From 93fdff500af2d05c478616545be92ce85ee224bb Mon Sep 17 00:00:00 2001 From: Steve Grubb Date: Tue, 19 May 2026 14:15:39 -0400 Subject: [PATCH 1/3] Add FAN_FS_ERROR configure switch FAN_FS_ERROR monitoring opens a second fanotify notification group and closes it during daemon shutdown. The blocked-task trace from the hang is in the fanotify group close path, so deployments need a build-time way to remove that newer descriptor while testing kernel shutdown behavior against older fapolicyd behavior. Add --disable-fanotify-fs-error, default it to enabled, and gate the FAN_FS_ERROR implementation on the configure define as well as kernel header support. The disabled build keeps the public helpers as no-ops and logs that monitoring was disabled by configure so the runtime behavior is explicit. Tests were updated so notify_test only exercises synthetic FAN_FS_ERROR events when the configure switch enables the implementation. --- configure.ac | 18 ++++++++++++++++++ src/daemon/fanotify-fs-error.c | 14 ++++++++++---- src/tests/notify_test.c | 4 +++- 3 files changed, 31 insertions(+), 5 deletions(-) diff --git a/configure.ac b/configure.ac index d774d2fa..06ecacc6 100644 --- a/configure.ac +++ b/configure.ac @@ -151,6 +151,23 @@ if test $perm = "no"; then fi AC_CHECK_DECLS([FAN_MARK_FILESYSTEM], [], [], [[#include ]]) +AC_ARG_ENABLE(fanotify-fs-error, +AS_HELP_STRING([--disable-fanotify-fs-error], +[disable FAN_FS_ERROR health monitoring even when supported]), +[enable_fanotify_fs_error=$enableval], +[enable_fanotify_fs_error=yes]) +case x$enable_fanotify_fs_error in + xyes) + AC_DEFINE([FAPOLICYD_ENABLE_FANOTIFY_FS_ERROR], [1], + [Define to enable FAN_FS_ERROR health monitoring]) + ;; + xno) + ;; + *) + AC_MSG_ERROR([bad value $enableval for --enable-fanotify-fs-error]) + ;; +esac + withval="" AC_ARG_WITH(rpm, AS_HELP_STRING([--with-rpm],[Use the rpm database as a trust source]), @@ -238,5 +255,6 @@ echo " `echo $LDFLAGS | fmt -w 50 | sed 's,^, ,'` __attr_access support: $ACCESS __attr_dealloc_free support: $DEALLOC + FAN_FS_ERROR monitoring: $enable_fanotify_fs_error " diff --git a/src/daemon/fanotify-fs-error.c b/src/daemon/fanotify-fs-error.c index eb1fddd2..978766f5 100644 --- a/src/daemon/fanotify-fs-error.c +++ b/src/daemon/fanotify-fs-error.c @@ -36,9 +36,9 @@ * queue handled by notify.c. * * Header and kernel support vary across supported build targets. Public entry - * points stay available even when FAN_FS_ERROR symbols are absent; in that case - * initialization reports that monitoring is unavailable and all other helpers - * become harmless no-ops. + * points stay available even when FAN_FS_ERROR symbols are absent or configure + * disables this monitor; in that case initialization reports that monitoring is + * unavailable and all other helpers become harmless no-ops. */ #include "config.h" /* Needed to get O_LARGEFILE definition */ @@ -62,7 +62,8 @@ #define FANOTIFY_FS_ERROR_BUFFER_SIZE 8192 #define FS_ERROR_LOG_INTERVAL 60 -#if defined(FAN_FS_ERROR) && defined(FAN_REPORT_FID) && \ +#if defined(FAPOLICYD_ENABLE_FANOTIFY_FS_ERROR) && \ + defined(FAN_FS_ERROR) && defined(FAN_REPORT_FID) && \ defined(FAN_MARK_FILESYSTEM) && \ defined(FAN_EVENT_INFO_TYPE_ERROR) && \ defined(FAN_EVENT_INFO_TYPE_FID) @@ -599,9 +600,14 @@ void fanotify_fs_error_unmark(const char *path) int fanotify_fs_error_init(mlist *m) { (void)m; +#if defined(FAPOLICYD_ENABLE_FANOTIFY_FS_ERROR) msg(LOG_INFO, "FAN_FS_ERROR monitoring disabled; kernel headers do not provide " "the required fanotify info records"); +#else + msg(LOG_INFO, + "FAN_FS_ERROR monitoring disabled by configure option"); +#endif return -1; } #endif diff --git a/src/tests/notify_test.c b/src/tests/notify_test.c index 1d084d47..b87c1971 100644 --- a/src/tests/notify_test.c +++ b/src/tests/notify_test.c @@ -1,6 +1,7 @@ /* * notify_test.c - unit tests for daemon fanotify metadata handling */ +#include "config.h" #include #include #include @@ -23,7 +24,8 @@ #define FAN_Q_OVERFLOW 0x00004000 #endif -#if defined(FAN_FS_ERROR) && defined(FAN_REPORT_FID) && \ +#if defined(FAPOLICYD_ENABLE_FANOTIFY_FS_ERROR) && \ + defined(FAN_FS_ERROR) && defined(FAN_REPORT_FID) && \ defined(FAN_MARK_FILESYSTEM) && \ defined(FAN_EVENT_INFO_TYPE_ERROR) && \ defined(FAN_EVENT_INFO_TYPE_FID) From 7ba841955fe58507f4ec12ea9ace322ea450575c Mon Sep 17 00:00:00 2001 From: Steve Grubb Date: Tue, 19 May 2026 15:52:21 -0400 Subject: [PATCH 2/3] Guard FAN_FS_ERROR poll slot setup The new configure switch compiled out FAN_FS_ERROR handling, but the daemon still unconditionally populated the optional third poll slot from fanotify_fs_error_fd(). That helper returned -1 when disabled, so the runtime behavior was harmless, but the main loop still looked as if it always considered the FS_ERROR descriptor path. Wrap the pfd[2] assignment and pfd_count promotion in FAPOLICYD_ENABLE_FANOTIFY_FS_ERROR. When the feature is disabled at configure time, the daemon no longer assigns or polls the optional FAN_FS_ERROR slot at all. --- src/daemon/fapolicyd.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/daemon/fapolicyd.c b/src/daemon/fapolicyd.c index 7584b087..0e84105e 100644 --- a/src/daemon/fapolicyd.c +++ b/src/daemon/fapolicyd.c @@ -1322,11 +1322,13 @@ int main(int argc, const char *argv[]) handle_mounts(pfd[0].fd); pfd[1].fd = init_fanotify(&config, m); pfd[1].events = POLLIN; +#ifdef FAPOLICYD_ENABLE_FANOTIFY_FS_ERROR pfd[2].fd = fanotify_fs_error_fd(); if (pfd[2].fd >= 0) { pfd[2].events = POLLIN; pfd_count = 3; } +#endif msg(LOG_INFO, "Starting to listen for events"); while (!stop) { From 4ca183a2dc49f41ee201cb2fed13bdccf1e22f24 Mon Sep 17 00:00:00 2001 From: Steve Grubb Date: Wed, 20 May 2026 13:05:31 -0400 Subject: [PATCH 3/3] Disable FAN_FS_ERROR for release Keep FAN_FS_ERROR support disabled unconditionally by leaving FAPOLICYD_ENABLE_FANOTIFY_FS_ERROR undefined. The previous configure option is commented out for later restoration, configure reports FAN_FS_ERROR monitoring as no, and the ChangeLog entry advertising FAN_FS_ERROR support was removed from the release notes. --- ChangeLog | 1 - configure.ac | 35 ++++++++++++++++++---------------- src/daemon/fanotify-fs-error.c | 2 +- 3 files changed, 20 insertions(+), 18 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3c0771a1..25e25cbe 100644 --- a/ChangeLog +++ b/ChangeLog @@ -18,7 +18,6 @@ - Add per-rule hit counters state report to improve observability. - Add per-attribute cache hit and lookup counters to improve observability. - Split CLI state and metrics reports -- fapolicyd: Handle FAN_FS_ERROR health events 1.4.5 - Inform the admin symlinks were skipped when adding paths diff --git a/configure.ac b/configure.ac index 06ecacc6..aa30263a 100644 --- a/configure.ac +++ b/configure.ac @@ -151,22 +151,25 @@ if test $perm = "no"; then fi AC_CHECK_DECLS([FAN_MARK_FILESYSTEM], [], [], [[#include ]]) -AC_ARG_ENABLE(fanotify-fs-error, -AS_HELP_STRING([--disable-fanotify-fs-error], -[disable FAN_FS_ERROR health monitoring even when supported]), -[enable_fanotify_fs_error=$enableval], -[enable_fanotify_fs_error=yes]) -case x$enable_fanotify_fs_error in - xyes) - AC_DEFINE([FAPOLICYD_ENABLE_FANOTIFY_FS_ERROR], [1], - [Define to enable FAN_FS_ERROR health monitoring]) - ;; - xno) - ;; - *) - AC_MSG_ERROR([bad value $enableval for --enable-fanotify-fs-error]) - ;; -esac +enable_fanotify_fs_error=no +dnl FAN_FS_ERROR shutdown currently exposes a kernel close(2) hang. Keep the +dnl monitor compiled out until the kernel problem is understood. +dnl AC_ARG_ENABLE(fanotify-fs-error, +dnl AS_HELP_STRING([--disable-fanotify-fs-error], +dnl [disable FAN_FS_ERROR health monitoring even when supported]), +dnl [enable_fanotify_fs_error=$enableval], +dnl [enable_fanotify_fs_error=yes]) +dnl case x$enable_fanotify_fs_error in +dnl xyes) +dnl AC_DEFINE([FAPOLICYD_ENABLE_FANOTIFY_FS_ERROR], [1], +dnl [Define to enable FAN_FS_ERROR health monitoring]) +dnl ;; +dnl xno) +dnl ;; +dnl *) +dnl AC_MSG_ERROR([bad value $enableval for --enable-fanotify-fs-error]) +dnl ;; +dnl esac withval="" AC_ARG_WITH(rpm, diff --git a/src/daemon/fanotify-fs-error.c b/src/daemon/fanotify-fs-error.c index 978766f5..fea4b8c4 100644 --- a/src/daemon/fanotify-fs-error.c +++ b/src/daemon/fanotify-fs-error.c @@ -606,7 +606,7 @@ int fanotify_fs_error_init(mlist *m) "the required fanotify info records"); #else msg(LOG_INFO, - "FAN_FS_ERROR monitoring disabled by configure option"); + "FAN_FS_ERROR monitoring disabled"); #endif return -1; }