Received-SPF: pass (google.com: best guess record for domain of linux-ext4-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Andreas Dilger <adilger@dilger.ca>
Message-Id: <6F46FB6C-D1E3-4BB8-B150-B229801EE13B@dilger.ca>
Content-Type: multipart/signed;
 boundary="Apple-Mail=_35E7AAEA-558E-4C69-AED7-98BFD0780248";
 protocol="application/pgp-signature"; micalg=pgp-sha256
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Subject: Re: [Project Quota]file owner could change its project ID?
Date:   Sun, 20 Oct 2019 14:19:19 -0600
In-Reply-To: <20191017121251.GB25548@mit.edu>
Cc:     "Darrick J. Wong" <darrick.wong@oracle.com>,
        Wang Shilong <wangshilong1991@gmail.com>,
        linux-xfs@vger.kernel.org, linux-fsdevel@vger.kernel.org,
        Ext4 Developers List <linux-ext4@vger.kernel.org>,
        Li Xi <lixi@ddn.com>, Wang Shilong <wshilong@ddn.com>
To:     "Theodore Y. Ts'o" <tytso@mit.edu>
References: <CAP9B-QmQ-mbWgJwEWrVOMabsgnPwyJsxSQbMkWuFk81-M4dRPQ@mail.gmail.com>
 <20191013164124.GR13108@magnolia>
 <CAP9B-Q=SfhnA6iO7h1TWAoSOfZ+BvT7d8=OE4176FZ3GXiU-xw@mail.gmail.com>
 <20191016213700.GH13108@magnolia>
 <648712FB-0ECE-41F4-B6B8-98BD3168B2A4@dilger.ca>
 <20191017121251.GB25548@mit.edu>
Sender: linux-ext4-owner@vger.kernel.org
Precedence: bulk


--Apple-Mail=_35E7AAEA-558E-4C69-AED7-98BFD0780248
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=us-ascii

On Oct 17, 2019, at 6:12 AM, Theodore Y. Ts'o <tytso@mit.edu> wrote:
> 
> On Wed, Oct 16, 2019 at 06:28:08PM -0600, Andreas Dilger wrote:
>> I don't think that this is really "directory quotas" in the end, since it
>> isn't changing the semantics that the same projid could exist in multiple
>> directory trees.  The real difference is the ability to enforce existing
>> project quota limits for regular users outside of a container.  Basically,
>> it is the same as regular users not being able to change the UID of their
>> files to dump quota to some other user.
>> 
>> So rather than rename this "dirquota", it would be better to have a
>> an option like "projid_enforce" or "projid_restrict", or maybe some
>> more flexibility to allow only users in specific groups to change the
>> projid like "projid_admin=<gid>" so that e.g. "staff" or "admin" groups
>> can still change it (in addition to root) but not regular users.  To
>> restrict it to root only, leave "projid_admin=0" and the default (to
>> keep the same "everyone can change projid" behavior) would be -1?
> 
> I'm not sure how common the need for restsrictive quota enforcement is
> really going to be.  Can someone convince me this is actually going to
> be a common use case?

Project quota (i.e. quota tracking that doesn't automatically also convey
permission to access a file or directory) is one of the most requested
features from our users.  This is useful for e.g. university or industry
research groups with multiple grad students/researchers under a single
principal professor/project that controls the funding.

> We could also solve the problem by adding an LSM hook called when
> there is an attempt to set the project ID, and for people who really
> want this, they can create a stackable LSM which enforces whatever
> behavior they want.

So, rather than add a few-line change that decides whether the user
is allowed to change the projid for a file, we would instead add *more*
lines to add a hook, then have to write and load an LSM that is called
each time?  That seems backward to me.

> If we think this going to be an speciality request, this might be the
> better way to go.

I don't see how this is more "speciality" than regular quota enforcement?
Just like we impose limits on users and groups, it makes sense to impose
a limit on a project, instead of just tracking it and then having to add
extra machinery to impose the limit externally.

Cheers, Andreas


--Apple-Mail=_35E7AAEA-558E-4C69-AED7-98BFD0780248
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iQIzBAEBCAAdFiEEDb73u6ZejP5ZMprvcqXauRfMH+AFAl2swUcACgkQcqXauRfM
H+C6bg/+IVKN6zxruxANDmRxjkhbz1DsHpy8bRcW2p+EfZXh4Q/VjLaqoak01fgP
xIlYX2phbBiJP1peTeMcw2N6CEWPJzVMJEM8ncW+NN7c2aFj+IJOU5HWgzw3E/TO
8Iku9a2iYb8P1SQ91sY+7uFknr7N0pLoMgPqlwBKF5SrPUMClIbuIW2UlVNFdBIp
ktRATf95Ieo2K9NpESNNtQWY0yBIuoKU/Vdd6PTq9Pra7gm/xwPBdmaOs/FQQ4dr
WhEGfEtKV6hFCy04zt1YkrHuTQe2ykV2/XKIGseVPkuNpKyzg3lS1OWhZZE8ek1V
iR/LvqbehVp+8RjLrka+YYxGCsKdi6uWJQNsaT/nbJFwroKmEuNu23WWguzXKDIf
eUq1lDn2VoFl2S8Kts4WXpSyxg7aSg8eVFZKq1sZaANo6Zzk+QgE82IJft0/mc+o
3g3DqeDMYmObhiL0JNR8FIfX6JNKJOolmT3AK4O4tZi4abOGaa0TjNqLWwfh7ted
az6VX3/I0it/P+t63i1wNN7sFVKvKFRfsF0VVcvvm52uYNag22yub0Ub3E2HAAi1
1r2YAPYwhV5xYF7t7Gaj4vzFWJCcFMKABHfR2t4mAJQ4gN2X9jvxvBMO1eopQiGe
9Z1FXKPTFb33RpbWftbv6wxn6fHMMGbKulV9qjOpxHoFhZXSgXE=
=Xz2h
-----END PGP SIGNATURE-----

--Apple-Mail=_35E7AAEA-558E-4C69-AED7-98BFD0780248--