fanotify: remove redundant permission checks

FAN_UNLIMITED_QUEUE and FAN_UNLIMITED_MARK flags are already checked
as part of the CAP_SYS_ADMIN check for any FANOTIFY_ADMIN_INIT_FLAGS.

Remove the individual CAP_SYS_ADMIN checks for these flags.

Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20250516192803.838659-2-amir73il@gmail.com

diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index f2d840ae4ded8870b46f6862ebe7f7886c73bd4c..24112b0992beb67b99078eac88450e0da9c65d59 100644 (file)
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -1334,6 +1334,7 @@ static struct fsnotify_mark *fanotify_add_new_mark(struct fsnotify_group *group,
         * A group with FAN_UNLIMITED_MARKS does not contribute to mark count
         * in the limited groups account.
         */
+       BUILD_BUG_ON(!(FANOTIFY_ADMIN_INIT_FLAGS & FAN_UNLIMITED_MARKS));
        if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS) &&
            !inc_ucount(ucounts->ns, ucounts->uid, UCOUNT_FANOTIFY_MARKS))
                return ERR_PTR(-ENOSPC);
@@ -1637,21 +1638,13 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
                goto out_destroy_group;
        }
 
+       BUILD_BUG_ON(!(FANOTIFY_ADMIN_INIT_FLAGS & FAN_UNLIMITED_QUEUE));
        if (flags & FAN_UNLIMITED_QUEUE) {
-               fd = -EPERM;
-               if (!capable(CAP_SYS_ADMIN))
-                       goto out_destroy_group;
                group->max_events = UINT_MAX;
        } else {
                group->max_events = fanotify_max_queued_events;
        }
 
-       if (flags & FAN_UNLIMITED_MARKS) {
-               fd = -EPERM;
-               if (!capable(CAP_SYS_ADMIN))
-                       goto out_destroy_group;
-       }
-
        if (flags & FAN_ENABLE_AUDIT) {
                fd = -EPERM;
                if (!capable(CAP_AUDIT_WRITE))