| From ebac9224c1056033ae9b9d113d821d8938b66ef3 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 5 May 2020 11:53:21 -0500 |
| Subject: gfs2: move privileged user check to gfs2_quota_lock_check |
| |
| From: Bob Peterson <rpeterso@redhat.com> |
| |
| [ Upstream commit 4ed0c30811cb4d30ef89850b787a53a84d5d2bcb ] |
| |
| Before this patch, function gfs2_quota_lock checked if it was called |
| from a privileged user, and if so, it bypassed the quota check: |
| superuser can operate outside the quotas. |
| That's the wrong place for the check because the lock/unlock functions |
| are separate from the lock_check function, and you can do lock and |
| unlock without actually checking the quotas. |
| |
| This patch moves the check to gfs2_quota_lock_check. |
| |
| Signed-off-by: Bob Peterson <rpeterso@redhat.com> |
| Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| fs/gfs2/quota.c | 3 +-- |
| fs/gfs2/quota.h | 3 ++- |
| 2 files changed, 3 insertions(+), 3 deletions(-) |
| |
| diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c |
| index e700fb162664..a833e2e07167 100644 |
| --- a/fs/gfs2/quota.c |
| +++ b/fs/gfs2/quota.c |
| @@ -1039,8 +1039,7 @@ int gfs2_quota_lock(struct gfs2_inode *ip, kuid_t uid, kgid_t gid) |
| u32 x; |
| int error = 0; |
| |
| - if (capable(CAP_SYS_RESOURCE) || |
| - sdp->sd_args.ar_quota != GFS2_QUOTA_ON) |
| + if (sdp->sd_args.ar_quota != GFS2_QUOTA_ON) |
| return 0; |
| |
| error = gfs2_quota_hold(ip, uid, gid); |
| diff --git a/fs/gfs2/quota.h b/fs/gfs2/quota.h |
| index 836f29480be6..e3a6e2404d11 100644 |
| --- a/fs/gfs2/quota.h |
| +++ b/fs/gfs2/quota.h |
| @@ -47,7 +47,8 @@ static inline int gfs2_quota_lock_check(struct gfs2_inode *ip, |
| int ret; |
| |
| ap->allowed = UINT_MAX; /* Assume we are permitted a whole lot */ |
| - if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF) |
| + if (capable(CAP_SYS_RESOURCE) || |
| + sdp->sd_args.ar_quota == GFS2_QUOTA_OFF) |
| return 0; |
| ret = gfs2_quota_lock(ip, NO_UID_QUOTA_CHANGE, NO_GID_QUOTA_CHANGE); |
| if (ret) |
| -- |
| 2.25.1 |
| |