From: Carlos Maiolino <cem@kernel.org>

Hi there.

This is the a new version of the series I've been working on
to fix a quota evasion issue on xfs. I've got to jump to more urgent
matters before the previous one so my apologies for the time it took to
cook this new version.

The changes to this version compared to the previous one are minor, only
comments and indentation related. This new version has also been rebased
on top of current xfs's for-next branch. A description of the changes
between this and the V3 version are below and more detailed on individual
patches.

This bug has originally been introduced by accident while turning off audit
messages while checking quota limits in xfs by replacing capable() calls by
as_capability_noaudit().

This series concatenates both series I sent for xfs and capabilities
infrastructure as they are dependent.

The first patch fix the xfs bug in a way that makes it easily portable
to older LTS kernels.

From second patch and beyond, it adds a new helper for the capabilities
framework named capable_noaudit() which as the same semantics as
capable() but without generating audit messages.
The following patches then replaces both generic quota call to
capable() and properly update xfs code to use this new helper.

Last but not least this unexport has_capability_noaudit which had been
previously exported.

Giving this affects different subsystems, I think it would be easier to
pull everything from a single tree (as long as everything is properly
reviewed of course).

Serge, Honza, are you guys ok if I pull those patches and send them to
Linus through xfs tree so we don't need to split the series?

Also I kept most of the RwB tags from previous versions as there were no
code changes but minor context updates to fix the conflicts.

Serge, I removed your RwB on purpose from the patch 2 as I updated the
comment, so I want to make sure you are ok with the new comment.

Changelog from the last state of these patches:

Patch2: Add more details to the capable_noaudit documentation specifying
	it checks for the process effective capabilities.

Patch4: Fix identation changes introduced in previous versions

Carlos Maiolino (5):
  xfs: fix capability check in xfs
  capability: Add new capable_noaudit
  quota: Don't issue audit messages on quota enforcing
  xfs: replace ns_capable_noaudit
  capability: unexport has_capability_noaudit

 fs/quota/dquot.c           |  2 +-
 fs/xfs/xfs_fsmap.c         |  3 +--
 fs/xfs/xfs_ioctl.c         |  2 +-
 fs/xfs/xfs_iops.c          |  2 +-
 include/linux/capability.h |  5 +++++
 kernel/capability.c        | 19 ++++++++++++++++++-
 6 files changed, 27 insertions(+), 6 deletions(-)

-- 
2.55.0

On Tue, 04 Aug 2026 11:45:50 +0200, cem@kernel.org wrote:
> From: Carlos Maiolino <cem@kernel.org>
> 
> Hi there.
> 
> This is the a new version of the series I've been working on
> to fix a quota evasion issue on xfs. I've got to jump to more urgent
> matters before the previous one so my apologies for the time it took to
> cook this new version.
> 
> [...]

Applied to for-next, thanks!

[1/5] xfs: fix capability check in xfs
      commit: e2f62a9744ebad3bcb6347a648e615026e9efeff
[2/5] capability: Add new capable_noaudit
      commit: 1b91724d0bdc470ed8f353d1cc8d3e4123b51ed5
[3/5] quota: Don't issue audit messages on quota enforcing
      commit: 4642259374fc9eb99af4cf8b2d54d54ccb0de08e
[4/5] xfs: replace ns_capable_noaudit
      commit: be9c45bdb19461889b16c91c185a284d665ea72d
[5/5] capability: unexport has_capability_noaudit
      commit: 412f89fb3988a344175899776c8bc7073524ad84

Best regards,
-- 
Carlos Maiolino <cem@kernel.org>

On Tue, Aug 04, 2026 at 11:45:50AM +0200, cem@kernel.org wrote:
> From: Carlos Maiolino <cem@kernel.org>
> 
> Hi there.
> 
> This is the a new version of the series I've been working on
> to fix a quota evasion issue on xfs. I've got to jump to more urgent
> matters before the previous one so my apologies for the time it took to
> cook this new version.
> 
> The changes to this version compared to the previous one are minor, only
> comments and indentation related. This new version has also been rebased
> on top of current xfs's for-next branch. A description of the changes
> between this and the V3 version are below and more detailed on individual
> patches.
> 
> This bug has originally been introduced by accident while turning off audit
> messages while checking quota limits in xfs by replacing capable() calls by
> as_capability_noaudit().
> 
> This series concatenates both series I sent for xfs and capabilities
> infrastructure as they are dependent.
> 
> The first patch fix the xfs bug in a way that makes it easily portable
> to older LTS kernels.
> 
> From second patch and beyond, it adds a new helper for the capabilities
> framework named capable_noaudit() which as the same semantics as
> capable() but without generating audit messages.
> The following patches then replaces both generic quota call to
> capable() and properly update xfs code to use this new helper.
> 
> Last but not least this unexport has_capability_noaudit which had been
> previously exported.
> 
> Giving this affects different subsystems, I think it would be easier to
> pull everything from a single tree (as long as everything is properly
> reviewed of course).
> 
> Serge, Honza, are you guys ok if I pull those patches and send them to
> Linus through xfs tree so we don't need to split the series?

Oh, I missed this before - yup, please do.


> Also I kept most of the RwB tags from previous versions as there were no
> code changes but minor context updates to fix the conflicts.
> 
> Serge, I removed your RwB on purpose from the patch 2 as I updated the
> comment, so I want to make sure you are ok with the new comment.

thanks - sent a new RwB in reply to that earlier.  All good.

thanks,
-serge

> Changelog from the last state of these patches:
> 
> Patch2: Add more details to the capable_noaudit documentation specifying
> 	it checks for the process effective capabilities.
> 
> Patch4: Fix identation changes introduced in previous versions
> 
> Carlos Maiolino (5):
>   xfs: fix capability check in xfs
>   capability: Add new capable_noaudit
>   quota: Don't issue audit messages on quota enforcing
>   xfs: replace ns_capable_noaudit
>   capability: unexport has_capability_noaudit
> 
>  fs/quota/dquot.c           |  2 +-
>  fs/xfs/xfs_fsmap.c         |  3 +--
>  fs/xfs/xfs_ioctl.c         |  2 +-
>  fs/xfs/xfs_iops.c          |  2 +-
>  include/linux/capability.h |  5 +++++
>  kernel/capability.c        | 19 ++++++++++++++++++-
>  6 files changed, 27 insertions(+), 6 deletions(-)
> 
> -- 
> 2.55.0
>