On 03/09, Chao Yu wrote: > On 2018/3/9 12:49, Jaegeuk Kim wrote: > > This fixes CAP_SYS_RESOURCE denial of selinux when using resgid. > > A little confusion, if capable(CAP_SYS_RESOURCE) is false, we still have > chance > to return true for below resuid & resgid cases, right?
I didn't dig it deeply tho, it seems selinux log came up when capable() is failed in the first place. We actually didn't need to show it up, since next resgid will give mostly true. > > Thanks, > > > > > Signed-off-by: Jaegeuk Kim <jaeg...@kernel.org> > > --- > > fs/f2fs/f2fs.h | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h > > index f6dc70666ebb..3d12277fbe9e 100644 > > --- a/fs/f2fs/f2fs.h > > +++ b/fs/f2fs/f2fs.h > > @@ -1607,13 +1607,13 @@ static inline bool __allow_reserved_blocks(struct > > f2fs_sb_info *sbi, > > return false; > > if (IS_NOQUOTA(inode)) > > return true; > > - if (capable(CAP_SYS_RESOURCE)) > > - return true; > > if (uid_eq(sbi->s_resuid, current_fsuid())) > > return true; > > if (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) && > > in_group_p(sbi->s_resgid)) > > return true; > > + if (capable(CAP_SYS_RESOURCE)) > > + return true; > > return false; > > } > > > >
