[PATCH 0/2] ksmbd: fix DACL checks for owners and groups

[Ian Bridges <icb@fastmail.org>]

These patches fix two access failures in smb_check_perm_dacl() on
acl_xattr shares.

Patch 1 grants the owner's implicit READ_CONTROL and WRITE_DAC when
neither the DACL lookup nor the POSIX ACL fallback matches. It also
handles the owner's MAXIMUM_ALLOWED request on an empty DACL.

Patch 2 grants access through Unix group and OWNER RIGHTS ACEs when
the existing lookup would otherwise refuse the caller. It extends
the check added by patch 1, so the patches must be applied in order.
Both are intended for stable.

Runtime tests used ksmbd-for-next d13da43938d1 with KASAN. Tests
covered empty DACLs and generated one- and two-ACE DACLs on files and
directories, across owner, nonowner, group-member, guest and anonymous
sessions. The observed access changes matched MS-DTYP 2.5.3.2.
smbtorture found no new regressions.

The series builds on that base with W=1 and no warnings.

Ian Bridges (2):
  ksmbd: let the owner read and change the DACL when no ACE names it
  ksmbd: grant a caller what its groups and OWNER RIGHTS ACEs allow

 fs/smb/server/smbacl.c | 83 +++++++++++++++++++++++++++++++++++++-----
 1 file changed, 73 insertions(+), 10 deletions(-)


base-commit: d13da43938d15b0b719827d8f2b32df8eaec5def
-- 
2.47.3