]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
gfs2: move privileged user check to gfs2_quota_lock_check
authorBob Peterson <rpeterso@redhat.com>
Tue, 5 May 2020 16:53:21 +0000 (11:53 -0500)
committerAndreas Gruenbacher <agruenba@redhat.com>
Fri, 8 May 2020 16:47:58 +0000 (18:47 +0200)
Before this patch, function gfs2_quota_lock checked if it was called
from a privileged user, and if so, it bypassed the quota check:
superuser can operate outside the quotas.
That's the wrong place for the check because the lock/unlock functions
are separate from the lock_check function, and you can do lock and
unlock without actually checking the quotas.

This patch moves the check to gfs2_quota_lock_check.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
fs/gfs2/quota.c
fs/gfs2/quota.h

index c997cadc8d9a07467db2ed733f9d7b1d6028075b..ed2e488f98b3bb59c2fc24cd33284deae27d49b2 100644 (file)
@@ -1051,8 +1051,7 @@ int gfs2_quota_lock(struct gfs2_inode *ip, kuid_t uid, kgid_t gid)
        u32 x;
        int error = 0;
 
-       if (capable(CAP_SYS_RESOURCE) ||
-           sdp->sd_args.ar_quota != GFS2_QUOTA_ON)
+       if (sdp->sd_args.ar_quota != GFS2_QUOTA_ON)
                return 0;
 
        error = gfs2_quota_hold(ip, uid, gid);
index 7f9ca8ef40fc4867454d97d37f8072e36dc1dbaa..21ada332d55571021bda02fb55be74da43952388 100644 (file)
@@ -44,7 +44,8 @@ static inline int gfs2_quota_lock_check(struct gfs2_inode *ip,
        int ret;
 
        ap->allowed = UINT_MAX; /* Assume we are permitted a whole lot */
-       if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
+       if (capable(CAP_SYS_RESOURCE) ||
+           sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
                return 0;
        ret = gfs2_quota_lock(ip, NO_UID_QUOTA_CHANGE, NO_GID_QUOTA_CHANGE);
        if (ret)