[PATCH v3 0/2] ksmbd: fix explicit DACL checks and parent-derived rights

[Ian Bridges <icb@fastmail.org>]

smb_check_perm_dacl() mishandles explicit access requests. It can turn a
deny ACE into a grant, ignore earlier deny ACEs, and treat guest and
anonymous sessions as Authenticated Users. This can grant read or write
access that the stored DACL does not grant.

The function also ignores rights granted by the parent directory.
FILE_DELETE_CHILD can grant DELETE on a child, and FILE_LIST_DIRECTORY
can grant FILE_READ_ATTRIBUTES.

Patch 1 evaluates explicit requests in DACL order and excludes guest and
anonymous sessions from Authenticated Users. Patch 2 obtains explicitly
requested DELETE and FILE_READ_ATTRIBUTES rights from the parent DACL.

Patch 2 uses the authentication state added by patch 1. It also restores
parent-derived rights that patch 1 can remove from guests. Backport the
patches in order.

Older stable trees first need commit cc2f133e80eb ("ksmbd: fix maximum
allowed access checks") and the preceding DACL fixes through "ksmbd:
grant a caller what its groups and OWNER RIGHTS ACEs allow".

Changes since v2:
- Patch 1: keep the POSIX ACL fallback from replacing the DACL result
  when an Authenticated Users ACE is present, including for guest and
  anonymous sessions. Namjae found that the fallback could otherwise
  grant access denied by the DACL.
- Rebase onto the current ksmbd-for-next.

Changes since v1:
- Patch 2: let group and OWNER RIGHTS ACEs decide the strict parent
  check before the POSIX ACL fallback. Sashiko's review of v1 found that
  a POSIX ACL entry could otherwise hide a FILE_DELETE_CHILD grant.
- Patch 2: add a comment on which MAXIMUM_ALLOWED requests omit group
  ACEs.

v1: https://lore.kernel.org/linux-cifs/20261107062233.1579198-1-icb@fastmail.org/
v2: https://lore.kernel.org/linux-cifs/20261107231941.1824289-1-icb@fastmail.org/

Both patches were tested with KASAN on ksmbd-for-next 6f42553e493d.
Its fs/smb/server tree is identical to current head 2f14fe2d5895.
smbtorture results are unchanged.

This series was developed with LLM assistance.

Ian Bridges (2):
  ksmbd: evaluate the DACL in order for explicit access requests
  ksmbd: let the parent's DACL grant DELETE and FILE_READ_ATTRIBUTES

 fs/smb/server/mgmt/user_config.h   |   5 ++
 fs/smb/server/smb2pdu.c            |  11 ++-
 fs/smb/server/smbacl.c             | 133 +++++++++++++++++++++++++----
 fs/smb/server/smbacl.h             |   2 +-
 fs/smb/server/tests/smbacl_kunit.c |   4 +-
 5 files changed, 131 insertions(+), 24 deletions(-)


base-commit: 2f14fe2d589583ce649b2bf1b449cc9839abda8b
-- 
2.47.3