[PATCH v4 0/5] Fix quota evasion on xfs and add capable_noaudit

[sergeh at kernel.org]

On Tue, Aug 04, 2026 at 11:45:50AM +0200, cem at kernel.org wrote:
> From: Carlos Maiolino <cem at kernel.org>
> 
> Hi there.
> 
> This is the a new version of the series I've been working on
> to fix a quota evasion issue on xfs. I've got to jump to more urgent
> matters before the previous one so my apologies for the time it took to
> cook this new version.
> 
> The changes to this version compared to the previous one are minor, only
> comments and indentation related. This new version has also been rebased
> on top of current xfs's for-next branch. A description of the changes
> between this and the V3 version are below and more detailed on individual
> patches.
> 
> This bug has originally been introduced by accident while turning off audit
> messages while checking quota limits in xfs by replacing capable() calls by
> as_capability_noaudit().
> 
> This series concatenates both series I sent for xfs and capabilities
> infrastructure as they are dependent.
> 
> The first patch fix the xfs bug in a way that makes it easily portable
> to older LTS kernels.
> 
> From second patch and beyond, it adds a new helper for the capabilities
> framework named capable_noaudit() which as the same semantics as
> capable() but without generating audit messages.
> The following patches then replaces both generic quota call to
> capable() and properly update xfs code to use this new helper.
> 
> Last but not least this unexport has_capability_noaudit which had been
> previously exported.
> 
> Giving this affects different subsystems, I think it would be easier to
> pull everything from a single tree (as long as everything is properly
> reviewed of course).
> 
> Serge, Honza, are you guys ok if I pull those patches and send them to
> Linus through xfs tree so we don't need to split the series?

Oh, I missed this before - yup, please do.


> Also I kept most of the RwB tags from previous versions as there were no
> code changes but minor context updates to fix the conflicts.
> 
> Serge, I removed your RwB on purpose from the patch 2 as I updated the
> comment, so I want to make sure you are ok with the new comment.

thanks - sent a new RwB in reply to that earlier.  All good.

thanks,
-serge

> Changelog from the last state of these patches:
> 
> Patch2: Add more details to the capable_noaudit documentation specifying
> 	it checks for the process effective capabilities.
> 
> Patch4: Fix identation changes introduced in previous versions
> 
> Carlos Maiolino (5):
>   xfs: fix capability check in xfs
>   capability: Add new capable_noaudit
>   quota: Don't issue audit messages on quota enforcing
>   xfs: replace ns_capable_noaudit
>   capability: unexport has_capability_noaudit
> 
>  fs/quota/dquot.c           |  2 +-
>  fs/xfs/xfs_fsmap.c         |  3 +--
>  fs/xfs/xfs_ioctl.c         |  2 +-
>  fs/xfs/xfs_iops.c          |  2 +-
>  include/linux/capability.h |  5 +++++
>  kernel/capability.c        | 19 ++++++++++++++++++-
>  6 files changed, 27 insertions(+), 6 deletions(-)
> 
> -- 
> 2.55.0
>