Linux-Fsdevel Archive on
help / color / mirror / Atom feed
From: Amir Goldstein <>
To: Tycho Kirchner <>
Cc: Matthew Bobrowski <>,
	linux-fsdevel <>
Subject: Re: fanotify feature request FAN_MARK_PID
Date: Sun, 23 Aug 2020 16:04:39 +0300	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

> Any further help is appreciated.

A patch along those line (fill in the missing pieces) looks useful to me.
It could serve a use case where applications are using fanotify filesystem
mark, but developer would like to limit those application's scope inside
"system containers".

Perhaps an even more useful API would be FAN_FILTER_MOUNT_NS.
FAN_FILTER_PID_NS effectively means that kernel will drop events
that are expected to report pid 0.
FAN_FILTER_MOUNT_NS would mean that kernel will drop events that
are expected to report an fd, whose /proc/<pid>/fd/<fd> symlink cannot
be resolved (it shows "/") because the file's mount is outside the scope
of the listener's mount namespace.

The burden of proof that this will be useful is still on you ;-)


--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -685,6 +685,11 @@ static int fanotify_handle_event(struct
fsnotify_group *group, u32 mask,

        pr_debug("%s: group=%p mask=%x\n", __func__, group, mask);

+       /* Interested only in events from group's pid ns */
+       if (FAN_GROUP_FLAG(group, FAN_FILTER_PID_NS) &&
+           !pid_nr_ns(task_pid(current), group->fanotify_data.pid_ns))
+               return 0;
        if (fanotify_is_perm_event(mask)) {
                 * fsnotify_prepare_user_wait() fails if we race with mark

  reply	other threads:[~2020-08-23 13:04 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-17 16:08 Tycho Kirchner
2020-08-17 17:02 ` Amir Goldstein
2020-08-22 22:47   ` Tycho Kirchner
2020-08-23 13:04     ` Amir Goldstein [this message]
2020-08-28  8:46       ` Jan Kara

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='' \ \ \ \ \
    --subject='Re: fanotify feature request FAN_MARK_PID' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).