Commit 90d12380 authored by Amir Goldstein's avatar Amir Goldstein Committed by Jan Kara
Browse files

fanotify: remove redundant permission checks 



FAN_UNLIMITED_QUEUE and FAN_UNLIMITED_MARK flags are already checked
as part of the CAP_SYS_ADMIN check for any FANOTIFY_ADMIN_INIT_FLAGS.

Remove the individual CAP_SYS_ADMIN checks for these flags.

Signed-off-by: default avatarAmir Goldstein <amir73il@gmail.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20250516192803.838659-2-amir73il@gmail.com
parent b9b410cc

fs/notify/fanotify/fanotify_user.c

+2 −9
Original line number Diff line number Diff line
@@ -1334,6 +1334,7 @@ static struct fsnotify_mark *fanotify_add_new_mark(struct fsnotify_group *group, 
	 * A group with FAN_UNLIMITED_MARKS does not contribute to mark count

	 * in the limited groups account.

	 */

	BUILD_BUG_ON(!(FANOTIFY_ADMIN_INIT_FLAGS & FAN_UNLIMITED_MARKS));

	if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS) &&

	    !inc_ucount(ucounts->ns, ucounts->uid, UCOUNT_FANOTIFY_MARKS))

		return ERR_PTR(-ENOSPC);
@@ -1637,21 +1638,13 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags) 
		goto out_destroy_group;

	}



	BUILD_BUG_ON(!(FANOTIFY_ADMIN_INIT_FLAGS & FAN_UNLIMITED_QUEUE));

	if (flags & FAN_UNLIMITED_QUEUE) {

		fd = -EPERM;

		if (!capable(CAP_SYS_ADMIN))

			goto out_destroy_group;

		group->max_events = UINT_MAX;

	} else {

		group->max_events = fanotify_max_queued_events;

	}



	if (flags & FAN_UNLIMITED_MARKS) {

		fd = -EPERM;

		if (!capable(CAP_SYS_ADMIN))

			goto out_destroy_group;

	}



	if (flags & FAN_ENABLE_AUDIT) {

		fd = -EPERM;

		if (!capable(CAP_AUDIT_WRITE))