How to find out whether CONFIG_FANOTIFY_ACCESS_PERMISSIONS is enabled?

Question

I want to make use of fanotify(7) and the problem I run into is that on some kernels CONFIG_FANOTIFY_ACCESS_PERMISSIONS does not work, although CONFIG_FANOTIFY is configured.

At the very least I'd like to report this condition.

Now on Debian and Ubuntu I could use the equivalent of grep CONFIG_FANOTIFY_ACCESS_PERMISSIONS /boot/config-$(uname -r) to verify that the feature is available. On some other systems I could use the equivalent of zgrep CONFIG_FANOTIFY_ACCESS_PERMISSIONS /proc/config.gz, but there are probably some more systems that are not covered by these two methods.

Is there a way to figure out in any of the fanotify(7) functions whether or not fanotify permission handling is available on the kernel currently running?

I was thinking of a method similar to the returned ENOSYS when fanotify_mark() is not implemented (fanotify_mark(2)), but could not find anything like that in the documentation.

Answer 1

It seems that fanotify_mark() returns EINVAL when FAN_ALL_PERM_EVENTS is passed but CONFIG_FANOTIFY_ACCESS_PERMISSIONS is disabled.

See fs/notify/fanotify/fanotify_user.c in kernel sources:

SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags,
                              __u64, mask, int, dfd,
                              const char  __user *, pathname)
{
...

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
        if (mask & ~(FAN_ALL_EVENTS | FAN_ALL_PERM_EVENTS | FAN_EVENT_ON_CHILD))
#else
        if (mask & ~(FAN_ALL_EVENTS | FAN_EVENT_ON_CHILD))
#endif
                return -EINVAL;