fanotify: clear all fanotify marks

fanotify listeners may want to clear all marks.  They may want to do this
to destroy all of their inode marks which have nothing but ignores.
Realistically this is useful for av vendors who update policy and want to
clear all of their cached allows.

Signed-off-by: Eric Paris <eparis@redhat.com>

4 files changed, 39 insertions, 7 deletions

diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 3e275f17e7b7..9fe760baf69f 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -514,9 +514,10 @@ SYSCALL_DEFINE(fanotify_mark)(int fanotify_fd, unsigned int flags,
 
         if (flags & ~FAN_ALL_MARK_FLAGS)
                 return -EINVAL;
-        switch (flags & (FAN_MARK_ADD | FAN_MARK_REMOVE)) {
+        switch (flags & (FAN_MARK_ADD | FAN_MARK_REMOVE | FAN_MARK_FLUSH)) {
         case FAN_MARK_ADD:
         case FAN_MARK_REMOVE:
+        case FAN_MARK_FLUSH:
                 break;
         default:
                 return -EINVAL;
@@ -545,7 +546,7 @@ SYSCALL_DEFINE(fanotify_mark)(int fanotify_fd, unsigned int flags,
         group = filp->private_data;
 
         /* create/update an inode mark */
-        switch (flags & (FAN_MARK_ADD | FAN_MARK_REMOVE)) {
+        switch (flags & (FAN_MARK_ADD | FAN_MARK_REMOVE | FAN_MARK_FLUSH)) {
         case FAN_MARK_ADD:
                 if (flags & FAN_MARK_MOUNT)
                         ret = fanotify_add_vfsmount_mark(group, mnt, mask, flags);
@@ -558,6 +559,13 @@ SYSCALL_DEFINE(fanotify_mark)(int fanotify_fd, unsigned int flags,
                 else
                         ret = fanotify_remove_inode_mark(group, inode, mask, flags);
                 break;
+        case FAN_MARK_FLUSH:
+                if (flags & FAN_MARK_MOUNT)
+                        fsnotify_clear_vfsmount_marks_by_group(group);
+                else
+                        fsnotify_clear_inode_marks_by_group(group);
+                fsnotify_recalc_group_mask(group);
+                break;
         default:
                 ret = -EINVAL;
         }
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index 4292f9e23ae8..0c0a48b1659f 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -104,6 +104,14 @@ void fsnotify_clear_marks_by_inode(struct inode *inode)
 }
 
 /*
+ * Given a group clear all of the inode marks associated with that group.
+ */
+void fsnotify_clear_inode_marks_by_group(struct fsnotify_group *group)
+{
+        fsnotify_clear_marks_by_group_flags(group, FSNOTIFY_MARK_FLAG_INODE);
+}
+
+/*
  * given a group and inode, find the mark associated with that combination.
  * if found take a reference to that mark and return it, else return NULL
  */
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index cb1d822f227f..1e824e64441d 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -270,18 +270,21 @@ err:
 }
 
 /*
- * Given a group, destroy all of the marks associated with that group.
+ * clear any marks in a group in which mark->flags & flags is true
  */
-void fsnotify_clear_marks_by_group(struct fsnotify_group *group)
+void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group,
+                                         unsigned int flags)
 {
         struct fsnotify_mark *lmark, *mark;
         LIST_HEAD(free_list);
 
         spin_lock(&group->mark_lock);
         list_for_each_entry_safe(mark, lmark, &group->marks_list, g_list) {
-                list_add(&mark->free_g_list, &free_list);
-                list_del_init(&mark->g_list);
-                fsnotify_get_mark(mark);
+                if (mark->flags & flags) {
+                        list_add(&mark->free_g_list, &free_list);
+                        list_del_init(&mark->g_list);
+                        fsnotify_get_mark(mark);
+                }
         }
         spin_unlock(&group->mark_lock);
 
@@ -291,6 +294,14 @@ void fsnotify_clear_marks_by_group(struct fsnotify_group *group)
         }
 }
 
+/*
+ * Given a group, destroy all of the marks associated with that group.
+ */
+void fsnotify_clear_marks_by_group(struct fsnotify_group *group)
+{
+        fsnotify_clear_marks_by_group_flags(group, (unsigned int)-1);
+}
+
 void fsnotify_duplicate_mark(struct fsnotify_mark *new, struct fsnotify_mark *old)
 {
         assert_spin_locked(&old->lock);
diff --git a/fs/notify/vfsmount_mark.c b/fs/notify/vfsmount_mark.c
index 1b61d0a942de..8f1aa02f4f02 100644
--- a/fs/notify/vfsmount_mark.c
+++ b/fs/notify/vfsmount_mark.c
@@ -51,6 +51,11 @@ void fsnotify_clear_marks_by_mount(struct vfsmount *mnt)
         }
 }
 
+void fsnotify_clear_vfsmount_marks_by_group(struct fsnotify_group *group)
+{
+        fsnotify_clear_marks_by_group_flags(group, FSNOTIFY_MARK_FLAG_VFSMOUNT);
+}
+
 /*
  * Recalculate the mask of events relevant to a given vfsmount locked.
  */