man2/fanotify_mark.2

   1 .\" Copyright (C) 2013,  Heinrich Schuchardt <xypron.glpk@gmx.de>
   2 .\"
   3 .\" SPDX-License-Identifier: Linux-man-pages-copyleft
   4 .TH FANOTIFY_MARK 2 (date) "Linux man-pages (unreleased)"
   5 .SH NAME
   6 fanotify_mark \- add, remove, or modify an fanotify mark on a filesystem
   7 object
   8 .SH LIBRARY
   9 Standard C library
  10 .RI ( libc ", " \-lc )
  11 .SH SYNOPSIS
  12 .nf
  13 .B #include <sys/fanotify.h>
  14 .PP
  15 .BI "int fanotify_mark(int " fanotify_fd ", unsigned int " flags ,
  16 .BI "                  uint64_t " mask ", int " dirfd \
  17 ", const char *" pathname );
  18 .fi
  19 .SH DESCRIPTION
  20 For an overview of the fanotify API, see
  21 .BR fanotify (7).
  22 .PP
  23 .BR fanotify_mark ()
  24 adds, removes, or modifies an fanotify mark on a filesystem object.
  25 The caller must have read permission on the filesystem object that
  26 is to be marked.
  27 .PP
  28 The
  29 .I fanotify_fd
  30 argument is a file descriptor returned by
  31 .BR fanotify_init (2).
  32 .PP
  33 .I flags
  34 is a bit mask describing the modification to perform.
  35 It must include exactly one of the following values:
  36 .TP
  37 .B FAN_MARK_ADD
  38 The events in
  39 .I mask
  40 will be added to the mark mask (or to the ignore mask).
  41 .I mask
  42 must be nonempty or the error
  43 .B EINVAL
  44 will occur.
  45 .TP
  46 .B FAN_MARK_REMOVE
  47 The events in argument
  48 .I mask
  49 will be removed from the mark mask (or from the ignore mask).
  50 .I mask
  51 must be nonempty or the error
  52 .B EINVAL
  53 will occur.
  54 .TP
  55 .B FAN_MARK_FLUSH
  56 Remove either all marks for filesystems, all marks for mounts, or all
  57 marks for directories and files from the fanotify group.
  58 If
  59 .I flags
  60 contains
  61 .BR FAN_MARK_MOUNT ,
  62 all marks for mounts are removed from the group.
  63 If
  64 .I flags
  65 contains
  66 .BR FAN_MARK_FILESYSTEM ,
  67 all marks for filesystems are removed from the group.
  68 Otherwise, all marks for directories and files are removed.
  69 No flag other than, and at most one of, the flags
  70 .B FAN_MARK_MOUNT
  71 or
  72 .B FAN_MARK_FILESYSTEM
  73 can be used in conjunction with
  74 .BR FAN_MARK_FLUSH .
  75 .I mask
  76 is ignored.
  77 .PP
  78 If none of the values above is specified, or more than one is specified,
  79 the call fails with the error
  80 .BR EINVAL .
  81 .PP
  82 In addition,
  83 zero or more of the following values may be ORed into
  84 .IR flags :
  85 .TP
  86 .B FAN_MARK_DONT_FOLLOW
  87 If
  88 .I pathname
  89 is a symbolic link, mark the link itself, rather than the file to which it
  90 refers.
  91 (By default,
  92 .BR fanotify_mark ()
  93 dereferences
  94 .I pathname
  95 if it is a symbolic link.)
  96 .TP
  97 .B FAN_MARK_ONLYDIR
  98 If the filesystem object to be marked is not a directory, the error
  99 .B ENOTDIR
 100 shall be raised.
 101 .TP
 102 .B FAN_MARK_MOUNT
 103 Mark the mount specified by
 104 .IR pathname .
 105 If
 106 .I pathname
 107 is not itself a mount point, the mount containing
 108 .I pathname
 109 will be marked.
 110 All directories, subdirectories, and the contained files of the mount
 111 will be monitored.
 112 The events which require that filesystem objects are identified by file handles,
 113 such as
 114 .BR FAN_CREATE ,
 115 .BR FAN_ATTRIB ,
 116 .BR FAN_MOVE ,
 117 and
 118 .BR FAN_DELETE_SELF ,
 119 cannot be provided as a
 120 .I mask
 121 when
 122 .I flags
 123 contains
 124 .BR FAN_MARK_MOUNT .
 125 Attempting to do so will result in the error
 126 .B EINVAL
 127 being returned.
 128 Use of this flag requires the
 129 .B CAP_SYS_ADMIN
 130 capability.
 131 .TP
 132 .BR FAN_MARK_FILESYSTEM " (since Linux 4.20)"
 133 .\" commit d54f4fba889b205e9cd8239182ca5d27d0ac3bc2
 134 Mark the filesystem specified by
 135 .IR pathname .
 136 The filesystem containing
 137 .I pathname
 138 will be marked.
 139 All the contained files and directories of the filesystem from any mount
 140 point will be monitored.
 141 Use of this flag requires the
 142 .B CAP_SYS_ADMIN
 143 capability.
 144 .TP
 145 .B FAN_MARK_IGNORED_MASK
 146 The events in
 147 .I mask
 148 shall be added to or removed from the ignore mask.
 149 Note that the flags
 150 .BR FAN_ONDIR ,
 151 and
 152 .B FAN_EVENT_ON_CHILD
 153 have no effect when provided with this flag.
 154 The effect of setting the flags
 155 .BR FAN_ONDIR ,
 156 and
 157 .B FAN_EVENT_ON_CHILD
 158 in the mark mask
 159 on the events that are set in the ignore mask
 160 is undefined and depends on the Linux kernel version.
 161 Specifically, prior to Linux 5.9,
 162 .\" commit 497b0c5a7c0688c1b100a9c2e267337f677c198e
 163 setting a mark mask on a file
 164 and a mark with ignore mask on its parent directory
 165 would not result in ignoring events on the file,
 166 regardless of the
 167 .B FAN_EVENT_ON_CHILD
 168 flag in the parent directory's mark mask.
 169 When the ignore mask is updated with the
 170 .B FAN_MARK_IGNORED_MASK
 171 flag
 172 on a mark that was previously updated with the
 173 .B FAN_MARK_IGNORE
 174 flag,
 175 the update fails with
 176 .B EEXIST
 177 error.
 178 .TP
 179 .BR FAN_MARK_IGNORE " (since Linux 6.0)"
 180 .\" commit e252f2ed1c8c6c3884ab5dd34e003ed21f1fe6e0
 181 This flag has a similar effect as setting the
 182 .B FAN_MARK_IGNORED_MASK
 183 flag.
 184 The events in
 185 .I mask
 186 shall be added to or removed from the ignore mask.
 187 Unlike the
 188 .B FAN_MARK_IGNORED_MASK
 189 flag,
 190 this flag also has the effect that the
 191 .BR FAN_ONDIR ,
 192 and
 193 .B FAN_EVENT_ON_CHILD
 194 flags take effect on the ignore mask.
 195 Specifically, unless the
 196 .B FAN_ONDIR
 197 flag is set with
 198 .BR FAN_MARK_IGNORE ,
 199 events on directories will not be ignored.
 200 If the flag
 201 .B FAN_EVENT_ON_CHILD
 202 is set with
 203 .BR FAN_MARK_IGNORE ,
 204 events on children will be ignored.
 205 For example,
 206 a mark on a directory with combination of
 207 a mask with
 208 .B FAN_CREATE
 209 event
 210 and
 211 .B FAN_ONDIR
 212 flag
 213 and an ignore mask with
 214 .B FAN_CREATE
 215 event
 216 and without
 217 .B FAN_ONDIR
 218 flag,
 219 will result in getting only
 220 the events for creation of sub-directories.
 221 When using the
 222 .B FAN_MARK_IGNORE
 223 flag to add to an ignore mask
 224 of a mount,
 225 filesystem,
 226 or directory inode mark,
 227 the
 228 .B FAN_MARK_IGNORED_SURV_MODIFY
 229 flag must be specified.
 230 Failure to do so will results with
 231 .B EINVAL
 232 or
 233 .B EISDIR
 234 error.
 235 .TP
 236 .B FAN_MARK_IGNORED_SURV_MODIFY
 237 The ignore mask shall survive modify events.
 238 If this flag is not set,
 239 the ignore mask is cleared when a modify event occurs
 240 on the marked object.
 241 Omitting this flag is typically used to suppress events
 242 (e.g.,
 243 .BR FAN_OPEN )
 244 for a specific file,
 245 until that specific file's content has been modified.
 246 It is far less useful to suppress events
 247 on an entire filesystem,
 248 or mount,
 249 or on all files inside a directory,
 250 until some file's content has been modified.
 251 For this reason,
 252 the
 253 .B FAN_MARK_IGNORE
 254 flag requires the
 255 .B FAN_MARK_IGNORED_SURV_MODIFY
 256 flag on a mount,
 257 filesystem,
 258 or directory inode mark.
 259 This flag cannot be removed from a mark once set.
 260 When the ignore mask is updated without this flag
 261 on a mark that was previously updated with the
 262 .B FAN_MARK_IGNORE
 263 and
 264 .B FAN_MARK_IGNORED_SURV_MODIFY
 265 flags,
 266 the update fails with
 267 .B EEXIST
 268 error.
 269 .TP
 270 .B FAN_MARK_IGNORE_SURV
 271 This is a synonym for
 272 .RB ( FAN_MARK_IGNORE | FAN_MARK_IGNORED_SURV_MODIFY ).
 273 .TP
 274 .BR FAN_MARK_EVICTABLE " (since Linux 5.19)"
 275 .\" commit 5f9d3bd520261fd7a850818c71809fd580e0f30c
 276 When an inode mark is created with this flag,
 277 the inode object will not be pinned to the inode cache,
 278 therefore,
 279 allowing the inode object to be evicted from the inode cache
 280 when the memory pressure on the system is high.
 281 The eviction of the inode object
 282 results in the evictable mark also being lost.
 283 When the mask of an evictable inode mark is updated
 284 without using the
 285 .B FAN_MARK_EVICATBLE
 286 flag,
 287 the marked inode is pinned to inode cache
 288 and the mark is no longer evictable.
 289 When the mask of a non-evictable inode mark is updated
 290 with the
 291 .B FAN_MARK_EVICTABLE
 292 flag,
 293 the inode mark remains non-evictable
 294 and the update fails with
 295 .B EEXIST
 296 error.
 297 Mounts and filesystems are not evictable objects,
 298 therefore,
 299 an attempt to create a mount mark or a filesystem mark
 300 with the
 301 .B FAN_MARK_EVICTABLE
 302 flag,
 303 will result in the error
 304 .BR EINVAL .
 305 For example,
 306 inode marks can be used in combination with mount marks
 307 to reduce the amount of events from noninteresting paths.
 308 The event listener reads events,
 309 checks if the path reported in the event is of interest,
 310 and if it is not,
 311 the listener sets a mark with an ignore mask on the directory.
 312 Evictable inode marks allow using this method for a large number of directories
 313 without the concern of pinning all inodes and exhausting the system's memory.
 314 .PP
 315 .I mask
 316 defines which events shall be listened for (or which shall be ignored).
 317 It is a bit mask composed of the following values:
 318 .TP
 319 .B FAN_ACCESS
 320 Create an event when a file or directory (but see BUGS) is accessed (read).
 321 .TP
 322 .B FAN_MODIFY
 323 Create an event when a file is modified (write).
 324 .TP
 325 .B FAN_CLOSE_WRITE
 326 Create an event when a writable file is closed.
 327 .TP
 328 .B FAN_CLOSE_NOWRITE
 329 Create an event when a read-only file or directory is closed.
 330 .TP
 331 .B FAN_OPEN
 332 Create an event when a file or directory is opened.
 333 .TP
 334 .BR FAN_OPEN_EXEC " (since Linux 5.0)"
 335 .\" commit 9b076f1c0f4869b838a1b7aa0edb5664d47ec8aa
 336 Create an event when a file is opened with the intent to be executed.
 337 See NOTES for additional details.
 338 .TP
 339 .BR FAN_ATTRIB " (since Linux 5.1)"
 340 .\" commit 235328d1fa4251c6dcb32351219bb553a58838d2
 341 Create an event when the metadata for a file or directory has changed.
 342 An fanotify group that identifies filesystem objects by file handles
 343 is required.
 344 .TP
 345 .BR FAN_CREATE " (since Linux 5.1)"
 346 .\" commit 235328d1fa4251c6dcb32351219bb553a58838d2
 347 Create an event when a file or directory has been created in a marked
 348 parent directory.
 349 An fanotify group that identifies filesystem objects by file handles
 350 is required.
 351 .TP
 352 .BR FAN_DELETE " (since Linux 5.1)"
 353 .\" commit 235328d1fa4251c6dcb32351219bb553a58838d2
 354 Create an event when a file or directory has been deleted in a marked
 355 parent directory.
 356 An fanotify group that identifies filesystem objects by file handles
 357 is required.
 358 .TP
 359 .BR FAN_DELETE_SELF " (since Linux 5.1)"
 360 .\" commit 235328d1fa4251c6dcb32351219bb553a58838d2
 361 Create an event when a marked file or directory itself is deleted.
 362 An fanotify group that identifies filesystem objects by file handles
 363 is required.
 364 .TP
 365 .BR FAN_FS_ERROR " (since Linux 5.16)"
 366 .\" commit 9709bd548f11a092d124698118013f66e1740f9b
 367 Create an event when a filesystem error
 368 leading to inconsistent filesystem metadata is detected.
 369 An additional information record of type
 370 .B FAN_EVENT_INFO_TYPE_ERROR
 371 is returned for each event in the read buffer.
 372 An fanotify group that identifies filesystem objects by file handles
 373 is required.
 374 .IP
 375 Events of such type are dependent on support
 376 from the underlying filesystem.
 377 At the time of writing,
 378 only the
 379 .B ext4
 380 filesystem reports
 381 .B FAN_FS_ERROR
 382 events.
 383 .IP
 384 See
 385 .BR fanotify (7)
 386 for additional details.
 387 .TP
 388 .BR FAN_MOVED_FROM " (since Linux 5.1)"
 389 .\" commit 235328d1fa4251c6dcb32351219bb553a58838d2
 390 Create an event when a file or directory has been moved from a marked
 391 parent directory.
 392 An fanotify group that identifies filesystem objects by file handles
 393 is required.
 394 .TP
 395 .BR FAN_MOVED_TO " (since Linux 5.1)"
 396 .\" commit 235328d1fa4251c6dcb32351219bb553a58838d2
 397 Create an event when a file or directory has been moved to a marked parent
 398 directory.
 399 An fanotify group that identifies filesystem objects by file handles
 400 is required.
 401 .TP
 402 .BR FAN_RENAME " (since Linux 5.17)"
 403 .\" commit 8cc3b1ccd930fe6971e1527f0c4f1bdc8cb56026
 404 This event contains the same information provided by events
 405 .B FAN_MOVED_FROM
 406 and
 407 .BR FAN_MOVED_TO ,
 408 however is represented by a single event with up to two information records.
 409 An fanotify group that identifies filesystem objects by file handles
 410 is required.
 411 If the filesystem object to be marked is not a directory, the error
 412 .B ENOTDIR
 413 shall be raised.
 414 .TP
 415 .BR FAN_MOVE_SELF " (since Linux 5.1)"
 416 .\" commit 235328d1fa4251c6dcb32351219bb553a58838d2
 417 Create an event when a marked file or directory itself has been moved.
 418 An fanotify group that identifies filesystem objects by file handles
 419 is required.
 420 .TP
 421 .B FAN_OPEN_PERM
 422 Create an event when a permission to open a file or directory is requested.
 423 An fanotify file descriptor created with
 424 .B FAN_CLASS_PRE_CONTENT
 425 or
 426 .B FAN_CLASS_CONTENT
 427 is required.
 428 .TP
 429 .BR FAN_OPEN_EXEC_PERM " (since Linux 5.0)"
 430 .\" commit 66917a3130f218dcef9eeab4fd11a71cd00cd7c9
 431 Create an event when a permission to open a file for execution is
 432 requested.
 433 An fanotify file descriptor created with
 434 .B FAN_CLASS_PRE_CONTENT
 435 or
 436 .B FAN_CLASS_CONTENT
 437 is required.
 438 See NOTES for additional details.
 439 .TP
 440 .B FAN_ACCESS_PERM
 441 Create an event when a permission to read a file or directory is requested.
 442 An fanotify file descriptor created with
 443 .B FAN_CLASS_PRE_CONTENT
 444 or
 445 .B FAN_CLASS_CONTENT
 446 is required.
 447 .TP
 448 .B FAN_ONDIR
 449 Create events for directories\(emfor example, when
 450 .BR opendir (3),
 451 .BR readdir (3)
 452 (but see BUGS), and
 453 .BR closedir (3)
 454 are called.
 455 Without this flag, events are created only for files.
 456 In the context of directory entry events, such as
 457 .BR FAN_CREATE ,
 458 .BR FAN_DELETE ,
 459 .BR FAN_MOVED_FROM ,
 460 and
 461 .BR FAN_MOVED_TO ,
 462 specifying the flag
 463 .B FAN_ONDIR
 464 is required in order to create events when subdirectory entries are
 465 modified (i.e.,
 466 .BR mkdir (2)/
 467 .BR rmdir (2)).
 468 .TP
 469 .B FAN_EVENT_ON_CHILD
 470 Events for the immediate children of marked directories shall be created.
 471 The flag has no effect when marking mounts and filesystems.
 472 Note that events are not generated for children of the subdirectories
 473 of marked directories.
 474 More specifically, the directory entry modification events
 475 .BR FAN_CREATE ,
 476 .BR FAN_DELETE ,
 477 .BR FAN_MOVED_FROM ,
 478 and
 479 .B FAN_MOVED_TO
 480 are not generated for any entry modifications performed inside subdirectories
 481 of marked directories.
 482 Note that the events
 483 .B FAN_DELETE_SELF
 484 and
 485 .B FAN_MOVE_SELF
 486 are not generated for children of marked directories.
 487 To monitor complete directory trees it is necessary to mark the relevant
 488 mount or filesystem.
 489 .PP
 490 The following composed values are defined:
 491 .TP
 492 .B FAN_CLOSE
 493 A file is closed
 494 .RB ( FAN_CLOSE_WRITE | FAN_CLOSE_NOWRITE ).
 495 .TP
 496 .B FAN_MOVE
 497 A file or directory has been moved
 498 .RB ( FAN_MOVED_FROM | FAN_MOVED_TO ).
 499 .PP
 500 The filesystem object to be marked is determined by the file descriptor
 501 .I dirfd
 502 and the pathname specified in
 503 .IR pathname :
 504 .IP * 3
 505 If
 506 .I pathname
 507 is NULL,
 508 .I dirfd
 509 defines the filesystem object to be marked.
 510 .IP *
 511 If
 512 .I pathname
 513 is NULL, and
 514 .I dirfd
 515 takes the special value
 516 .BR AT_FDCWD ,
 517 the current working directory is to be marked.
 518 .IP *
 519 If
 520 .I pathname
 521 is absolute, it defines the filesystem object to be marked, and
 522 .I dirfd
 523 is ignored.
 524 .IP *
 525 If
 526 .I pathname
 527 is relative, and
 528 .I dirfd
 529 does not have the value
 530 .BR AT_FDCWD ,
 531 then the filesystem object to be marked is determined by interpreting
 532 .I pathname
 533 relative the directory referred to by
 534 .IR dirfd .
 535 .IP *
 536 If
 537 .I pathname
 538 is relative, and
 539 .I dirfd
 540 has the value
 541 .BR AT_FDCWD ,
 542 then the filesystem object to be marked is determined by interpreting
 543 .I pathname
 544 relative to the current working directory.
 545 (See
 546 .BR openat (2)
 547 for an explanation of why the
 548 .I dirfd
 549 argument is useful.)
 550 .SH RETURN VALUE
 551 On success,
 552 .BR fanotify_mark ()
 553 returns 0.
 554 On error, \-1 is returned, and
 555 .I errno
 556 is set to indicate the error.
 557 .SH ERRORS
 558 .TP
 559 .B EBADF
 560 An invalid file descriptor was passed in
 561 .IR fanotify_fd .
 562 .TP
 563 .B EBADF
 564 .I pathname
 565 is relative but
 566 .I dirfd
 567 is neither
 568 .B AT_FDCWD
 569 nor a valid file descriptor.
 570 .TP
 571 .B EEXIST
 572 The filesystem object indicated by
 573 .I dirfd
 574 and
 575 .I pathname
 576 has a mark that was updated without the
 577 .B FAN_MARK_EVICTABLE
 578 flag,
 579 and the user attempted to update the mark with
 580 .B FAN_MARK_EVICTABLE
 581 flag.
 582 .TP
 583 .B EEXIST
 584 The filesystem object indicated by
 585 .I dirfd
 586 and
 587 .I pathname
 588 has a mark that was updated with the
 589 .B FAN_MARK_IGNORE
 590 flag,
 591 and the user attempted to update the mark with
 592 .B FAN_MARK_IGNORED_MASK
 593 flag.
 594 .TP
 595 .B EEXIST
 596 The filesystem object indicated by
 597 .I dirfd
 598 and
 599 .I pathname
 600 has a mark that was updated with the
 601 .B FAN_MARK_IGNORE
 602 and
 603 .B FAN_MARK_IGNORED_SURV_MODIFY
 604 flags,
 605 and the user attempted to update the mark only with
 606 .B FAN_MARK_IGNORE
 607 flag.
 608 .TP
 609 .B EINVAL
 610 An invalid value was passed in
 611 .I flags
 612 or
 613 .IR mask ,
 614 or
 615 .I fanotify_fd
 616 was not an fanotify file descriptor.
 617 .TP
 618 .B EINVAL
 619 The fanotify file descriptor was opened with
 620 .B FAN_CLASS_NOTIF
 621 or the fanotify group identifies filesystem objects by file handles
 622 and mask contains a flag for permission events
 623 .RB ( FAN_OPEN_PERM
 624 or
 625 .BR FAN_ACCESS_PERM ).
 626 .TP
 627 .B EINVAL
 628 The group was initialized without
 629 .B FAN_REPORT_FID
 630 but one or more event types specified in the
 631 .I mask
 632 require it.
 633 .TP
 634 .B EINVAL
 635 .I flags
 636 contains
 637 .BR FAN_MARK_IGNORE ,
 638 and either
 639 .B FAN_MARK_MOUNT
 640 or
 641 .BR FAN_MARK_FILESYSTEM ,
 642 but does not contain
 643 .BR FAN_MARK_IGNORED_SURV_MODIFY .
 644 .TP
 645 .B EISDIR
 646 .I flags
 647 contains
 648 .BR FAN_MARK_IGNORE ,
 649 but does not contain
 650 .BR FAN_MARK_IGNORED_SURV_MODIFY ,
 651 and
 652 .I dirfd
 653 and
 654 .I pathname
 655 specify a directory.
 656 .TP
 657 .B ENODEV
 658 The filesystem object indicated by
 659 .I dirfd
 660 and
 661 .I pathname
 662 is not associated with a filesystem that supports
 663 .I fsid
 664 (e.g.,
 665 .BR fuse (4)).
 666 .BR tmpfs (5)
 667 did not support
 668 .I fsid
 669 prior to Linux 5.13.
 670 .\" commit 59cda49ecf6c9a32fae4942420701b6e087204f6
 671 This error can be returned only with an fanotify group that identifies
 672 filesystem objects by file handles.
 673 .TP
 674 .B ENOENT
 675 The filesystem object indicated by
 676 .I dirfd
 677 and
 678 .I pathname
 679 does not exist.
 680 This error also occurs when trying to remove a mark from an object
 681 which is not marked.
 682 .TP
 683 .B ENOMEM
 684 The necessary memory could not be allocated.
 685 .TP
 686 .B ENOSPC
 687 The number of marks for this user exceeds the limit and the
 688 .B FAN_UNLIMITED_MARKS
 689 flag was not specified when the fanotify file descriptor was created with
 690 .BR fanotify_init (2).
 691 See
 692 .BR fanotify (7)
 693 for details about this limit.
 694 .TP
 695 .B ENOSYS
 696 This kernel does not implement
 697 .BR fanotify_mark ().
 698 The fanotify API is available only if the kernel was configured with
 699 .BR CONFIG_FANOTIFY .
 700 .TP
 701 .B ENOTDIR
 702 .I flags
 703 contains
 704 .BR FAN_MARK_ONLYDIR ,
 705 and
 706 .I dirfd
 707 and
 708 .I pathname
 709 do not specify a directory.
 710 .TP
 711 .B ENOTDIR
 712 .I mask
 713 contains
 714 .BR FAN_RENAME ,
 715 and
 716 .I dirfd
 717 and
 718 .I pathname
 719 do not specify a directory.
 720 .TP
 721 .B ENOTDIR
 722 .I flags
 723 contains
 724 .BR FAN_MARK_IGNORE ,
 725 or the fanotify group was initialized with flag
 726 .BR FAN_REPORT_TARGET_FID ,
 727 and
 728 .I mask
 729 contains directory entry modification events
 730 (e.g.,
 731 .BR FAN_CREATE ,
 732 .BR FAN_DELETE ),
 733 or directory event flags
 734 (e.g.,
 735 .BR FAN_ONDIR ,
 736 .BR FAN_EVENT_ON_CHILD ),
 737 and
 738 .I dirfd
 739 and
 740 .I pathname
 741 do not specify a directory.
 742 .TP
 743 .B EOPNOTSUPP
 744 The object indicated by
 745 .I pathname
 746 is associated with a filesystem that does not support the encoding of file
 747 handles.
 748 This error can be returned only with an fanotify group that identifies
 749 filesystem objects by file handles.
 750 .TP
 751 .B EPERM
 752 The operation is not permitted because the caller lacks a required capability.
 753 .TP
 754 .B EXDEV
 755 The filesystem object indicated by
 756 .I pathname
 757 resides within a filesystem subvolume (e.g.,
 758 .BR btrfs (5))
 759 which uses a different
 760 .I fsid
 761 than its root superblock.
 762 This error can be returned only with an fanotify group that identifies
 763 filesystem objects by file handles.
 764 .SH VERSIONS
 765 .BR fanotify_mark ()
 766 was introduced in version 2.6.36 of the Linux kernel and enabled in version
 767 2.6.37.
 768 .SH STANDARDS
 769 This system call is Linux-specific.
 770 .SH NOTES
 771 .SS FAN_OPEN_EXEC and FAN_OPEN_EXEC_PERM
 772 When using either
 773 .B FAN_OPEN_EXEC
 774 or
 775 .B FAN_OPEN_EXEC_PERM
 776 within the
 777 .IR mask ,
 778 events of these types will be returned only when the direct execution of a
 779 program occurs.
 780 More specifically, this means that events of these types will be generated
 781 for files that are opened using
 782 .BR execve (2),
 783 .BR execveat (2),
 784 or
 785 .BR uselib (2).
 786 Events of these types will not be raised in the situation where an
 787 interpreter is passed (or reads) a file for interpretation.
 788 .PP
 789 Additionally, if a mark has also been placed on the Linux dynamic
 790 linker, a user should also expect to receive an event for it when
 791 an ELF object has been successfully opened using
 792 .BR execve (2)
 793 or
 794 .BR execveat (2).
 795 .PP
 796 For example, if the following ELF binary were to be invoked and a
 797 .B FAN_OPEN_EXEC
 798 mark has been placed on /:
 799 .PP
 800 .in +4n
 801 .EX
 802 $ /bin/echo foo
 803 .EE
 804 .in
 805 .PP
 806 The listening application in this case would receive
 807 .B FAN_OPEN_EXEC
 808 events for both the ELF binary and interpreter, respectively:
 809 .PP
 810 .in +4n
 811 .EX
 812 /bin/echo
 813 /lib64/ld\-linux\-x86\-64.so.2
 814 .EE
 815 .in
 816 .SH BUGS
 817 The following bugs were present in Linux kernels before version 3.16:
 818 .IP * 3
 819 .\" Fixed by commit 0a8dd2db579f7a0ac7033d6b857c3d5dbaa77563
 820 If
 821 .I flags
 822 contains
 823 .BR FAN_MARK_FLUSH ,
 824 .IR dirfd ,
 825 and
 826 .I pathname
 827 must specify a valid filesystem object, even though this object is not used.
 828 .IP *
 829 .\" Fixed by commit d4c7cf6cffb1bc711a833b5e304ba5bcfe76398b
 830 .BR readdir (2)
 831 does not generate a
 832 .B FAN_ACCESS
 833 event.
 834 .IP *
 835 .\" Fixed by commit cc299a98eb13a9853675a9cbb90b30b4011e1406
 836 If
 837 .BR fanotify_mark ()
 838 is called with
 839 .BR FAN_MARK_FLUSH ,
 840 .I flags
 841 is not checked for invalid values.
 842 .SH SEE ALSO
 843 .BR fanotify_init (2),
 844 .BR fanotify (7)