[PATCH] ksmbd: enforce the read-only share flag when creating a stream

[PATCH] ksmbd: enforce the read-only share flag when creating a stream

[Ian Bridges]

When a share is read-only, smb2_open() rejects opens that would create
or truncate a file. Creating a named stream on an existing file with
streams_xattr sets neither O_CREAT nor O_TRUNC, so it passes this check,
and smb2_set_stream_name_xattr() then creates the stream. On a Time
Machine share, opening a missing AFP_AfpInfo stream also writes one. A
user who can write a file at the filesystem level can therefore add
streams to it through a read-only share.

Do not create a stream or synthesize AFP_AfpInfo when the share is not
writable. Existing streams still open normally, and a missing stream
opened with FILE_OPEN still returns STATUS_OBJECT_NAME_NOT_FOUND.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Fixes: eaff8e924f60 ("ksmbd: synthesize empty AFP_AfpInfo xattr on first probe")
Cc: stable@vger.kernel.org
Signed-off-by: Ian Bridges <icb@fastmail.org>
---

Notes:
    Reachable on a read-only streams_xattr share, or for a user outside its
    "write list". The change is persistent but only adds empty streams, or
    the synthesized 60-byte AFP_AfpInfo on a Time Machine share. Writing
    stream data still goes through the writable check. It is not a privilege
    escalation.
    
    Tested on ksmbd-for-next bd24b89645c5 with read-only and writable
    streams_xattr and Time Machine shares. Before this change new streams
    are created on the read-only shares. With it they fail with
    STATUS_ACCESS_DENIED and nothing is written. Writable shares behave as
    before.
    
    A reproducer is available on request.
    
    This fix was developed with LLM assistance.

 fs/smb/server/smb2pdu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index f3cd6ff7eb09..cbbe12b3f96e 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3566,7 +3566,8 @@ static noinline int smb2_set_stream_name_xattr(const struct path *path,
 	if (fp->cdoption == FILE_OPEN_LE) {
 		if (!strcmp(stream_name, "AFP_AfpInfo") &&
 		    test_share_config_flag(fp->tcon->share_conf,
-					   KSMBD_SHARE_FLAG_TIME_MACHINE)) {
+					   KSMBD_SHARE_FLAG_TIME_MACHINE) &&
+		    test_tree_conn_flag(fp->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
 			/*
 			 * Synthesize an empty AFP_AfpInfo xattr on first access.
 			 * type=0/creator=0 tells macOS to use the file extension
@@ -3593,6 +3594,9 @@ static noinline int smb2_set_stream_name_xattr(const struct path *path,
 		return -EBADF;
 	}
 
+	if (!test_tree_conn_flag(fp->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE))
+		return -EACCES;
+
 	rc = ksmbd_vfs_setxattr(idmap, path, xattr_stream_name, NULL, 0, 0, false);
 	if (rc < 0)
 		pr_err("Failed to store XATTR stream name :%d\n", rc);

base-commit: bd24b89645c5fa8283aceda78dbe53aa234e6bf9
-- 
2.47.3

Re: [PATCH] ksmbd: enforce the read-only share flag when creating a stream

[Namjae Jeon]

On Thu, Oct 29, 2026 at 10:25 AM Ian Bridges <icb@fastmail.org> wrote:
>
> When a share is read-only, smb2_open() rejects opens that would create
> or truncate a file. Creating a named stream on an existing file with
> streams_xattr sets neither O_CREAT nor O_TRUNC, so it passes this check,
> and smb2_set_stream_name_xattr() then creates the stream. On a Time
> Machine share, opening a missing AFP_AfpInfo stream also writes one. A
> user who can write a file at the filesystem level can therefore add
> streams to it through a read-only share.
>
> Do not create a stream or synthesize AFP_AfpInfo when the share is not
> writable. Existing streams still open normally, and a missing stream
> opened with FILE_OPEN still returns STATUS_OBJECT_NAME_NOT_FOUND.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Fixes: eaff8e924f60 ("ksmbd: synthesize empty AFP_AfpInfo xattr on first probe")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ian Bridges <icb@fastmail.org>
Applied it to #ksmbd-for-next.
Thanks!