On Mon, May 04, 2009 at 02:18:54PM -0700, Joel Becker wrote: > More thinking. It looks like we'll restrict reflink() to owners > or people with CAP_FCHOWN. This prevents some quota DoS behavior. > We need to pre-charge all quota. That means a reflink must be > charged the entire size of the file. So, if I do: > > # dd if=/dev/zero bs=1M count=1 of=foo > # reflink foo bar > > I am now charged 2MB of quota, even though foo and bar share the same > 1MB of space. Yep; but as long as you do this, why do you need CAP_FCHOWN? Suppose Alice has a 1MB file, and Bob creates a reflink to it. The reflink would be owned by Bob, and Bob would be charged the 1MB quota. This mirrors exactly what happens if Bob were to make a copy of the file, and we want to make the creation of reflink mirror a copy, right? In that case, as long as Bob has read access to the file, he should be allowed to create a reflink. That way when you do the copy-on-write, Bob will continue to be charged the 1MB quota, which is what you want. So pre-charging the quota makes the most amount of sense. - Ted -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
