lkml.org 
[lkml]   [2019]   [Jun]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] fanotify: remove redundant capable(CAP_SYS_ADMIN)s
    On Thu, May 23, 2019 at 01:25:08PM +0300, Amir Goldstein wrote:

    ...

    > > > > Interesting. When do you think the gate can be removed?
    > > >
    > > > Nobody is working on this AFAIK.
    > > > What I posted was a simple POC, but I have no use case for this.
    > > > In the patchwork link above, Jan has listed the prerequisites for
    > > > removing the gate.
    > > >
    > > > One of the prerequisites is FAN_REPORT_FID, which is now merged.
    > > > When events gets reported with fid instead of fd, unprivileged user
    > > > (hopefully) cannot use fid for privilege escalation.
    > > >
    > > > > I was looking into switching from inotify to fanotify but since it's not usable from
    > > > > non-initial userns it's a no-no
    > > > > since we support nested workloads.
    > > >
    > > > One of Jan's questions was what is the benefit of using inotify-compatible
    > > > fanotify vs. using inotify.
    > > > So what was the reason you were looking into switching from inotify to fanotify?
    > > > Is it because of mount/filesystem watch? Because making those available for
    > >
    > > Yeah. Well, I would need to look but you could probably do it safely for
    > > filesystems mountable in user namespaces (which are few).
    > > Can you do a bind-mount and then place a watch on the bind-mount or is
    > > this superblock based?
    > >
    >
    > Either.
    > FAN_MARK_MOUNT was there from day 1 of fanotify.
    > FAN_MARK_FILESYSTEM was merged to Linux Linux 4.20.
    >
    > But directory modification events that are supported since v5.1 are
    > not available
    > with FAN_MARK_MOUNT, see:
    > https://github.com/amir73il/man-pages/blob/fanotify_fid/man2/fanotify_init.2#L97
    >
    > Matthew,
    >
    > Perhaps this fact is worth a mention in the linked entry for FAN_REPORT_FID
    > in fanotify_init.2 in addition to the comment on the entry for FAN_MARK_MOUNT
    > in fanotify_mark.2.

    Sorry, a little late to the party...

    The fact being that directory modification events that are supported since v5.1
    are not available when used in conjunction with FAN_MARK_MOUNT?

    --
    Matthew Bobrowski

    \
     
     \ /
      Last update: 2019-06-05 12:26    [W:6.397 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site