LU-16524 sec: enforce rbac roles

[fs/lustre-release.git] / lustre / ptlrpc / nodemap_handler.c

diff --git a/lustre/ptlrpc/nodemap_handler.c b/lustre/ptlrpc/nodemap_handler.c
index 673b613..159ea99 100644 (file)
--- a/lustre/ptlrpc/nodemap_handler.c
+++ b/lustre/ptlrpc/nodemap_handler.c
@@ -1489,7 +1489,8 @@ bool nodemap_can_setquota(struct lu_nodemap *nodemap, __u32 qc_type, __u32 id)
        if (!nodemap_active)
                return true;
 
-       if (!nodemap || !nodemap->nmf_allow_root_access)
+       if (!nodemap || !nodemap->nmf_allow_root_access ||
+           !(nodemap->nmf_rbac & NODEMAP_RBAC_QUOTA_OPS))
                return false;
 
        if (qc_type == PRJQUOTA) {