[PATCH 0/2] ksmbd: fix DACL evaluation for denies and guest sessions

[Ian Bridges <icb@fastmail.org>]

On an acl_xattr share, smb_check_perm_dacl() has two evaluation errors.
Patch 1 makes every open evaluate the DACL in order. Today a deny ACE
that is the first one matching the caller grants every right it does not
name. Patch 2 stops guest and anonymous sessions from matching
Authenticated Users ACEs.

The two patches belong together. Each one alone moves some guest results
the wrong way through the other error. Patch 1 alone lets a guest gather
rights from Authenticated Users ACEs as it walks the DACL. Patch 2 alone
can leave an Everyone deny as the first ACE a guest matches, and that
deny then grants every right it does not name.

With both applied, every combination of one or two allow or deny ACEs
for the caller, Everyone and Authenticated Users was tested, with
READ_DATA, WRITE_DATA, WRITE_EA, APPEND_DATA or full access as the mask
(930 DACLs). Each DACL also ended with an allow ACE giving the owner
full access. The tests ran as an authenticated user, a guest and an
anonymous session. Compared with the base, every result that changes
agrees with ordered evaluation (MS-DTYP 2.5.3.2) and the definition of
Authenticated Users (MS-DTYP 2.4.2.4), and no result that agreed
changes.

Both patches carry Cc stable and need to be backported in this order.

Ian Bridges (2):
  ksmbd: evaluate the DACL in order for requested access
  ksmbd: exclude guest and anonymous sessions from Authenticated Users
    ACEs

 fs/smb/server/mgmt/user_config.h   |  5 +++++
 fs/smb/server/smb2pdu.c            | 11 +++++++---
 fs/smb/server/smbacl.c             | 34 +++++++++++++-----------------
 fs/smb/server/smbacl.h             |  2 +-
 fs/smb/server/tests/smbacl_kunit.c |  4 ++--
 5 files changed, 31 insertions(+), 25 deletions(-)


base-commit: af8c72f6550744fe948ef2dbc7ab8739c149aab2
-- 
2.47.3