Re: [PATCH 2/2] ksmbd: grant a caller what its groups and OWNER RIGHTS ACEs allow

[Ian Bridges <icb@fastmail.org>]

Hi Namjae,

Sashiko is right about access_bits. In v1, an explicit request could
gain rights from the ordered walk when the selected ACE had a type
the lookup does not handle. I've prepared v2, which clears access_bits
after that walk for explicit requests.

The other three findings describe limitations that also exist before
this patch.

For FILE_EXECUTE, the reported OWNER RIGHTS ACE grants generic read
without execute. MAXIMUM_ALLOWED|GENERIC_EXECUTE is refused before
and after the patch. The execute adjustment is not included in the
new OWNER RIGHTS-only path. A probe confirms this.

For Everyone and Authenticated Users, the existing lookup still lets
one of those ACEs decide the explicit request when no ACE names the
caller's own SID. Group and OWNER RIGHTS ACEs are ignored in that
case. This patch changes only requests that the lookup and POSIX ACL
fallback would otherwise refuse.

For the maximal access context, a non-owner relying solely on group
grants still fails the MAXIMUM_ALLOWED check. An explicit open can
therefore succeed without MxAc and fail with it. The probe confirms
this, and the v2 message now documents it. Counting groups in
MAXIMUM_ALLOWED also needs changes in smb2_open().

Thanks,
Ian