fanotify: support watching filesystems and mounts inside userns

An unprivileged user is allowed to create an fanotify group and add
inode marks, but not filesystem, mntns and mount marks.

Add limited support for setting up filesystem, mntns and mount marks by
an unprivileged user under the following conditions:

1.   User has CAP_SYS_ADMIN in the user ns where the group was created
2.a. User has CAP_SYS_ADMIN in the user ns where the sb was created
  OR (in case setting up a mntns mark)
2.b. User has CAP_SYS_ADMIN in the user ns associated with the mntns

Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20250516192803.838659-3-amir73il@gmail.com

diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 7bc5580a91dc6a277c841a24dbda68787a1e6999..3083643b864b838f832ce0d3a7d9af67fbe6aa60 100644 (file)
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -1009,6 +1009,7 @@ finish:
 
 static void fanotify_free_group_priv(struct fsnotify_group *group)
 {
+       put_user_ns(group->user_ns);
        kfree(group->fanotify_data.merge_hash);
        if (group->fanotify_data.ucounts)
                dec_ucount(group->fanotify_data.ucounts,

diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 24112b0992beb67b99078eac88450e0da9c65d59..b4a1626f6b8e6ecb1e7745d5e3b471882f2d66c8 100644 (file)
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -1499,6 +1499,7 @@ static struct hlist_head *fanotify_alloc_merge_hash(void)
 /* fanotify syscalls */
 SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
 {
+       struct user_namespace *user_ns = current_user_ns();
        struct fsnotify_group *group;
        int f_flags, fd;
        unsigned int fid_mode = flags & FANOTIFY_FID_BITS;
@@ -1513,10 +1514,11 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
                /*
                 * An unprivileged user can setup an fanotify group with
                 * limited functionality - an unprivileged group is limited to
-                * notification events with file handles and it cannot use
-                * unlimited queue/marks.
+                * notification events with file handles or mount ids and it
+                * cannot use unlimited queue/marks.
                 */
-               if ((flags & FANOTIFY_ADMIN_INIT_FLAGS) || !fid_mode)
+               if ((flags & FANOTIFY_ADMIN_INIT_FLAGS) ||
+                   !(flags & (FANOTIFY_FID_BITS | FAN_REPORT_MNT)))
                        return -EPERM;
 
                /*
@@ -1595,8 +1597,7 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
        }
 
        /* Enforce groups limits per user in all containing user ns */
-       group->fanotify_data.ucounts = inc_ucount(current_user_ns(),
-                                                 current_euid(),
+       group->fanotify_data.ucounts = inc_ucount(user_ns, current_euid(),
                                                  UCOUNT_FANOTIFY_GROUPS);
        if (!group->fanotify_data.ucounts) {
                fd = -EMFILE;
@@ -1605,6 +1606,7 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
 
        group->fanotify_data.flags = flags | internal_flags;
        group->memcg = get_mem_cgroup_from_mm(current->mm);
+       group->user_ns = get_user_ns(user_ns);
 
        group->fanotify_data.merge_hash = fanotify_alloc_merge_hash();
        if (!group->fanotify_data.merge_hash) {
@@ -1804,6 +1806,8 @@ static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask,
        struct fsnotify_group *group;
        struct path path;
        struct fan_fsid __fsid, *fsid = NULL;
+       struct user_namespace *user_ns = NULL;
+       struct mnt_namespace *mntns;
        u32 valid_mask = FANOTIFY_EVENTS | FANOTIFY_EVENT_FLAGS;
        unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS;
        unsigned int mark_cmd = flags & FANOTIFY_MARK_CMD_BITS;
@@ -1897,12 +1901,10 @@ static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask,
        }
 
        /*
-        * An unprivileged user is not allowed to setup mount nor filesystem
-        * marks.  This also includes setting up such marks by a group that
-        * was initialized by an unprivileged user.
+        * A user is allowed to setup sb/mount/mntns marks only if it is
+        * capable in the user ns where the group was created.
         */
-       if ((!capable(CAP_SYS_ADMIN) ||
-            FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV)) &&
+       if (!ns_capable(group->user_ns, CAP_SYS_ADMIN) &&
            mark_type != FAN_MARK_INODE)
                return -EPERM;
 
@@ -1986,18 +1988,31 @@ static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask,
                fsid = &__fsid;
        }
 
-       /* inode held in place by reference to path; group by fget on fd */
+       /*
+        * In addition to being capable in the user ns where group was created,
+        * the user also needs to be capable in the user ns associated with
+        * the filesystem or in the user ns associated with the mntns
+        * (when marking mntns).
+        */
        if (obj_type == FSNOTIFY_OBJ_TYPE_INODE) {
                inode = path.dentry->d_inode;
                obj = inode;
        } else if (obj_type == FSNOTIFY_OBJ_TYPE_VFSMOUNT) {
+               user_ns = path.mnt->mnt_sb->s_user_ns;
                obj = path.mnt;
        } else if (obj_type == FSNOTIFY_OBJ_TYPE_SB) {
+               user_ns = path.mnt->mnt_sb->s_user_ns;
                obj = path.mnt->mnt_sb;
        } else if (obj_type == FSNOTIFY_OBJ_TYPE_MNTNS) {
-               obj = mnt_ns_from_dentry(path.dentry);
+               mntns = mnt_ns_from_dentry(path.dentry);
+               user_ns = mntns->user_ns;
+               obj = mntns;
        }
 
+       ret = -EPERM;
+       if (user_ns && !ns_capable(user_ns, CAP_SYS_ADMIN))
+               goto path_put_and_out;
+
        ret = -EINVAL;
        if (!obj)
                goto path_put_and_out;

diff --git a/include/linux/fanotify.h b/include/linux/fanotify.h
index 3c817dc6292ea4fc710a925e204ebbecb89e2ee3..879cff5eccd4e30739c2b084d26f7144ad64e522 100644 (file)
--- a/include/linux/fanotify.h
+++ b/include/linux/fanotify.h
@@ -38,8 +38,7 @@
                                         FAN_REPORT_PIDFD | \
                                         FAN_REPORT_FD_ERROR | \
                                         FAN_UNLIMITED_QUEUE | \
-                                        FAN_UNLIMITED_MARKS | \
-                                        FAN_REPORT_MNT)
+                                        FAN_UNLIMITED_MARKS)
 
 /*
  * fanotify_init() flags that are allowed for user without CAP_SYS_ADMIN.
@@ -48,7 +47,7 @@
  * so one of the flags for reporting file handles is required.
  */
 #define FANOTIFY_USER_INIT_FLAGS       (FAN_CLASS_NOTIF | \
-                                        FANOTIFY_FID_BITS | \
+                                        FANOTIFY_FID_BITS | FAN_REPORT_MNT | \
                                         FAN_CLOEXEC | FAN_NONBLOCK)
 
 #define FANOTIFY_INIT_FLAGS    (FANOTIFY_ADMIN_INIT_FLAGS | \

diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index 6cd8d1d28b8be4406356a2ad3db02bbb9d674680..7dd22db06317cfe808c9de4c3fb905c9b5870a77 100644 (file)
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -250,6 +250,7 @@ struct fsnotify_group {
                                                 * full */
 
        struct mem_cgroup *memcg;       /* memcg to charge allocations */
+       struct user_namespace *user_ns; /* user ns where group was created */
 
        /* groups can define private fields here or use the void *private */
        union {