From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=202.12.124.148 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793325942; b=E9suBOdX9S4S27SEO7TQn9NOd0c7pq2zr2ptUlTkdGLlZFXzKgiRaPK8OhwAuyxOoE8I /ABCR0ICyA90yn5/STsDveA87KcbM5Fmxq5Wz4bVNaQ0IMfkOn03sPd4mRG4Z5gBtlU8q EhE22aTuqD+8Ecp/+06gn2sFR3F+OZE635hG7wHRV1AY/bok/6bR243Gq/+X1FCXN2FSA AVbatVUPJnf+UGtffzXH1T/05mcXq2H/w3um/l2RX8j9MmEjFx7O82/aK52fs5jZCvhWK /BTtARlmdV7iZ0yXFB999jLOS1G7z88fnNMUWkTIVW1NiBUIt1a+2BThgJaZUNm7nKw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793325942; h=DMARC-Filter:Received:Received:DKIM-Signature:DKIM-Signature: X-DKIM2-Info:DKIM2-Signature:X-DKIM2-Info:Message-Instance: X-ME-Sender:X-ME-Received:X-ME-Proxy-Cause:X-ME-Proxy:Feedback-ID: Received:From:To:Cc:Subject:Date:Message-ID:X-Mailer:MIME-Version: Content-Transfer-Encoding; bh=FaBdhe+BilZDrddoVF/yPe3H5iKhhYZT0hc6y5Pow0o=; b=jqLqDD1R6mcCNfECXjlLJXgmKw4CKfmuzV2pR9V5hJrKHxjOTcIA2DJk+YB6nIKZT4ov QR6Ycg920uD1bxkoOsRByu7AX1KXr+kG4VUS8VuSjEjxxc/R92z9oROYVjmZuEomvgIsq jX51JqyhkvwZ9/qOKfBkakyCOa0dljExJGksj9mmm/ClxK5dSvaIuP/CmC6KlOlFPFMer ERNGp2BLQcVBGZdJpqXiYElgK3hzDYXPl6N9rsqG0/h/N4ngNVSwKPXSraKJ1pCN6zQXh 1MdPBU46IOubfhx5MBjzM27NYnZZ/41GkO7d2X0f5FQTchfTqWDu8MS3ehniMqWBVow== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=fastmail.org; spf=pass smtp.mailfrom=fastmail.org; dkim=pass header.d=fastmail.org header.i=@fastmail.org header.a=rsa-sha256 header.s=fm2 header.b=fHPDKoo8; dkim=pass header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm2 header.b=s6rDGbCO; arc=none smtp.remote-ip=202.12.124.148 Received: from fout-b5-smtp.messagingengine.com (fout-b5-smtp.messagingengine.com [202.12.124.148]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9BFB3606A31E for ; Fri, 30 Oct 2026 02:05:41 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 9BFB3606A31E Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=fastmail.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=fastmail.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=fastmail.org header.i=@fastmail.org header.a=rsa-sha256 header.s=fm2 header.b=fHPDKoo8; dkim=pass (2048-bit key, unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm2 header.b=s6rDGbCO Received: from phl-compute-02.internal (phl-compute-02.internal [10.202.2.42]) by mailfout.stl.internal (Postfix) with ESMTP id 211FE1D000E7 for ; Thu, 29 Oct 2026 22:05:41 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-02.internal (MEProxy); Thu, 29 Oct 2026 22:05:41 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.org; h= cc:cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to; s=fm2; t=1793325940; x=1793412340; bh=FaBdhe+BilZDrddoVF/yP e3H5iKhhYZT0hc6y5Pow0o=; b=fHPDKoo8utiL93Q5xcoAYH11TXGj6qadP2pnw uV5kbmR3xSN8MkT1Sf/bkFJPt1/Og30cyIB1AKXtnHTHrQBMW6JcIzBUgmm5pFm8 b8AS+2VXb9CbOcWJMxvnN/77k8I6vOyVl0Xrcgyp0rywsP3VD6e9SwzsHxYE16q0 M3muG+viWNk2ZLgA7o9ueMr0OyavxXdIIcBe45lbnPUO9prhJR6RwdYEKHFroP9A qlew3PcYNJX+OxNslzfkFhV04BBxWtDND7ZUGkgXq3VjUEq1BC7x6+VNtI0lKUos YIFI0TjSDoNxRsiftgCt3ieIs0V1uWwCpi9AskQc+tFsgx7Kw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t= 1793325940; x=1793412340; bh=FaBdhe+BilZDrddoVF/yPe3H5iKhhYZT0hc 6y5Pow0o=; b=s6rDGbCOD8Kvq7RAlxiea8tzdHMGFGwmorujyn5lo6Ke47BeadQ V/2vCjsZQXefMuaVg9uJYc3Wg+B12Ux2PCHrqmKElxJdPq/Z7NDOypLst/oyZtjW +yrNRkBkPkZurZkQSqFagEynWr0/PtfAE5HWrZEXfU4ICoHkMjupbJXORKHKZNR4 UV59jlXyWsnwvw8OTUjK02TXgcuXP8AfhsGMeq8OQR5bcTBDHRoZL7nAV4UJcthD Ok9/ZRWjmTp+2v+6Gv0+KTX+ly26GnU+3YHpcmiKEFpcaWSMzmPsM6ftHhIEwMnM 9e9reTn6imBCHgROl8hWkhl5/31CSIbsihA== X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-08; repo=github.com/dkim2wg/interop; date=2026-10-28; sw=lmtpprox; action=sign d=fastmail.org a=rsa-sha256; DKIM2-Signature: i=1; m=1; t=1793325940; d=fastmail.org; mf=PGljYkBmYXN0bWFpbC5vcmc+; rt=PGxpbnV4LWtlcm5lbEB2Z2VyLmtlcm5lbC5vcmc+; s=fm2:rsa-sha256:VPZqZ9xSgoq81lo8pHE4a1rOV9l3FidAbBvJjTWjcqhdut3 wVz+XVSVcDbYlj955+5G1W122J/ZC9tn4zOQtNC5Dhi6zq/L8eXos3mNZ1ZJ/g75 1/oCFcXjw6ylAKapyYPdxHcnvr20cdaATaajFkpZH51mb04SGDDBc+QC9sSClEmh RwH8yHkCDU5tx9M510lrpnP6C+m/GFSjsaUi3xPI1W862YzSh73F2fYh64lcv8/e Az+etBI4dIjOepb1lwmtx7aF0vCDEi+yFoi66LOx5chTikbNsx/eVzMg05XE7r8n ozqGP7VcCQK6DpBx7Ffmv5qm8Ciwe9mNwe8T74Q==; X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-08; repo=github.com/dkim2wg/interop; date=2026-10-28; sw=lmtpprox; action=mi-m=1; hc=9; hn=cc,content-transfer-encoding,date,feedback-id,from, message-id,mime-version,subject,to; Message-Instance: m=1; h=sha256:+aMMOfRIwJXoJpN2rY6QcICx8fT0C7uYC286o+L8fNw=:/wP4vCjzLDwPCJDTrFdbpQj6RhesBSCyqe/LqXw9w3c=; X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTFaipjI6C9gtG9z8NrfEedlKvdaZbESlsh9dddB1e5Ur0R2NoRyH2lC89j2rrX5WC mWmwvvrt/hKsPc76Eqt3NE8U6vVSGozyzeuHq5w94SNBIx6j3IfRfE8dwT6q9m7sMHogr9 8ruGY+N4LnJ9eBdxgfwZV4HWM8tJfycmjXkx98zxPVYGHsFhYQzpPTx+cp6z+jnkbFbdH6 +58yvsrAKy2eBG9lgryWABrMduyO1e1fUeHAsudGHUT8C0FP6gdqdWYKLhP/SDlOdc38hD H/yPIbxFiy8yZPtEm4B3LJekJpTgz991hYBYBGGHynnb2G0WdXT/7yQ0AjSBHHJfcLFwRK LSQIBRCRNfNR6lypInrIH/YUsC5HEfzBW6+1GMIjz2qmekRUPKJPN8ewgoEsEWm4jVNf7k Dw1kXbjKrl8kJ4SrYpf+l2PUgn0BAgaDLxPDyncAzVScQ1/+mgxpmdZyKEcZxnKt5qX1bQ nJApTpJQwv4FbAeE7ZXNgxNmJMX3MSZJ/NUXqY5A6h5G22MDnCfxrGQ6zaygY+nmQ2vsQv HbcvOaPu9WgsYdhpgPSm8LSsgBE6O1jHTOzJXNAS0j6MOhnU+xr8ekAMO8WHeBThaqnB5C 9kjwYLPVU5ttwa3ZRzq9CPPntvdHqrU8RUbI+jX0bELdKdfCdRzAEMu8KCCw X-ME-Proxy: Feedback-ID: ib53e4b78:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 29 Oct 2026 22:05:38 -0400 (EDT) From: Ian Bridges To: Namjae Jeon Cc: Sergey Senozhatsky , Tom Talpey , ChenXiaoSong , linux-cifs@vger.kernel.org, linux-kernel@vger.kernel.org, Ian Bridges Subject: [PATCH 0/2] ksmbd: fix DACL evaluation for denies and guest sessions Date: Thu, 29 Oct 2026 21:05:21 -0500 Message-ID: <20261030020523.302085-1-icb@fastmail.org> X-Mailer: git-send-email 2.47.3 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On an acl_xattr share, smb_check_perm_dacl() has two evaluation errors. Patch 1 makes every open evaluate the DACL in order. Today a deny ACE that is the first one matching the caller grants every right it does not name. Patch 2 stops guest and anonymous sessions from matching Authenticated Users ACEs. The two patches belong together. Each one alone moves some guest results the wrong way through the other error. Patch 1 alone lets a guest gather rights from Authenticated Users ACEs as it walks the DACL. Patch 2 alone can leave an Everyone deny as the first ACE a guest matches, and that deny then grants every right it does not name. With both applied, every combination of one or two allow or deny ACEs for the caller, Everyone and Authenticated Users was tested, with READ_DATA, WRITE_DATA, WRITE_EA, APPEND_DATA or full access as the mask (930 DACLs). Each DACL also ended with an allow ACE giving the owner full access. The tests ran as an authenticated user, a guest and an anonymous session. Compared with the base, every result that changes agrees with ordered evaluation (MS-DTYP 2.5.3.2) and the definition of Authenticated Users (MS-DTYP 2.4.2.4), and no result that agreed changes. Both patches carry Cc stable and need to be backported in this order. Ian Bridges (2): ksmbd: evaluate the DACL in order for requested access ksmbd: exclude guest and anonymous sessions from Authenticated Users ACEs fs/smb/server/mgmt/user_config.h | 5 +++++ fs/smb/server/smb2pdu.c | 11 +++++++--- fs/smb/server/smbacl.c | 34 +++++++++++++----------------- fs/smb/server/smbacl.h | 2 +- fs/smb/server/tests/smbacl_kunit.c | 4 ++-- 5 files changed, 31 insertions(+), 25 deletions(-) base-commit: af8c72f6550744fe948ef2dbc7ab8739c149aab2 -- 2.47.3