[PATCH v3 0/2] User namespace aware fanotify

[Amir Goldstein <amir73il@gmail.com>]

Jan,

Considering that the review discussion on v2 [1] did not yet converge
and considering that the merge window is very close, I realized
there is a way that we can simplify the controversial part.

There are two main use cases to allow setting marks inside user ns:

1. Christian added support for open_by_handle_at(2) to admin inside
   userns, which makes watching FS_USERNS_MOUNT sb more useful.
2. The mount events added by Miklos would be very useful also inside
   userns.

The rule for watching mntns inside user ns is pretty obvious and so
is the rule for watching an sb inside user ns.

The complexity discussed in review of v2 revolved around the more
complicated rules for watching fs events on a specific mount inside
users ns.

My realization is that watching fs events on a mount inside user ns
is a less intersting use case and it is much easier to apply the same
obvious rules as for watching an sb inside user ns and discuss
relaxing them later if there is any interesting use case for that.

mntns watch inside user ns was tested with the mount-notify_test_ns
selftest [2]. sb/mount watches inside user ns were tested manually
with fsnotifywatch -S and -M with some changes to inotify-tools [3].

Thanks,
Amir.

Changes since v2:
- selftest merged to Christian's tree
- Change mount mark to require capable sb user ns
- Remove incorrect reference to FS_USERNS_MOUNT in comments (Miklos)
- Avoid unneeded type casting to mntns (Miklos)

Changes since v1:
- Split cleanup patch (Jan)
- Logic simplified a bit
- Add support for mntns marks inside userns

[1] https://lore.kernel.org/linux-fsdevel/20250419100657.2654744-1-amir73il@gmail.com/
[2] https://lore.kernel.org/linux-fsdevel/20250509133240.529330-1-amir73il@gmail.com/
[3] https://github.com/amir73il/inotify-tools/commits/fanotify_userns/

Amir Goldstein (2):
  fanotify: remove redundant permission checks
  fanotify: support watching filesystems and mounts inside userns

 fs/notify/fanotify/fanotify.c      |  1 +
 fs/notify/fanotify/fanotify_user.c | 50 +++++++++++++++++-------------
 include/linux/fanotify.h           |  5 ++-
 include/linux/fsnotify_backend.h   |  1 +
 4 files changed, 33 insertions(+), 24 deletions(-)

-- 
2.34.1