gfs2: move privileged user check to gfs2_quota_lock_check (4ed0c308) · Commits · 戴 / test

Before this patch, function gfs2_quota_lock checked if it was called from a privileged user, and if so, it bypassed the quota check: superuser can operate outside the quotas. That's the wrong place for the check because the lock/unlock functions are separate from the lock_check function, and you can do lock and unlock without actually checking the quotas. This patch moves the check to gfs2_quota_lock_check. Signed-off-by:

Bob Peterson <rpeterso@redhat.com> Signed-off-by:

Andreas Gruenbacher <agruenba@redhat.com>

fs/gfs2/quota.c

+1 −2

Original line number	Diff line number	Diff line
		@@ -1051,8 +1051,7 @@ int gfs2_quota_lock(struct gfs2_inode *ip, kuid_t uid, kgid_t gid)
		u32 x;
		int error = 0;

		if (capable(CAP_SYS_RESOURCE) \|\|
		sdp->sd_args.ar_quota != GFS2_QUOTA_ON)
		if (sdp->sd_args.ar_quota != GFS2_QUOTA_ON)
		return 0;

		error = gfs2_quota_hold(ip, uid, gid);

fs/gfs2/quota.h

+2 −1

Original line number	Diff line number	Diff line
		@@ -44,7 +44,8 @@ static inline int gfs2_quota_lock_check(struct gfs2_inode *ip,
		int ret;

		ap->allowed = UINT_MAX; /* Assume we are permitted a whole lot */
		if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
		if (capable(CAP_SYS_RESOURCE) \|\|
		sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
		return 0;
		ret = gfs2_quota_lock(ip, NO_UID_QUOTA_CHANGE, NO_GID_QUOTA_CHANGE);
		if (ret)

Admin message