Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac7e22dc authored by Eric Paris's avatar Eric Paris
Browse files

fanotify: allow userspace to override max marks 



Some fanotify groups, especially those like AV scanners, will need to place
lots of marks, particularly ignore marks.  Since ignore marks do not pin
inodes in cache and are cleared if the inode is removed from core (usually
under memory pressure) we expose an interface for listeners, with
CAP_SYS_ADMIN, to override the maximum number of marks and be allowed to
set and 'unlimited' number of marks.  Programs which make use of this
feature will be able to OOM a machine.

Signed-off-by: default avatarEric Paris <eparis@redhat.com>
parent e7099d8a

fs/notify/fanotify/fanotify_user.c

+8 −1
Original line number Diff line number Diff line
@@ -707,7 +707,14 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags) 
		group->max_events = FANOTIFY_DEFAULT_MAX_EVENTS;

	}



	if (flags & FAN_UNLIMITED_MARKS) {

		fd = -EPERM;

		if (!capable(CAP_SYS_ADMIN))

			goto out_put_group;

		group->fanotify_data.max_marks = UINT_MAX;

	} else {

		group->fanotify_data.max_marks = FANOTIFY_DEFAULT_MAX_MARKS;

	}



	fd = anon_inode_getfd("[fanotify]", &fanotify_fops, group, f_flags);

	if (fd < 0)

include/linux/fanotify.h

+3 −1
Original line number Diff line number Diff line
@@ -32,9 +32,11 @@ 
				 FAN_CLASS_PRE_CONTENT)



#define FAN_UNLIMITED_QUEUE	0x00000010

#define FAN_UNLIMITED_MARKS	0x00000020



#define FAN_ALL_INIT_FLAGS	(FAN_CLOEXEC | FAN_NONBLOCK | \

				 FAN_ALL_CLASS_BITS | FAN_UNLIMITED_QUEUE)

				 FAN_ALL_CLASS_BITS | FAN_UNLIMITED_QUEUE |\

				 FAN_UNLIMITED_MARKS)



/* flags used for fanotify_modify_mark() */

#define FAN_MARK_ADD		0x00000001