[PATCH v4 1/5] xfs: fix capability check in xfs

[Carlos Maiolino]

On Thu, Aug 06, 2026 at 12:22:29PM -0500, sergeh at kernel.org wrote:
> On Tue, Aug 04, 2026 at 11:45:51AM +0200, cem at kernel.org wrote:
> > From: Carlos Maiolino <cem at kernel.org>
> > 
> > An user reported a bug where he managed to evade group's quota
> > by changing a file's gid to a different group id the same user
> > belonged to, even though quotas were enforced on both gids and the
> > file's size was big enough to exceed the quota's hardlimit.
> > 
> > Commit eba0549bc7d1 replaced a capable() call by a
> > has_capability_noaudit() to prevent unnecessary selinux audit messages.
> > Turns out that both calls have slightly different semantics even though
> > their documentation seems similar. Where in a nutshell:
> > 
> > capable() - Tests the task's effective credentials
> > has_ns_capability_noaudit() - Tests the task's real credentials
> > 
> > This most of the time has no practical difference but in some cases like
> > changing attrs (specifically group id in this case) through a NFS client
> > this will allow the quota code to use XFS_QMOPT_FORCE_RES, effectively
> > bypassing quota accounting checks.
> > 
> > Using instead ns_capable_noaudit() should fix this issue and prevent
> > selinux audit messages.
> 
> Hi,
> 
> this makes perfect sense, but since you say "should fix this issue",
> did you have a chance to set up a reproducer, and verify?

Hi Serge.

Yes, I do have a reproducer to test this all, I'm in process of wiring
it up on a xfstests once I get to it on my pile of stuff to do :)


> 
> > This also fix the remaining calls to has_capability_noaudit()
> > 
> > Fixes: eba0549bc7d1 ("xfs: don't generate selinux audit messages for capability testing")
> > Cc: <stable at vger.kernel.org> # v5.18
> > Reported-by: Dr. Thomas Orgis <thomas.orgis at uni-hamburg.de>
> > Signed-off-by: Carlos Maiolino <cmaiolino at redhat.com>
> > Reviewed-by: "Darrick J. Wong" <djwong at kernel.org>
> 
> Reviewed-by: Serge Hallyn <sergeh at kernel.org>
> 
> thanks,
> -serge
> 
> > ---
> >  fs/xfs/xfs_fsmap.c | 2 +-
> >  fs/xfs/xfs_ioctl.c | 2 +-
> >  fs/xfs/xfs_iops.c  | 2 +-
> >  3 files changed, 3 insertions(+), 3 deletions(-)
> > 
> > diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c
> > index b6a3bc9f143c..7c79fbe0a74c 100644
> > --- a/fs/xfs/xfs_fsmap.c
> > +++ b/fs/xfs/xfs_fsmap.c
> > @@ -1175,7 +1175,7 @@ xfs_getfsmap(
> >  		return -EINVAL;
> >  
> >  	use_rmap = xfs_has_rmapbt(mp) &&
> > -		   has_capability_noaudit(current, CAP_SYS_ADMIN);
> > +		   ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN);
> >  	head->fmh_entries = 0;
> >  
> >  	/* Set up our device handlers. */
> > diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
> > index 1b53701bebea..1a8af827dde1 100644
> > --- a/fs/xfs/xfs_ioctl.c
> > +++ b/fs/xfs/xfs_ioctl.c
> > @@ -647,7 +647,7 @@ xfs_ioctl_setattr_get_trans(
> >  		goto out_error;
> >  
> >  	error = xfs_trans_alloc_ichange(ip, NULL, NULL, pdqp,
> > -			has_capability_noaudit(current, CAP_FOWNER), &tp);
> > +			ns_capable_noaudit(&init_user_ns, CAP_FOWNER), &tp);
> >  	if (error)
> >  		goto out_error;
> >  
> > diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
> > index 6339f4956ecb..7a8c77fdcf68 100644
> > --- a/fs/xfs/xfs_iops.c
> > +++ b/fs/xfs/xfs_iops.c
> > @@ -835,7 +835,7 @@ xfs_setattr_nonsize(
> >  	}
> >  
> >  	error = xfs_trans_alloc_ichange(ip, udqp, gdqp, NULL,
> > -			has_capability_noaudit(current, CAP_FOWNER), &tp);
> > +			ns_capable_noaudit(&init_user_ns, CAP_FOWNER), &tp);
> >  	if (error)
> >  		goto out_dqrele;
> >  
> > -- 
> > 2.55.0
> > 
>