[PATCH v4 4/4] vfs: add notifications for mount attribute change

Amir Goldstein amir73il at gmail.com
Fri Jan 24 09:09:57 UTC 2025


On Thu, Jan 23, 2025 at 8:41 PM Miklos Szeredi <mszeredi at redhat.com> wrote:
>
> Notify when mount flags, propagation or idmap changes.
>
> Just like attach and detach, no details are given in the notification, only
> the mount ID.
>
> Signed-off-by: Miklos Szeredi <mszeredi at redhat.com>
> ---

My only nit this time is that I prefer the fsnotify/fanotify bits here
to be in patches 1,2
which as you write, only add the infrastructure to be used later.

[...]

> --- a/fs/notify/fanotify/fanotify.h
> +++ b/fs/notify/fanotify/fanotify.h
> @@ -471,7 +471,7 @@ static inline bool fanotify_is_error_event(u32 mask)
>
>  static inline bool fanotify_is_mnt_event(u32 mask)
>  {
> -       return mask & (FAN_MNT_ATTACH | FAN_MNT_DETACH);
> +       return mask & FANOTIFY_MOUNT_EVENTS;
>  }
>

This should have used the macro from the first use in patch 2.

[...]

> diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
> index 6c3e3a4a7b10..54e01803e309 100644
> --- a/include/linux/fsnotify_backend.h
> +++ b/include/linux/fsnotify_backend.h
> @@ -58,6 +58,8 @@
>
>  #define FS_MNT_ATTACH          0x01000000      /* Mount was attached */
>  #define FS_MNT_DETACH          0x02000000      /* Mount was detached */
> +#define FS_MNT_CHANGE          0x04000000      /* Mount was changed */
> +
>  #define FS_MNT_MOVE            (FS_MNT_ATTACH | FS_MNT_DETACH)
>
>  /*
> @@ -106,7 +108,8 @@
>                              FS_EVENTS_POSS_ON_CHILD | \
>                              FS_DELETE_SELF | FS_MOVE_SELF | \
>                              FS_UNMOUNT | FS_Q_OVERFLOW | FS_IN_IGNORED | \
> -                            FS_ERROR | FS_MNT_ATTACH | FS_MNT_DETACH)
> +                            FS_ERROR | \
> +                            FS_MNT_ATTACH | FS_MNT_DETACH | FS_MNT_CHANGE )

Please add those bits as a group in patch 1:

@@ -80,6 +80,9 @@
  */
 #define ALL_FSNOTIFY_DIRENT_EVENTS (FS_CREATE | FS_DELETE | FS_MOVE |
FS_RENAME)

+/* Mount namespace events */
+#define FSNOTIFY_MNT_EVENTS (FS_MNT_ATTACH | FS_MNT_DETACH | FS_MNT_CHANGE)
+
 /* Content events can be used to inspect file content */
 #define FSNOTIFY_CONTENT_PERM_EVENTS (FS_OPEN_PERM | FS_OPEN_EXEC_PERM | \
                                      FS_ACCESS_PERM)
@@ -108,6 +111,7 @@

 /* Events that can be reported to backends */
 #define ALL_FSNOTIFY_EVENTS (ALL_FSNOTIFY_DIRENT_EVENTS | \
+                            FSNOTIFY_MNT_EVENTS | \
                             FS_EVENTS_POSS_ON_CHILD | \

I am aware of the inconsistency of the names ALL_FSNOTIFY_* and FSNOTIFY_*
but if you look at master as of last night you will find:

FSNOTIFY_CONTENT_PERM_EVENTS and FSNOTIFY_PRE_CONTENT_EVENTS

(please rebase)

One day we may cleanup ALL_FSNOTIFY_DIRENT_EVENTS and
ALL_FSNOTIFY_PERM_EVENTS to conform.

Thanks,
Amir.



More information about the Linux-security-module-archive mailing list