* [RFC PATCH 2/6] ksmbd: keep named ACL entries effective when a DACL sets a POSIX ACL
@ 2026-11-10 9:02 Jan Koester
0 siblings, 0 replies; 2+ messages in thread
From: Jan Koester @ 2026-11-10 9:02 UTC (permalink / raw)
To: linkinjeon, smfrench
Cc: senozhatsky, tom, chenxiaosong, brauner, linux-cifs,
linux-fsdevel, samba-technical, linux-kernel
parse_dacl() turns ACEs for other users into named POSIX ACL entries
with an rwx mask, but leaves the group bits of fattr->cf_mode as the
owning group's ACE made them. set_info_sec() sets the ACL first and
then the mode, and on an inode with an extended ACL the mode's group
bits are the mask: a DACL without an ACE for the owning group (as
Windows writes them) left the mask at --- and every named entry
without effect.
Put the mask into the mode's group bits when there are named entries.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Jan Koester <jan.koester@tuxist.de>
---
fs/smb/server/smbacl.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index d1cf63a9fe..b3daf65798 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -680,6 +680,12 @@ static int parse_dacl(struct mnt_idmap *idmap,
if (acl_state.users->n || acl_state.groups->n) {
acl_state.mask.allow = 0x07;
+ /*
+ * With named entries the mode's group bits are the ACL's mask:
+ * the chmod after setting the ACL mustn't mask them all off.
+ */
+ fattr->cf_mode = (fattr->cf_mode & ~0070) |
+ (acl_state.mask.allow << 3);
if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) {
fattr->cf_acls =
--
2.56.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* [RFC PATCH 2/6] ksmbd: keep named ACL entries effective when a DACL sets a POSIX ACL
2026-10-28 6:19 [RFC PATCH 0/6] ksmbd: Windows SIDs for user and group ids Jan Koester
@ 2026-10-28 6:19 ` Jan Koester
0 siblings, 0 replies; 2+ messages in thread
From: Jan Koester @ 2026-10-28 6:19 UTC (permalink / raw)
To: Namjae Jeon, Steve French
Cc: Sergey Senozhatsky, Tom Talpey, ChenXiaoSong, Christian Brauner,
linux-cifs, linux-fsdevel, samba-technical, linux-kernel
parse_dacl() turns ACEs for other users into named POSIX ACL entries
with an rwx mask, but leaves the group bits of fattr->cf_mode as the
owning group's ACE made them. set_info_sec() sets the ACL first and
then the mode, and on an inode with an extended ACL the mode's group
bits are the mask: a DACL without an ACE for the owning group (as
Windows writes them) left the mask at --- and every named entry
without effect.
Put the mask into the mode's group bits when there are named entries.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Jan Koester <jan.koester@tuxist.de>
---
fs/smb/server/smbacl.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index d1cf63a9fe..b3daf65798 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -680,6 +680,12 @@ static int parse_dacl(struct mnt_idmap *idmap,
if (acl_state.users->n || acl_state.groups->n) {
acl_state.mask.allow = 0x07;
+ /*
+ * With named entries the mode's group bits are the ACL's mask:
+ * the chmod after setting the ACL mustn't mask them all off.
+ */
+ fattr->cf_mode = (fattr->cf_mode & ~0070) |
+ (acl_state.mask.allow << 3);
if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) {
fattr->cf_acls =
--
2.56.0
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-11-10 9:01 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-11-10 9:02 [RFC PATCH 2/6] ksmbd: keep named ACL entries effective when a DACL sets a POSIX ACL Jan Koester
-- strict thread matches above, loose matches on Subject: below --
2026-10-28 6:19 [RFC PATCH 0/6] ksmbd: Windows SIDs for user and group ids Jan Koester
2026-10-28 6:19 ` [RFC PATCH 2/6] ksmbd: keep named ACL entries effective when a DACL sets a POSIX ACL Jan Koester
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®