linux-kernel - Re: Upcoming: Notifications, FS notifications and fsinfo()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3072811.1585842687@warthog.procyon.org.uk>
Date:   Thu, 02 Apr 2020 16:51:27 +0100
From:   David Howells <dhowells@...hat.com>
To:     Lennart Poettering <mzxreary@...inter.de>
Cc:     dhowells@...hat.com, Miklos Szeredi <miklos@...redi.hu>,
        Ian Kent <raven@...maw.net>,
        Christian Brauner <christian.brauner@...ntu.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Al Viro <viro@...iv.linux.org.uk>, dray@...hat.com,
        Karel Zak <kzak@...hat.com>,
        Miklos Szeredi <mszeredi@...hat.com>,
        Steven Whitehouse <swhiteho@...hat.com>,
        Jeff Layton <jlayton@...hat.com>, andres@...razel.de,
        keyrings@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, Aleksa Sarai <cyphar@...har.com>
Subject: Re: Upcoming: Notifications, FS notifications and fsinfo()

Lennart Poettering <mzxreary@...inter.de> wrote:

> systemd cares about all mount points in PID1's mount namespace.
> 
> The fact that mount tables can grow large is why we want something
> better than constantly reparsing the whole /proc/self/mountinfo. But
> filtering subsets of that is something we don't really care about.

With the notifications stuff I've done, you can do, for example:

	pipe2(pipefd, O_NOTIFICATION_PIPE);
	ioctl(pipefd[0], IOC_WATCH_QUEUE_SET_SIZE, 256);
	watch_mount(AT_FDCWD, "/", 0, pipefd[0], 0x02);

And that will catch all mount object changes in the subtree rooted at the
given path, in this case "/".

If you want to limit it to just the notifications on that mount, you would
need to install a filter:

	struct watch_notification_filter filter = {
		.nr_filters	= 1,
		.filters = {
			[0]	= {
				.type		= WATCH_TYPE_MOUNT_NOTIFY,
				.subtype_filter[0]= UINT_MAX,
				.info_mask	= NOTIFY_MOUNT_IS_RECURSIVE,
				.info_filter	= 0,
			},
		},
	};
	ioctl(fd, IOC_WATCH_QUEUE_SET_FILTER, &filter);

Note that this doesn't monitor for superblock changes and events.  They must
be watched individually with something like:

	watch_sb(AT_FDCWD, "/afs", AT_NO_AUTOMOUNT, pipefd[0], 0x27);

David