lkml.org 
[lkml]   [2020]   [Jun]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.6 057/177] gfs2: move privileged user check to gfs2_quota_lock_check
    Date
    From: Bob Peterson <rpeterso@redhat.com>

    [ Upstream commit 4ed0c30811cb4d30ef89850b787a53a84d5d2bcb ]

    Before this patch, function gfs2_quota_lock checked if it was called
    from a privileged user, and if so, it bypassed the quota check:
    superuser can operate outside the quotas.
    That's the wrong place for the check because the lock/unlock functions
    are separate from the lock_check function, and you can do lock and
    unlock without actually checking the quotas.

    This patch moves the check to gfs2_quota_lock_check.

    Signed-off-by: Bob Peterson <rpeterso@redhat.com>
    Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/gfs2/quota.c | 3 +--
    fs/gfs2/quota.h | 3 ++-
    2 files changed, 3 insertions(+), 3 deletions(-)

    diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
    index e9f93045eb01..832d44782f74 100644
    --- a/fs/gfs2/quota.c
    +++ b/fs/gfs2/quota.c
    @@ -1040,8 +1040,7 @@ int gfs2_quota_lock(struct gfs2_inode *ip, kuid_t uid, kgid_t gid)
    u32 x;
    int error = 0;

    - if (capable(CAP_SYS_RESOURCE) ||
    - sdp->sd_args.ar_quota != GFS2_QUOTA_ON)
    + if (sdp->sd_args.ar_quota != GFS2_QUOTA_ON)
    return 0;

    error = gfs2_quota_hold(ip, uid, gid);
    diff --git a/fs/gfs2/quota.h b/fs/gfs2/quota.h
    index 765627d9a91e..fe68a91dc16f 100644
    --- a/fs/gfs2/quota.h
    +++ b/fs/gfs2/quota.h
    @@ -44,7 +44,8 @@ static inline int gfs2_quota_lock_check(struct gfs2_inode *ip,
    int ret;

    ap->allowed = UINT_MAX; /* Assume we are permitted a whole lot */
    - if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
    + if (capable(CAP_SYS_RESOURCE) ||
    + sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
    return 0;
    ret = gfs2_quota_lock(ip, NO_UID_QUOTA_CHANGE, NO_GID_QUOTA_CHANGE);
    if (ret)
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-06-01 20:13    [W:3.786 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site