From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=202.12.124.149 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794162026; b=D4/ZmnFZa8fsSljyYNa6IyoWgoCX6udkv0hSOqaJIvp328Unwo2/6Jt0F+6JgNBWGOkj 81F9dwu6XrQjv/IkcWX99B+fDixmmn/EBSoIHppQu1TcnH5hXqfDsYmTIJWQFQDel/RC/ dP/NJYKpiSA6XkdBI6sUHnDGc7kZ63i6K5QqSIFc86/5WTqIPD9bEVlEr7mBvOPLoF1fT SRcdS2mtRMOqrYjnl829CJ68NvuPuua5Fa58thSdaOJG9WYJnC1m3SnC1JmdWkXBaPYh0 Gl9ZdRl4cpBB1CZkjN5COMVM4oFfROxcj6u/8wLco9Hsg1Gz/AuOPDHUE3u/gf4FgvQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794162026; h=DMARC-Filter:Received:Received:DKIM-Signature:DKIM-Signature: X-DKIM2-Info:DKIM2-Signature:X-DKIM2-Info:Message-Instance: X-ME-Sender:X-ME-Received:X-ME-Proxy-Cause:X-ME-Proxy:Feedback-ID: Received:From:To:Cc:Subject:Date:Message-ID:X-Mailer:MIME-Version: Content-Transfer-Encoding; bh=PbR35XiVVIWraPGWWcvFvDs5I54IAhzBzMiggypBFzw=; b=ZDb1G/8JstAXxBVAcALkOll93/6v8XaT8vWMhVb3Zwbeg/DHVQP/wNwy1A6Bak0bSGi4 gpDXtBhoIqhjtB9S5fCaKmk5Q2SiDj75HLXILWth+NfLapltoGVCOfuw8kl5mwbSsAE/p QhQq/eJl+PevApbifhBcm5vaGw/XOG4sMRXncr+b9tK1pQIiuGEt4+eco1EuTkYJYI4kY vqyRtM4ZW+/jzKlgLV5uFcxj5nE4VprVJ4/IJfkEdrcCTINZAtCkM5wP5ZEbiSgNExsDg DIWH/0KW2uP8Za9Gkcm7N3iW2+IMpypDYO9ntaO/N/YYUyiecBVybHcaDrp3GPUrCWQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=fastmail.org; spf=pass smtp.mailfrom=fastmail.org; dkim=pass header.d=fastmail.org header.i=@fastmail.org header.a=rsa-sha256 header.s=fm3 header.b="ieVkY/My"; dkim=pass header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm3 header.b=0BSP1A+9; arc=none smtp.remote-ip=202.12.124.149 Received: from fout-b6-smtp.messagingengine.com (fout-b6-smtp.messagingengine.com [202.12.124.149]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDA82606A321 for ; Sun, 8 Nov 2026 18:20:24 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org EDA82606A321 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=fastmail.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=fastmail.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=fastmail.org header.i=@fastmail.org header.a=rsa-sha256 header.s=fm3 header.b=ieVkY/My; dkim=pass (2048-bit key, unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm3 header.b=0BSP1A+9 Received: from phl-compute-12.internal (phl-compute-12.internal [10.202.2.52]) by mailfout.stl.internal (Postfix) with ESMTP id 664251D000A9 for ; Sun, 8 Nov 2026 13:20:24 -0500 (EST) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-12.internal (MEProxy); Sun, 08 Nov 2026 13:20:24 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.org; h= cc:cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to; s=fm3; t=1794162023; x=1794248423; bh=PbR35XiVVIWraPGWWcvFv Ds5I54IAhzBzMiggypBFzw=; b=ieVkY/MyUQjict4emdgBNUWBAQkGWLTriVLHv hUwMmA0qOivsC8aBMqwGjNNBKumy9gSGNWkZWgJOf6akY0+sZZZPqs+GQZhlWeoV BN2GqSAMJ7m8Jb6Jq+5vw56Iew3ND3uoYA5RjI4ruS9Fz4kcqEjMsM1DIrrEJXTe +L+XMsl0PTvvFGj1Lcu/Yz1zpfLfDfuQ9Of8lQ1OuwXuJIYdCuTMxP2pFs7dr8dh cRgZFy0ZbLU/QKvMQgy8Qdf2zobXaJ2JkXmWR77V114wB6EQ2IaLaWfgv1CUjn4d RSOshKMhh5rJTrXqR//OtGUuYRT3dpTk3LuipIH+tYABBrOow== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t= 1794162023; x=1794248423; bh=PbR35XiVVIWraPGWWcvFvDs5I54IAhzBzMi ggypBFzw=; b=0BSP1A+9Q/jZ+pn1jTUWs03EC2WshDsfmxpaujfuy6nnLpSYUAC ujfCOTAsi4N0VKvNBcEgX80mhx7ywRUnUt0uTNBqIiauiz8v4SP/Nixxrl7BTKRk a8jEBeAYpbT1KF1cPiAFuSCkeD1xcLa/Da6Ky0ITBkUnVFaNx1w1yPGsLUMEeI8Q /Ys++J3s9qnD1PPUyfD8OpK4MT8yl0QnyDS5YIBM297qzvpxa9fQ0XZYbDBL2gRl LCZH6w01lhg5BHXhSUJx1MhwkbC+d+yjRiRBawYc/s3pmJD0oZp5zYYhXSOo8wqT lRQwQZOBGFkVd2iSz93Xq4zE7JeN2FZ7iRA== X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-09; repo=github.com/dkim2wg/interop; date=2026-11-03; sw=lmtpprox; action=sign d=fastmail.org a=rsa-sha256; DKIM2-Signature: i=1; m=1; t=1794162023; d=fastmail.org; mf=PGljYkBmYXN0bWFpbC5vcmc+; rt=PGxpbnV4LWtlcm5lbEB2Z2VyLmtlcm5lbC5vcmc+; s=fm3:rsa-sha256:Wm2PdQJVHven58B16HYTu7Efz/GXbkO4ryROwN/vt1nDafC yX6KB6+KC7WzBvtj/g7sKelrC7A31fiMqwTBVGPXdXYzSSx94bnBWeQC1RmxZRAt afEQzY7AQQgRaDmbDOzeE/Ca5GDLrYT03TZ46w5OkDVFRGZh+RjmNT2bJPYbkWEW AgoAmJMMBN+8frl4qAImTAhmg1aIAjeS+iB1yzt5ZsQfWj9FEmGdyEB+cT200dhA BBOjCsBKsohvcrShDRRFdcq8ANF8s/VLPSBeA4UTptl3toRTfQEKC92RAJ/N0KAz pV4oP/BBvgN/+2VQf15BKhNYIys2k4DRZ7sTS5Q==; X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-09; repo=github.com/dkim2wg/interop; date=2026-11-03; sw=lmtpprox; action=mi-m=1; hc=9; hn=cc,content-transfer-encoding,date,feedback-id,from, message-id,mime-version,subject,to; Message-Instance: m=1; h=sha256:1jug1UyKWT71b9GkrDBBCB8olC6QuXKeGuVlzpNj7vg=:wUxsHYGFCU3zkHneFwyevYZjfEzbUrcHmIieWC5JXMk=; X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTEz4lTyiNlrhfEqdBUEbs0DMfQN8NYKzX9n13W2b6fXSHzuYZC4bA0OGY4WpAnTTJ of/ZS2XdmZzbr7hs2WU/xDrkqIc+G656ONabJgxwSG/JiAcHkpAtbN2RlclHMCZo+0lnIs 1UUOWyZ4EiLzGsQSazJpKutoo8RgUkqUPZiv94lbNlGvIVJ7JNLY5gEluO1giqNIqnGc4Y hJxakEtZzGPXmfMnUdvpnSao0lF6SmoXM+u35V+DMsSFzOjlrUtpBJKcTu3vm5pAC0+DUq y3qUT32erocSLB24gevKxkGL993tCtua0yNuhVqVQL0/ZCSUkLPJcrtfyC2Su/MPYjZjKe ho9ww9PiNzwYwwGXiY2Nsxp6HvT/w7kdIhyw8irroiIAL9dPgASibqURvhALn1Olr9uf42 /LbEn2dsUruMOuRyM18Q8E1kUwctpKpE/BZw7bQHltovOi5kSVy1hzfhxOfc3FdU0fw68+ /WS4yjGaSilII0L7LWPRAQZBfQwuowvpsbHYNSTeBrUM3wrM7FDFnHEeHe6nQTqVAooSTN KDnm0rS6pCRQyCsZ7h6OwLVXYzTVtT31ZCShLkj/2nidScTJXCrpCRu660Nc974Xgu1dkT TBXv9eVHITdZb6yxjWo1InSzKvKFQi+4izfTezqatNeyDL73h/PVyUx4wT+w X-ME-Proxy: Feedback-ID: ib53e4b78:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sun, 8 Nov 2026 13:20:22 -0500 (EST) From: Ian Bridges To: linkinjeon@kernel.org Cc: senozhatsky@chromium.org, tom@talpey.com, chenxiaosong@chenxiaosong.com, linux-cifs@vger.kernel.org, linux-kernel@vger.kernel.org, Ian Bridges Subject: [PATCH v3 0/2] ksmbd: fix explicit DACL checks and parent-derived rights Date: Sun, 8 Nov 2026 12:20:09 -0600 Message-ID: <20261108182011.1888520-1-icb@fastmail.org> X-Mailer: git-send-email 2.47.3 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit smb_check_perm_dacl() mishandles explicit access requests. It can turn a deny ACE into a grant, ignore earlier deny ACEs, and treat guest and anonymous sessions as Authenticated Users. This can grant read or write access that the stored DACL does not grant. The function also ignores rights granted by the parent directory. FILE_DELETE_CHILD can grant DELETE on a child, and FILE_LIST_DIRECTORY can grant FILE_READ_ATTRIBUTES. Patch 1 evaluates explicit requests in DACL order and excludes guest and anonymous sessions from Authenticated Users. Patch 2 obtains explicitly requested DELETE and FILE_READ_ATTRIBUTES rights from the parent DACL. Patch 2 uses the authentication state added by patch 1. It also restores parent-derived rights that patch 1 can remove from guests. Backport the patches in order. Older stable trees first need commit cc2f133e80eb ("ksmbd: fix maximum allowed access checks") and the preceding DACL fixes through "ksmbd: grant a caller what its groups and OWNER RIGHTS ACEs allow". Changes since v2: - Patch 1: keep the POSIX ACL fallback from replacing the DACL result when an Authenticated Users ACE is present, including for guest and anonymous sessions. Namjae found that the fallback could otherwise grant access denied by the DACL. - Rebase onto the current ksmbd-for-next. Changes since v1: - Patch 2: let group and OWNER RIGHTS ACEs decide the strict parent check before the POSIX ACL fallback. Sashiko's review of v1 found that a POSIX ACL entry could otherwise hide a FILE_DELETE_CHILD grant. - Patch 2: add a comment on which MAXIMUM_ALLOWED requests omit group ACEs. v1: https://lore.kernel.org/linux-cifs/20261107062233.1579198-1-icb@fastmail.org/ v2: https://lore.kernel.org/linux-cifs/20261107231941.1824289-1-icb@fastmail.org/ Both patches were tested with KASAN on ksmbd-for-next 6f42553e493d. Its fs/smb/server tree is identical to current head 2f14fe2d5895. smbtorture results are unchanged. This series was developed with LLM assistance. Ian Bridges (2): ksmbd: evaluate the DACL in order for explicit access requests ksmbd: let the parent's DACL grant DELETE and FILE_READ_ATTRIBUTES fs/smb/server/mgmt/user_config.h | 5 ++ fs/smb/server/smb2pdu.c | 11 ++- fs/smb/server/smbacl.c | 133 +++++++++++++++++++++++++---- fs/smb/server/smbacl.h | 2 +- fs/smb/server/tests/smbacl_kunit.c | 4 +- 5 files changed, 131 insertions(+), 24 deletions(-) base-commit: 2f14fe2d589583ce649b2bf1b449cc9839abda8b -- 2.47.3