| From: |
| cem-AT-kernel.org |
| To: |
| linux-fsdevel-AT-vger.kernel.org |
| Subject: |
| [RFC PATCH 0/4] Introduce capable_noaudit |
| Date: |
| Fri, 26 Jun 2026 13:45:19 +0200 |
| Message-ID: |
| <20260626114533.102138-1-cem@kernel.org> |
| Cc: |
| jack-AT-suze.cz, djwong-AT-kernel.org, hch-AT-lst.de, serge-AT-hallyn.com, linux-security-module-AT-vger.kernel.org, linux-kernel-AT-vger.kernel.org, linux-xfs-AT-vger.kernel.org, Carlos Maiolino <cem-AT-kernel.org> |
| Archive-link: |
| Article |
From: Carlos Maiolino <cem@kernel.org>
In some cases - filesystems quota specifically here - we'd like to check
for effective capabilities without issuing spurious audit messages and
without the need to specify a namespace for that.
This series introduce capable_noaudit() which has the same goal as
capable() but without firing audit messages.
Also, this updates both generic quota and xfs quota code to use that.
The last patch unexports has_capability_noaudit() which was originally
exported to be used in xfs but turns out it does not meet our needs.
Note this is based on top of a current series I have to remove
has_capability_noaudit() calls from xfs so the xfs patch won't
apply cleanly without that series.
If adding this helper is acceptable, I'll turn this into a non-rfc
series with the required changes to apply properly.
Comments? Flames?
Cheers
Carlos Maiolino (4):
capabily: Add new capable_noaudit
quota: Don't issue audit messages on quota enforcing
xfs: replace ns_capable_noaudit()
capability: unexport has_capability_noaudit
fs/quota/dquot.c | 2 +-
fs/xfs/xfs_trans_dquot.c | 2 +-
include/linux/capability.h | 5 +++++
kernel/capability.c | 18 +++++++++++++++++-
4 files changed, 24 insertions(+), 3 deletions(-)
--
2.54.0
