Fix quota evasion on xfs and add capable_noaudit
Subsystems (5)
[email protected]
maintainerv4 cover Fix quota evasion on xfs and add capable_noaudit
From: Carlos Maiolino <[email protected]>
Hi there.
This is the a new version of the series I've been working on to fix a quota evasion issue on xfs. I've got to jump to more urgent matters before the previous one so my apologies for the time it took to cook this new version.
The changes to this version compared to the previous one are minor, only comments and indentation related. This new version has also been rebased on top of current xfs's for-next branch. A description of the changes between this and the V3 version are below and more detailed on individual patches.
This bug has originally been introduced by accident while turning off audit messages while checking quota limits in xfs by replacing capable() calls by as_capability_noaudit().
This series concatenates both series I sent for xfs and capabilities infrastructure as they are dependent.
The first patch fix the xfs bug in a way that makes it easily portable to older LTS kernels.
From second patch and beyond, it adds a new helper for the capabilities framework named capable_noaudit() which as the same semantics as capable() but without generating audit messages.
The following patches then replaces both generic quota call to capable() and properly update xfs code to use this new helper.
Last but not least this unexport has_capability_noaudit which had been previously exported.
Giving this affects different subsystems, I think it would be easier to pull everything from a single tree (as long as everything is properly reviewed of course).
Serge, Honza, are you guys ok if I pull those patches and send them to Linus through xfs tree so we don't need to split the series?
Also I kept most of the RwB tags from previous versions as there were no code changes but minor context updates to fix the conflicts.
Serge, I removed your RwB on purpose from the patch 2 as I updated the comment, so I want to make sure you are ok with the new comment.
Changelog from the last state of these patches:
Patch2: Add more details to the capable_noaudit documentation specifying
it checks for the process effective capabilities.
Patch4: Fix identation changes introduced in previous versions
Carlos Maiolino (5):
xfs: fix capability check in xfs
capability: Add new capable_noaudit
quota: Don't issue audit messages on quota enforcing
xfs: replace ns_capable_noaudit
capability: unexport has_capability_noaudit
fs/quota/dquot.c | 2 +- fs/xfs/xfs_fsmap.c | 3 +-- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_iops.c | 2 +- include/linux/capability.h | 5 +++++ kernel/capability.c | 19 ++++++++++++++++++- 6 files changed, 27 insertions(+), 6 deletions(-)
Signature · 1 line
2.55.0
[email protected]
maintainerPATCH v4 1/5 xfs: fix capability check in xfs
From: Carlos Maiolino <[email protected]>
An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the file's size was big enough to exceed the quota's hardlimit.
Commit eba0549bc7d1 replaced a capable() call by a has_capability_noaudit() to prevent unnecessary selinux audit messages. Turns out that both calls have slightly different semantics even though their documentation seems similar. Where in a nutshell:
capable() - Tests the task's effective credentials has_ns_capability_noaudit() - Tests the task's real credentials
This most of the time has no practical difference but in some cases like changing attrs (specifically group id in this case) through a NFS client this will allow the quota code to use XFS_QMOPT_FORCE_RES, effectively bypassing quota accounting checks.
Using instead ns_capable_noaudit() should fix this issue and prevent selinux audit messages.
This also fix the remaining calls to has_capability_noaudit()
--- fs/xfs/xfs_fsmap.c | 2 +- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_iops.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
fs/xfs/xfs_fsmap.c +1 -1
@@ -1175,7 +1175,7 @@ xfs_getfsmap(return -EINVAL ; use_rmap =xfs_has_rmapbt (mp) && -has_capability_noaudit (current,CAP_SYS_ADMIN ); +ns_capable_noaudit (&init_user_ns,CAP_SYS_ADMIN ); head->fmh_entries =0 ;/* Set up our device handlers. */
fs/xfs/xfs_ioctl.c +1 -1
@@ -647,7 +647,7 @@ xfs_ioctl_setattr_get_trans( goto out_error; error =xfs_trans_alloc_ichange (ip,NULL ,NULL , pdqp, -has_capability_noaudit (current,CAP_FOWNER ), &tp); +ns_capable_noaudit (&init_user_ns,CAP_FOWNER ), &tp);if (error) goto out_error;
fs/xfs/xfs_iops.c +1 -1
@@ -835,7 +835,7 @@ xfs_setattr_nonsize( } error =xfs_trans_alloc_ichange (ip, udqp, gdqp,NULL , -has_capability_noaudit (current,CAP_FOWNER ), &tp); +ns_capable_noaudit (&init_user_ns,CAP_FOWNER ), &tp);if (error) goto out_dqrele;
Signature · 1 line
2.55.0
Re: [PATCH v4 1/5] xfs: fix capability check in xfs
Looks good:
Re: [PATCH v4 1/5] xfs: fix capability check in xfs
In reply to [email protected]Quoted 15 lines · On Tue, Aug 04, 2026 at 11:45:51AM +0200, [email protected] wrote:
From: Carlos Maiolino <[email protected]>
An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the file's size was big enough to exceed the quota's hardlimit.
Commit
eba0549bc7d1replaced acapable()call by ahas_capability_noaudit()to prevent unnecessary selinux audit messages. Turns out that both calls have slightly different semantics even though their documentation seems similar. Where in a nutshell:
capable()- Tests the task's effective credentialshas_ns_capability_noaudit()- Tests the task's real credentials
Quoted 7 lines
This most of the time has no practical difference but in some cases like changing attrs (specifically group id in this case) through a NFS client this will allow the quota code to use
XFS_QMOPT_FORCE_RES, effectively bypassing quota accounting checks.Using instead
ns_capable_noaudit()should fix this issue and prevent selinux audit messages.
Hi,
this makes perfect sense, but since you say "should fix this issue", did you have a chance to set up a reproducer, and verify?
Quoted 7 lines
This also fix the remaining calls to
has_capability_noaudit()Fixes eba0549bc7d1 ("xfs: don't generate selinux audit messages for capability testing")Cc <[email protected]> # v5.18Reported-by Dr. Thomas Orgis <[email protected]>Signed-off-by Carlos Maiolino <[email protected]>Reviewed-by "Darrick J. Wong" <[email protected]>
thanks,
-serge
Quoted 48 lines
--- fs/xfs/xfs_fsmap.c | 2 +- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_iops.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)fs/xfs/xfs_fsmap.c +1
-1@@ -1175,7 +1175,7 @@ xfs_getfsmap(return -EINVAL ; use_rmap =xfs_has_rmapbt (mp) && -has_capability_noaudit (current,CAP_SYS_ADMIN ); +ns_capable_noaudit (&init_user_ns,CAP_SYS_ADMIN ); head->fmh_entries =0 ;/* Set up our device handlers. */ fs/xfs/xfs_ioctl.c +1
-1@@ -647,7 +647,7 @@ xfs_ioctl_setattr_get_trans( goto out_error; error =xfs_trans_alloc_ichange (ip,NULL ,NULL , pdqp, -has_capability_noaudit (current,CAP_FOWNER ), &tp); +ns_capable_noaudit (&init_user_ns,CAP_FOWNER ), &tp);if (error) goto out_error;fs/xfs/xfs_iops.c +1
-1@@ -835,7 +835,7 @@ xfs_setattr_nonsize( } error =xfs_trans_alloc_ichange (ip, udqp, gdqp,NULL , -has_capability_noaudit (current,CAP_FOWNER ), &tp); +ns_capable_noaudit (&init_user_ns,CAP_FOWNER ), &tp);if (error) goto out_dqrele;Signature · 1 line
2.55.0
Carlos Maiolino
maintainerRe: [PATCH v4 1/5] xfs: fix capability check in xfs
Quoted 21 lines · On Thu, Aug 06, 2026 at 12:22:29PM -0500, [email protected] wrote:
Quoted 20 lines · On Tue, Aug 04, 2026 at 11:45:51AM +0200, [email protected] wrote:
From: Carlos Maiolino <[email protected]>
An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the file's size was big enough to exceed the quota's hardlimit.
Commit
eba0549bc7d1replaced acapable()call by ahas_capability_noaudit()to prevent unnecessary selinux audit messages. Turns out that both calls have slightly different semantics even though their documentation seems similar. Where in a nutshell:
capable()- Tests the task's effective credentialshas_ns_capability_noaudit()- Tests the task's real credentialsThis most of the time has no practical difference but in some cases like changing attrs (specifically group id in this case) through a NFS client this will allow the quota code to use
XFS_QMOPT_FORCE_RES, effectively bypassing quota accounting checks.
Quoted 7 lines
Quoted 2 lines
Using instead
ns_capable_noaudit()should fix this issue and prevent selinux audit messages.Hi,
this makes perfect sense, but since you say "should fix this issue", did you have a chance to set up a reproducer, and verify?
Hi Serge.
Yes, I do have a reproducer to test this all, I'm in process of wiring it up on a xfstests once I get to it on my pile of stuff to do :)
Quoted 63 lines
Quoted 8 lines
This also fix the remaining calls to
has_capability_noaudit()Fixes eba0549bc7d1 ("xfs: don't generate selinux audit messages for capability testing")Cc <[email protected]> # v5.18Reported-by Dr. Thomas Orgis <[email protected]>Signed-off-by Carlos Maiolino <[email protected]>Reviewed-by "Darrick J. Wong" <[email protected]>Reviewed-by Serge Hallyn <[email protected]>thanks,
-sergeQuoted 48 lines
--- fs/xfs/xfs_fsmap.c | 2 +- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_iops.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)fs/xfs/xfs_fsmap.c +1
-1@@ -1175,7 +1175,7 @@ xfs_getfsmap(return -EINVAL ; use_rmap =xfs_has_rmapbt (mp) && -has_capability_noaudit (current,CAP_SYS_ADMIN ); +ns_capable_noaudit (&init_user_ns,CAP_SYS_ADMIN ); head->fmh_entries =0 ;/* Set up our device handlers. */ fs/xfs/xfs_ioctl.c +1
-1@@ -647,7 +647,7 @@ xfs_ioctl_setattr_get_trans( goto out_error; error =xfs_trans_alloc_ichange (ip,NULL ,NULL , pdqp, -has_capability_noaudit (current,CAP_FOWNER ), &tp); +ns_capable_noaudit (&init_user_ns,CAP_FOWNER ), &tp);if (error) goto out_error;fs/xfs/xfs_iops.c +1
-1@@ -835,7 +835,7 @@ xfs_setattr_nonsize( } error =xfs_trans_alloc_ichange (ip, udqp, gdqp,NULL , -has_capability_noaudit (current,CAP_FOWNER ), &tp); +ns_capable_noaudit (&init_user_ns,CAP_FOWNER ), &tp);if (error) goto out_dqrele;Signature · 1 line
2.55.0
[email protected]
maintainerPATCH v4 2/5 capability: Add new capable_noaudit
In reply to [email protected]From: Carlos Maiolino <[email protected]>
In some situations (quota enforcement bypass in this case) we'd like to check for a specific capability without triggering spurious audit messages from security modules like selinux.
Add a new helper so we don't need to use ns_capable_noaudit() directly.
---
V4: Mention capable_noaudit check for process effective capabilities
V3: remove the extern declaration
include/linux/capability.h | 5 +++++ kernel/capability.c | 18 ++++++++++++++++++ 2 files changed, 23 insertions(+)
include/linux/capability.h +5 -0
@@ -145,6 +145,7 @@ extern bool has_capability_noaudit(struct task_struct *t, int cap);extern bool has_ns_capability_noaudit (struct task_struct *t,struct user_namespace *ns,int cap);extern bool capable (int cap); +bool capable_noaudit (int cap);extern bool ns_capable (struct user_namespace *ns,int cap);extern bool ns_capable_noaudit (struct user_namespace *ns,int cap);extern bool ns_capable_setid (struct user_namespace *ns,int cap);
@@ -167,6 +168,10 @@ static inline bool capable(int cap) {return true; } +static inline bool capable_noaudit (int cap) +{ +return true; +}static inline bool ns_capable (struct user_namespace *ns,int cap) {return true;
kernel/capability.c +18 -0
@@ -416,6 +416,24 @@ bool capable(int cap) return ns_capable(&init_user_ns, cap); }EXPORT_SYMBOL (capable); + +/** +* capable_noaudit - Determine if the current task has a superior +* capability in effect by checking the process's effective +* capabilities (unaudited). +* @cap: The capability to be tested for +* +* This is the same as capable(), except it uses CAP_OPT_NOAUDIT as to prevent +* issuing spurious audit messages. +* +* This sets PF_SUPERPRIV on the task if the capability is available on the +* assumption that it's about to be used. +*/ +bool capable_noaudit (int cap) +{ +return ns_capable_noaudit (&init_user_ns, cap); +} +EXPORT_SYMBOL (capable_noaudit);#endif /* CONFIG_MULTIUSER */ /**
Signature · 1 line
2.55.0
Re: [PATCH v4 2/5] capability: Add new capable_noaudit
Quoted 10 lines · On Tue, Aug 04, 2026 at 11:45:52AM +0200, [email protected] wrote:
From: Carlos Maiolino <[email protected]>
In some situations (quota enforcement bypass in this case) we'd like to check for a specific capability without triggering spurious audit messages from security modules like selinux.
Add a new helper so we don't need to use
ns_capable_noaudit()directly.Signed-off-by Carlos Maiolino <[email protected]>Reviewed-by Christoph Hellwig <[email protected]>
Quoted 64 lines
---
V4: Mention
capable_noauditcheck for process effective capabilities
V3: remove the extern declarationinclude/linux/capability.h | 5 +++++ kernel/capability.c | 18 ++++++++++++++++++ 2 files changed, 23 insertions(+)include/linux/capability.h +5
-0@@ -145,6 +145,7 @@ extern bool has_capability_noaudit(struct task_struct *t, int cap);extern bool has_ns_capability_noaudit (struct task_struct *t,struct user_namespace *ns,int cap);extern bool capable (int cap); +bool capable_noaudit (int cap);extern bool ns_capable (struct user_namespace *ns,int cap);extern bool ns_capable_noaudit (struct user_namespace *ns,int cap);extern bool ns_capable_setid (struct user_namespace *ns,int cap);@@ -167,6 +168,10 @@ static inline bool capable(int cap) {return true; } +static inline bool capable_noaudit (int cap) +{ +return true; +}static inline bool ns_capable (struct user_namespace *ns,int cap) {return true;kernel/capability.c +18
-0@@ -416,6 +416,24 @@ bool capable(int cap) return ns_capable(&init_user_ns, cap); }EXPORT_SYMBOL (capable); + +/** +* capable_noaudit - Determine if the current task has a superior +* capability in effect by checking the process's effective +* capabilities (unaudited). +* @cap: The capability to be tested for +* +* This is the same as capable(), except it uses CAP_OPT_NOAUDIT as to prevent +* issuing spurious audit messages. +* +* This sets PF_SUPERPRIV on the task if the capability is available on the +* assumption that it's about to be used. +*/ +bool capable_noaudit (int cap) +{ +return ns_capable_noaudit (&init_user_ns, cap); +} +EXPORT_SYMBOL (capable_noaudit);#endif /* CONFIG_MULTIUSER */ /** Signature · 1 line
2.55.0
[email protected]
maintainerPATCH v4 3/5 quota: Don't issue audit messages on quota enforcing
In reply to [email protected]From: Carlos Maiolino <[email protected]>
Calling capable() to determine if we can bypass quota enforcement or not can trigger spurious audit messages. We don't really require it here so just use the capable_noaudit() version.
--- fs/quota/dquot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/quota/dquot.c +1 -1
@@ -1308,7 +1308,7 @@ static int ignore_hardlimit(struct dquot *dquot) {struct mem_dqinfo *info = &sb_dqopt (dquot->dq_sb)->info[dquot->dq_id.type]; -return capable (CAP_SYS_RESOURCE ) && +return capable_noaudit (CAP_SYS_RESOURCE ) && (info->dqi_format->qf_fmt_id !=QFMT_VFS_OLD || !(info->dqi_flags &DQF_ROOT_SQUASH )); }
Signature · 1 line
2.55.0
[email protected]
maintainerPATCH v4 4/5 xfs: replace ns_capable_noaudit
In reply to [email protected]From: Carlos Maiolino <[email protected]>
Now that capable_noaudit() is available, we don't need to keep using ns_capable_noaudit() and specifying the usernaspace every single time.
---
V4: Fix indentation on xfs_ioctl_setattr_get_trans() changes
fs/xfs/xfs_fsmap.c | 3 +-- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_iops.c | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-)
fs/xfs/xfs_fsmap.c +1 -2
@@ -1174,8 +1174,7 @@ xfs_getfsmap(if (!xfs_getfsmap_check_keys (&head->fmh_keys[0 ], &head->fmh_keys[1 ]))return -EINVAL ; - use_rmap =xfs_has_rmapbt (mp) && -ns_capable_noaudit (&init_user_ns,CAP_SYS_ADMIN ); + use_rmap =xfs_has_rmapbt (mp) &&capable_noaudit (CAP_SYS_ADMIN ); head->fmh_entries =0 ;/* Set up our device handlers. */
fs/xfs/xfs_ioctl.c +1 -1
@@ -647,7 +647,7 @@ xfs_ioctl_setattr_get_trans( goto out_error; error =xfs_trans_alloc_ichange (ip,NULL ,NULL , pdqp, -ns_capable_noaudit (&init_user_ns,CAP_FOWNER ), &tp); +capable_noaudit (CAP_FOWNER ), &tp);if (error) goto out_error;
fs/xfs/xfs_iops.c +1 -1
@@ -835,7 +835,7 @@ xfs_setattr_nonsize( } error =xfs_trans_alloc_ichange (ip, udqp, gdqp,NULL , -ns_capable_noaudit (&init_user_ns,CAP_FOWNER ), &tp); +capable_noaudit (CAP_FOWNER ), &tp);if (error) goto out_dqrele;
Signature · 1 line
2.55.0
Re: [PATCH v4 4/5] xfs: replace ns_capable_noaudit
Looks good:
Re: [PATCH v4 4/5] xfs: replace ns_capable_noaudit
In reply to [email protected]Quoted 4 lines · On Tue, Aug 04, 2026 at 11:45:54AM +0200, [email protected] wrote:
From: Carlos Maiolino <[email protected]>
Now that
capable_noaudit()is available, we don't need to keep usingns_capable_noaudit()and specifying the usernaspace every single
(typo - usernaspace)
Quoted 54 lines
time.
Signed-off-by Carlos Maiolino <[email protected]>---
V4: Fix indentation onxfs_ioctl_setattr_get_trans()changesfs/xfs/xfs_fsmap.c | 3 +-- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_iops.c | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-)fs/xfs/xfs_fsmap.c +1
-2@@ -1174,8 +1174,7 @@ xfs_getfsmap(if (!xfs_getfsmap_check_keys (&head->fmh_keys[0 ], &head->fmh_keys[1 ]))return -EINVAL ; - use_rmap =xfs_has_rmapbt (mp) && -ns_capable_noaudit (&init_user_ns,CAP_SYS_ADMIN ); + use_rmap =xfs_has_rmapbt (mp) &&capable_noaudit (CAP_SYS_ADMIN ); head->fmh_entries =0 ;/* Set up our device handlers. */ fs/xfs/xfs_ioctl.c +1
-1@@ -647,7 +647,7 @@ xfs_ioctl_setattr_get_trans( goto out_error; error =xfs_trans_alloc_ichange (ip,NULL ,NULL , pdqp, -ns_capable_noaudit (&init_user_ns,CAP_FOWNER ), &tp); +capable_noaudit (CAP_FOWNER ), &tp);if (error) goto out_error;fs/xfs/xfs_iops.c +1
-1@@ -835,7 +835,7 @@ xfs_setattr_nonsize( } error =xfs_trans_alloc_ichange (ip, udqp, gdqp,NULL , -ns_capable_noaudit (&init_user_ns,CAP_FOWNER ), &tp); +capable_noaudit (CAP_FOWNER ), &tp);if (error) goto out_dqrele;Signature · 1 line
2.55.0
Carlos Maiolino
maintainerRe: [PATCH v4 4/5] xfs: replace ns_capable_noaudit
Quoted 7 lines · On Thu, Aug 06, 2026 at 04:11:07PM -0500, [email protected] wrote:
Quoted 4 lines · On Tue, Aug 04, 2026 at 11:45:54AM +0200, [email protected] wrote:
From: Carlos Maiolino <[email protected]>
Now that
capable_noaudit()is available, we don't need to keep usingns_capable_noaudit()and specifying the usernaspace every single(typo - usernaspace)
Woops thanks, I'll fix it keeping the RwB
Quoted 56 lines
Quoted 55 lines
time.
Signed-off-by Carlos Maiolino <[email protected]>---
V4: Fix indentation onxfs_ioctl_setattr_get_trans()changesfs/xfs/xfs_fsmap.c | 3 +-- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_iops.c | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-)fs/xfs/xfs_fsmap.c +1
-2@@ -1174,8 +1174,7 @@ xfs_getfsmap(if (!xfs_getfsmap_check_keys (&head->fmh_keys[0 ], &head->fmh_keys[1 ]))return -EINVAL ; - use_rmap =xfs_has_rmapbt (mp) && -ns_capable_noaudit (&init_user_ns,CAP_SYS_ADMIN ); + use_rmap =xfs_has_rmapbt (mp) &&capable_noaudit (CAP_SYS_ADMIN ); head->fmh_entries =0 ;/* Set up our device handlers. */ fs/xfs/xfs_ioctl.c +1
-1@@ -647,7 +647,7 @@ xfs_ioctl_setattr_get_trans( goto out_error; error =xfs_trans_alloc_ichange (ip,NULL ,NULL , pdqp, -ns_capable_noaudit (&init_user_ns,CAP_FOWNER ), &tp); +capable_noaudit (CAP_FOWNER ), &tp);if (error) goto out_error;fs/xfs/xfs_iops.c +1
-1@@ -835,7 +835,7 @@ xfs_setattr_nonsize( } error =xfs_trans_alloc_ichange (ip, udqp, gdqp,NULL , -ns_capable_noaudit (&init_user_ns,CAP_FOWNER ), &tp); +capable_noaudit (CAP_FOWNER ), &tp);if (error) goto out_dqrele;Signature · 1 line
2.55.0
[email protected]
maintainerPATCH v4 5/5 capability: unexport has_capability_noaudit
In reply to [email protected]From: Carlos Maiolino <[email protected]>
This has been originally exported to be used in xfs. Giving we are not using it anymore, unexport for consistency.
--- kernel/capability.c | 1 - 1 file changed, 1 deletion(-)
kernel/capability.c +0 -1
@@ -326,7 +326,6 @@ bool has_capability_noaudit(struct task_struct *t, int cap) {return has_ns_capability_noaudit (t, &init_user_ns, cap); } -EXPORT_SYMBOL (has_capability_noaudit); static bool ns_capable_common(struct user_namespace *ns, int cap,
Signature · 1 line
2.55.0
Re: [PATCH v4 5/5] capability: unexport has_capability_noaudit
Quoted 8 lines · On Tue, Aug 04, 2026 at 11:45:55AM +0200, [email protected] wrote:
From: Carlos Maiolino <[email protected]>
This has been originally exported to be used in xfs. Giving we are not using it anymore, unexport for consistency.
Signed-off-by Carlos Maiolino <[email protected]>Reviewed-by "Darrick J. Wong" <[email protected]>Reviewed-by Christoph Hellwig <[email protected]>
Thanks, Carlos.
Should these all just go in through the xfs tree?
Quoted 19 lines
--- kernel/capability.c | 1 - 1 file changed, 1 deletion(-)kernel/capability.c +0
-1@@ -326,7 +326,6 @@ bool has_capability_noaudit(struct task_struct *t, int cap) {return has_ns_capability_noaudit (t, &init_user_ns, cap); } -EXPORT_SYMBOL (has_capability_noaudit); static bool ns_capable_common(struct user_namespace *ns, int cap,Signature · 1 line
2.55.0
Carlos Maiolino
maintainerRe: [PATCH v4 5/5] capability: unexport has_capability_noaudit
Quoted 10 lines · On Thu, Aug 06, 2026 at 01:54:23PM -0500, [email protected] wrote:
Quoted 8 lines · On Tue, Aug 04, 2026 at 11:45:55AM +0200, [email protected] wrote:
From: Carlos Maiolino <[email protected]>
This has been originally exported to be used in xfs. Giving we are not using it anymore, unexport for consistency.
Signed-off-by Carlos Maiolino <[email protected]>Reviewed-by "Darrick J. Wong" <[email protected]>Reviewed-by Christoph Hellwig <[email protected]>
Quoted 5 lines
Reviewed-by Serge Hallyn <[email protected]>Thanks, Carlos.
Should these all just go in through the xfs tree?
Yeah, I'm pulling them through XFS tree if you are ok with it?!
Cheers.
Quoted 21 lines
Quoted 20 lines
--- kernel/capability.c | 1 - 1 file changed, 1 deletion(-)kernel/capability.c +0
-1@@ -326,7 +326,6 @@ bool has_capability_noaudit(struct task_struct *t, int cap) {return has_ns_capability_noaudit (t, &init_user_ns, cap); } -EXPORT_SYMBOL (has_capability_noaudit); static bool ns_capable_common(struct user_namespace *ns, int cap,Signature · 1 line
2.55.0
Quoted 34 lines · On Tue, Aug 04, 2026 at 11:45:50AM +0200, [email protected] wrote:
From: Carlos Maiolino <[email protected]>
Hi there.
This is the a new version of the series I've been working on to fix a quota evasion issue on xfs. I've got to jump to more urgent matters before the previous one so my apologies for the time it took to cook this new version.
The changes to this version compared to the previous one are minor, only comments and indentation related. This new version has also been rebased on top of current xfs's for-next branch. A description of the changes between this and the V3 version are below and more detailed on individual patches.
This bug has originally been introduced by accident while turning off audit messages while checking quota limits in xfs by replacing
capable()calls byas_capability_noaudit().This series concatenates both series I sent for xfs and capabilities infrastructure as they are dependent.
The first patch fix the xfs bug in a way that makes it easily portable to older LTS kernels.
From second patch and beyond, it adds a new helper for the capabilities framework named
capable_noaudit()which as the same semantics ascapable()but without generating audit messages.
The following patches then replaces both generic quota call tocapable()and properly update xfs code to use this new helper.Last but not least this unexport
has_capability_noauditwhich had been previously exported.
Quoted 6 lines
Giving this affects different subsystems, I think it would be easier to pull everything from a single tree (as long as everything is properly reviewed of course).
Serge, Honza, are you guys ok if I pull those patches and send them to Linus through xfs tree so we don't need to split the series?
Oh, I missed this before - yup, please do.
Quoted 5 lines
Also I kept most of the RwB tags from previous versions as there were no code changes but minor context updates to fix the conflicts.
Serge, I removed your RwB on purpose from the patch 2 as I updated the comment, so I want to make sure you are ok with the new comment.
thanks - sent a new RwB in reply to that earlier. All good.
thanks,
-serge
Quoted 25 lines
Changelog from the last state of these patches:
Patch2: Add more details to the
capable_noauditdocumentation specifying
it checks for the process effective capabilities.Patch4: Fix identation changes introduced in previous versions
Carlos Maiolino (5):
xfs: fix capability check in xfs
capability: Add newcapable_noaudit
quota: Don't issue audit messages on quota enforcing
xfs: replacens_capable_noaudit
capability: unexporthas_capability_noauditfs/quota/dquot.c | 2 +- fs/xfs/xfs_fsmap.c | 3 +-- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_iops.c | 2 +- include/linux/capability.h | 5 +++++ kernel/capability.c | 19 ++++++++++++++++++- 6 files changed, 27 insertions(+), 6 deletions(-)Signature · 1 line
2.55.0
Quoted 10 lines · On Tue, 04 Aug 2026 11:45:50 +0200, [email protected] wrote:
From: Carlos Maiolino <[email protected]>
Hi there.
This is the a new version of the series I've been working on to fix a quota evasion issue on xfs. I've got to jump to more urgent matters before the previous one so my apologies for the time it took to cook this new version.
[...]
Applied to for-next, thanks!
[1/5] xfs: fix capability check in xfs
commit: e2f62a9744ebad3bcb6347a648e615026e9efeff
[2/5] capability: Add new capable_noaudit
commit: 1b91724d0bdc470ed8f353d1cc8d3e4123b51ed5
[3/5] quota: Don't issue audit messages on quota enforcing
commit: 4642259374fc9eb99af4cf8b2d54d54ccb0de08e
[4/5] xfs: replace ns_capable_noaudit
commit: be9c45bdb19461889b16c91c185a284d665ea72d
[5/5] capability: unexport has_capability_noaudit
commit: 412f89fb3988a344175899776c8bc7073524ad84Best regards,
Signature · 1 line
Carlos Maiolino <[email protected]>