From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=202.12.124.147 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793596492; b=wjUF5+p0vfX4nXuHERxXv8EkaidvHFOqnQbLlD8rT57ueTZM4a49AwXPvyvE/W2/tBK4 p3czNUswYIUEv7g9Tg46ZbmUeKiU4+qNj31573LFqSP0RUN4g6uPRY7oWWhbgLn0zxOPo GGoadsylTDGkfh7PIfgAlH2qYy6cCT2iHCdG6WBTzI9wQ4zA1p4Rl71XTGKlMv94zGbUt gCLFQssJKCD00L4Il/xW7POZma9cO9tJkAMezc2EZsyH+M8V2FYUo0HSo88JuRhCBO4O4 +ZArdbM5ixSwOvaKZmjFigUipyjuIjjCoZopI8IFT8lR3sXO8oNFnTeMEvL4I8FKDcQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793596492; h=DMARC-Filter:Received:Received:DKIM-Signature:DKIM-Signature: X-DKIM2-Info:DKIM2-Signature:X-DKIM2-Info:Message-Instance: X-ME-Sender:X-ME-Received:X-ME-Proxy-Cause:X-ME-Proxy:Feedback-ID: Received:From:To:Cc:Subject:Date:Message-ID:X-Mailer:MIME-Version: Content-Transfer-Encoding; bh=jMtjIgA43+c/lzOmY12E6boojWAvU84MMBpXv340+1w=; b=hxO9q+oTTkHAu8i668ZmrNs2kdyHiWNa0HlGcHZn/TeYOxeDyIiYWCd0MgpZWq0qK21S 1t9JZT+5Bcb9NX8cENivHqsmaYyKDQtF2VJxyD+IW/lQEco6dVJOOST4cI0ct9dhD8lw2 33Ndz3cMHyNPfqFigCMpW4r6Dnpa3PRurH5VzTVFsnzRH5ev5NX/44UJxmdWopB2MBTdp p1cAIp/j6D0qltdjDF3D7o8JS3TsxeAMlZh69QwqM/S7p9jVRJD1GUgXhqALjvwLHDoOG 7mClG6H95NpSoCMi9JvYZ7Ls8DJX2zXoFeww70fNi3sDBXzXAKmBjlSiITYdnGRTk2A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=fastmail.org; spf=pass smtp.mailfrom=fastmail.org; dkim=pass header.d=fastmail.org header.i=@fastmail.org header.a=rsa-sha256 header.s=fm2 header.b=jSazJCSb; dkim=pass header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm2 header.b=sscGai+f; arc=none smtp.remote-ip=202.12.124.147 Received: from fout-b4-smtp.messagingengine.com (fout-b4-smtp.messagingengine.com [202.12.124.147]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CDA34606A324 for ; Mon, 2 Nov 2026 05:14:51 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org CDA34606A324 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=fastmail.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=fastmail.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=fastmail.org header.i=@fastmail.org header.a=rsa-sha256 header.s=fm2 header.b=jSazJCSb; dkim=pass (2048-bit key, unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm2 header.b=sscGai+f Received: from phl-compute-05.internal (phl-compute-05.internal [10.202.2.45]) by mailfout.stl.internal (Postfix) with ESMTP id 502691D0012C for ; Mon, 2 Nov 2026 00:14:51 -0500 (EST) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-05.internal (MEProxy); Mon, 02 Nov 2026 00:14:51 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.org; h= cc:cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to; s=fm2; t=1793596490; x=1793682890; bh=jMtjIgA43+c/lzOmY12E6 boojWAvU84MMBpXv340+1w=; b=jSazJCSb1x+XATOUV4bxOI+g4tDldXs4RaMJ7 drEGID+3jBXVPvn5Ivl3TMHSL366rOBBeIeOtg8BUyyJaScgirmdnBe/ihZ33xko n3MCVEDfN6xk952ZHFskTVxwa1cmmIprEgPj4uQN8zYNL8/s93CalYFDLZvrgMGu 8XD9n67pzalmGsrr0c5+gGeGLDXL4s7V556oH6g5L0xOWKZ4225bcmhuZxmDKd7L G1LzGDQhEyqb5jSkvJawdp2poSGNQMS69eHZnGjto4CRiEzIMpR2aLnvSecARyWF s+hwdsjwoHZzLuAZcoXsX3BMuHE73wMkDMpit1TM0lTXqe9PA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t= 1793596490; x=1793682890; bh=jMtjIgA43+c/lzOmY12E6boojWAvU84MMBp Xv340+1w=; b=sscGai+fDjWTkh+E5NcAH5PiwKR9u3CXBs2rVjZMLN+epgWmH4n us5af4EUBpA8mLye0uELNZW2mRLVhPLe0JiYkVCT2lHWeYIJeUTfMvH024OyYNpD jxiFRNRTGAbnpHi2ynwYoAYYxDZWKRLSHEq8bp1diZBu3SRCwskOLfQPgVN4f0N0 XQP9puyaXJ8ochDPcZig+8UetIwOFgn52pFX4uKAXYfk9E09uR7OPIBBM3VrM9Oh lAcUx9oV9inGnisYdwTxbASp/61gHkGKYfVanu+RzWIF2qunVUZNTqFk8NlJY4cW m1j8htlWRWNbvwB0CrbzlD9O/PnbOWjeh5A== X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-08; repo=github.com/dkim2wg/interop; date=2026-10-28; sw=lmtpprox; action=sign d=fastmail.org a=rsa-sha256; DKIM2-Signature: i=1; m=1; t=1793596490; d=fastmail.org; mf=PGljYkBmYXN0bWFpbC5vcmc+; rt=PGxpbnV4LWtlcm5lbEB2Z2VyLmtlcm5lbC5vcmc+; s=fm2:rsa-sha256:jfIv+Yi/lNO/6IlgfCT1H7JOeWC8c/xswVpzKQGLOCCApRo ppsmwybUHcvfqZmv6lRDyo350CGdpE1Dqxipad250L7BHbKiBKis1QKCl8E683jr c1EpHmeUPnnZY6plr+26/ubi2mOWOhXkS3MRuPxi9cXS4+Y3JKKcd9QsgaAyQhtS bK8LKIctoY/umXK/eveCpst9gaMr4yXQaWCL2LY2xh/TG92L/JGctLkwlItlFUHv GFdJYiq/Z2hCHDrfQ3aONGERMW9ygW9sS54nuc6JHaUoFIM9eiD3ER23VT5vv4dK RUSxuFASMu1Zj/2f6SfMv+aRE2i7D1BliQ78wYA==; X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-08; repo=github.com/dkim2wg/interop; date=2026-10-28; sw=lmtpprox; action=mi-m=1; hc=9; hn=cc,content-transfer-encoding,date,feedback-id,from, message-id,mime-version,subject,to; Message-Instance: m=1; h=sha256:00w2r3bAhZe5Mnq8RfvDPanzXzlVZnIneg2QSCotbdQ=:nYDK/w6ZIE7On70icd4mEx/hnoUF9KJRBBihAIEPdos=; X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTF7LU1oUKbshqWTEClbsUf7zYe5dwP6RhfDFn/QDn+SGv9JujCGoZBiRPCW5Zy8uM xBwo65hFt35V1L7ISt3DAImlh6poIQ8FPym7u5AmmPp2jiD6gDAt9D9U8V5YggvyFk4VKG CNqNmbtd7buavIpnfuGMEfEC7D9jRrDg5szR+n3W+kUnlNK0y6XHELnAMKwfNkBW3cMJZU j8r9v2JNyfGnla+sSeCGQjE3pVls51LufjIMFsk4VVsNAfT6zpaPNDlR0XwAs8AeZfipr9 PxiGUsatxAs4YiEqzxjtnld2UXGyW2fWX6VihwnVNimc3z/yfNAdiRHc851Tv6j5ypANbU QEFACfWplQIm3wWppfyZRzzrtXygVcDyrPm9DxP+w3jcGcehZnglTCzzT5wvXApSTnVW8H xQhRBUnJVAjcnK6rBwh12PjHFL2aerczyYvDy6KReGTFAteHBee/Zs34znQqGXHI1qUQes Ms+XUM5Hl0ac3jqe0hAaLJ1jOnyDpW0Ecxd9pjhoElZ/9/V0lT+p9ct4Gj9Dl0jxPD9OMo /QJh7cw05+TFqK4QSt6jDHExEVyBRjg7SCaKXvFLADJS60KYq23qg4KaoGTjUvvYbpdNu4 mDV5Cw+zgvce/G94HXF0B/y6vCFOv4S6gDOlthv3rQ3LynLQbJ4Er6YOh7vA X-ME-Proxy: Feedback-ID: ib53e4b78:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Mon, 2 Nov 2026 00:14:49 -0500 (EST) From: Ian Bridges To: Namjae Jeon Cc: Sergey Senozhatsky , Tom Talpey , ChenXiaoSong , linux-cifs@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Ian Bridges Subject: [PATCH] ksmbd: grant a POSIX ACL group entry only to the group's members Date: Sun, 1 Nov 2026 23:14:28 -0600 Message-ID: <20261102051428.817037-1-icb@fastmail.org> X-Mailer: git-send-email 2.47.3 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When no ACE of the DACL matches the caller, Everyone or Authenticated Users, smb_check_perm_dacl() falls back to the file's POSIX ACL. It takes the first ACL_USER or ACL_GROUP entry whose id equals the caller's uid. For ACL_GROUP, this compares a gid with the caller's uid. A numerical match grants the group's permissions even when the caller is not a member. Match a group entry only when the caller is also in the group. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Reported-by: Namjae Jeon Closes: https://lore.kernel.org/linux-cifs/CAKYAXd93czbFD=znZUq_pJLXzDR5N3zc_auvAGWT7pzKR1f9Ag@mail.gmail.com/ Cc: stable@vger.kernel.org Signed-off-by: Ian Bridges --- Notes: Reachable on a share with "vfs objects = acl_xattr" when the fallback runs and the POSIX ACL has a group entry whose gid equals the caller's uid. Such entries come from setfacl or from ksmbd's own mapping of a DACL to POSIX. A guest account reaches it the same way on a share with "guest ok = yes". The fallback retains its existing id match and adds a group membership check. Tested on ksmbd-for-next d13da43938d1 with KASAN. Generated DACLs of one or two allow or deny ACEs were probed on files and directories as the owner, other users, group members, a guest and an anonymous session. In the tested cases, only the results of the guest account with the uid/gid collision change. It no longer gets the rights of the file's group, which it is not in. Its MAXIMUM_ALLOWED opens were granted with no access and are now refused, matching the maximal access reply. smbtorture gives the same results as on the base. A reproducer is available on request. This fix was developed with LLM assistance. fs/smb/server/smbacl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c index 664f01263611..d9ceeb84d8da 100644 --- a/fs/smb/server/smbacl.c +++ b/fs/smb/server/smbacl.c @@ -1625,7 +1625,10 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path, else continue; - if (id == uid) { + /* A group entry grants only to the group's members */ + if (id == uid && + (pa_entry->e_tag == ACL_USER || + in_group_p(make_kgid(&init_user_ns, id)))) { mode_to_access_flags(pa_entry->e_perm, 0777, &access_bits); base-commit: d13da43938d15b0b719827d8f2b32df8eaec5def -- 2.47.3