* [PATCH v3 1/2] ksmbd: evaluate the DACL in order for explicit access requests
2026-11-08 18:20 [PATCH v3 0/2] ksmbd: fix explicit DACL checks and parent-derived rights Ian Bridges
@ 2026-11-08 18:20 ` Ian Bridges
2026-11-08 18:20 ` [PATCH v3 2/2] ksmbd: let the parent's DACL grant DELETE and FILE_READ_ATTRIBUTES Ian Bridges
1 sibling, 0 replies; 3+ messages in thread
From: Ian Bridges @ 2026-11-08 18:20 UTC (permalink / raw)
To: linkinjeon
Cc: senozhatsky, tom, chenxiaosong, linux-cifs, linux-kernel,
Ian Bridges, stable
For requests without MAXIMUM_ALLOWED, smb_check_perm_dacl() selects one
ACE instead of evaluating the DACL in order. When the selected ACE is a
deny ACE, the function grants the complement of its mask, and deny ACEs
before it are ignored. The selected ACE can also be inherit-only,
unsupported, or an NFS mode ACE.
Guest and anonymous sessions also match Authenticated Users. These bugs
can grant read or write access that the stored DACL does not grant. For
example, a deny of FILE_READ_DATA grants FILE_WRITE_DATA, and guests can
read files granted only to Authenticated Users.
Evaluate explicit requests in DACL order. Use exact SID matching for the
caller, Everyone, Authenticated Users, OWNER RIGHTS and the caller's
groups. Match Authenticated Users only for authenticated sessions, and
ignore the NFS mode SID.
An Authenticated Users ACE must still prevent the POSIX ACL fallback
from replacing the DACL result for guest and anonymous sessions. The ACE
does not grant them access.
Keep the existing single-ACE behavior when a non-inherit-only object
deny ACE is present because ksmbd does not parse those ACEs. Guest and
anonymous sessions do not match Authenticated Users there either.
MAXIMUM_ALLOWED behavior is unchanged.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Fixes: cc2f133e80eb ("ksmbd: fix maximum allowed access checks")
Cc: stable@vger.kernel.org
Signed-off-by: Ian Bridges <icb@fastmail.org>
---
Notes:
This patch changes explicit requests only. MAXIMUM_ALLOWED and
maximal-access replies still treat guest and anonymous sessions as
Authenticated Users.
The NFS mode ACE carries the POSIX mode but names no caller.
inode_permission() continues to enforce that mode.
DACL-order evaluation keeps a right granted by an allow ACE before a
later deny ACE.
fs/smb/server/mgmt/user_config.h | 5 +++
fs/smb/server/smb2pdu.c | 11 ++++--
fs/smb/server/smbacl.c | 58 +++++++++++++++++++++++-------
fs/smb/server/smbacl.h | 2 +-
fs/smb/server/tests/smbacl_kunit.c | 4 +--
5 files changed, 62 insertions(+), 18 deletions(-)
diff --git a/fs/smb/server/mgmt/user_config.h b/fs/smb/server/mgmt/user_config.h
index cc460b4ff7d3..e116b2ee9917 100644
--- a/fs/smb/server/mgmt/user_config.h
+++ b/fs/smb/server/mgmt/user_config.h
@@ -67,4 +67,9 @@ struct ksmbd_user *ksmbd_alloc_user(struct ksmbd_login_response *resp,
void ksmbd_free_user(struct ksmbd_user *user);
bool ksmbd_anonymous_user(struct ksmbd_user *user);
bool ksmbd_compare_user(struct ksmbd_user *u1, struct ksmbd_user *u2);
+
+static inline bool ksmbd_user_authenticated(struct ksmbd_user *user)
+{
+ return user && !user_guest(user) && !ksmbd_anonymous_user(user);
+}
#endif /* __USER_CONFIG_MANAGEMENT_H__ */
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 5bbc33d5a3a8..72981756ee23 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -4338,7 +4338,8 @@ static int smb2_handle_app_instance_id(struct ksmbd_work *work,
/* Authorize the referenced open even if its name changes meanwhile. */
old_path = &old_fp->filp->f_path;
rc = smb_check_perm_dacl(conn, old_path, &maximal_access, 0,
- work->sess->user->uid, false);
+ work->sess->user->uid,
+ ksmbd_user_authenticated(work->sess->user), false);
if (rc) {
/* Access denial prevents takeover, not the CREATE itself. */
ksmbd_put_durable_fd(old_fp);
@@ -4860,14 +4861,17 @@ int smb2_open(struct ksmbd_work *work)
if (file_present && !(req->CreateOptions & FILE_DELETE_ON_CLOSE_LE)) {
rc = smb_check_perm_dacl(conn, &path, &daccess,
req->DesiredAccess,
- sess->user->uid, false);
+ sess->user->uid,
+ ksmbd_user_authenticated(sess->user), false);
if (rc)
goto err_out;
if (maximal_access_ctxt) {
maximal_access = FILE_MAXIMAL_ACCESS_LE;
rc = smb_check_perm_dacl(conn, &path, &maximal_access,
- 0, sess->user->uid, false);
+ 0, sess->user->uid,
+ ksmbd_user_authenticated(sess->user),
+ false);
if (rc)
goto err_out;
@@ -6347,6 +6351,7 @@ static int process_query_dir_entries(struct smb2_query_dir_private *priv)
rc = smb_check_perm_dacl(priv->work->conn, &path,
&daccess, daccess,
priv->work->sess->user->uid,
+ ksmbd_user_authenticated(priv->work->sess->user),
true);
if (rc) {
dput(dent);
diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index 32feafe9f73b..50a03101cd8a 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -1478,6 +1478,12 @@ static bool smb_sid_in_group(const struct smb_sid *sid)
return in_group_p(make_kgid(&init_user_ns, gid));
}
+/* Whether two SIDs are the same SID */
+static bool smb_sid_equal(const struct smb_sid *a, const struct smb_sid *b)
+{
+ return a->num_subauth == b->num_subauth && !compare_sids(a, b);
+}
+
/*
* compare_sids() compares only the sub-authorities both SIDs have, so it
* also matches a shorter or longer SID, such as S-1-3 or S-1-3-4-777
@@ -1490,7 +1496,7 @@ static bool smb_sid_is_owner_rights(const struct smb_sid *sid)
int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
__le32 *pdaccess, __le32 raw_daccess, int uid,
- bool strict)
+ bool authenticated, bool strict)
{
const struct mnt_idmap *idmap = mnt_idmap(path->mnt);
struct smb_ntsd *pntsd = NULL;
@@ -1507,12 +1513,17 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
unsigned int access_bits = 0, denied = 0, grp_granted = 0;
unsigned int grp_allowed = 0, grp_denied = 0, bits;
struct smb_ace *others_ace = NULL;
- bool or_ace = false, obj_deny = false, member, counted;
+ bool or_ace = false, obj_deny = false, au_ace = false, member, counted;
struct posix_acl_entry *pa_entry;
unsigned int sid_type = SIDOWNER;
unsigned short ace_size;
bool is_owner, owner_rights = false;
bool maximal = *pdaccess & FILE_MAXIMAL_ACCESS_LE;
+ /*
+ * MAXIMUM_ALLOWED requests match every session against
+ * Authenticated Users.
+ */
+ bool authusers = authenticated || maximal;
vfsuid_t vfsuid;
ksmbd_debug(SMB, "check permission using windows acl\n");
@@ -1564,9 +1575,10 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
/*
* Evaluate the DACL in order (MS-DTYP 2.5.3.2). access_bits collects
- * the MAXIMUM_ALLOWED result. grp_granted collects what ACEs for the
- * caller's groups, or OWNER RIGHTS for the owner, grant. It is used
- * when the SID lookup and POSIX ACL fallback below do not decide.
+ * the result for the ACEs that apply to the caller, without its groups
+ * for MAXIMUM_ALLOWED. grp_granted collects what ACEs for the caller's
+ * groups, or OWNER RIGHTS for the owner, grant. It is used when the
+ * SID lookup and POSIX ACL fallback below do not decide.
*/
ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl));
aces_size = pdacl_size - sizeof(struct smb_acl);
@@ -1606,10 +1618,18 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
(compare_sids(&sid, &ace->sid) &&
compare_sids(&sid_unix_NFS_mode, &ace->sid) &&
compare_sids(&sid_everyone, &ace->sid) &&
- compare_sids(&sid_authusers, &ace->sid) &&
+ (!authusers ||
+ compare_sids(&sid_authusers, &ace->sid)) &&
compare_sids(&sid_owner_rights, &ace->sid) &&
!member))
goto next_ace;
+ /* An explicit request counts only SIDs that match exactly */
+ if (!maximal && !member &&
+ !smb_sid_equal(&sid, &ace->sid) &&
+ !smb_sid_equal(&sid_everyone, &ace->sid) &&
+ !(authusers && smb_sid_equal(&sid_authusers, &ace->sid)) &&
+ !smb_sid_is_owner_rights(&ace->sid))
+ goto next_ace;
bits = le32_to_cpu(ace->access_req);
switch (ace->type) {
@@ -1627,8 +1647,8 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
case ACCESS_DENIED_CALLBACK_ACE_TYPE:
if (counted)
grp_denied |= ~grp_allowed & bits;
- /* access_bits takes no group denials either */
- if (!member)
+ /* MAXIMUM_ALLOWED takes no group denials either */
+ if (!(maximal && member))
denied |= ~access_bits & bits;
break;
}
@@ -1648,8 +1668,14 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
(access_bits & GENERIC_READ_FLAGS) == GENERIC_READ_FLAGS)
access_bits |= FILE_EXECUTE;
granted = requested | access_bits;
+ } else if (!obj_deny) {
+ /* An explicit request takes the ordered result */
+ access_bits &= ~denied;
} else {
- /* An explicit request uses only grp_granted and obj_deny */
+ /*
+ * ksmbd does not parse object deny ACEs, so with one present an
+ * explicit request keeps the answer of the ACE found below
+ */
access_bits = 0;
}
@@ -1680,15 +1706,23 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
!(ace->flags & INHERIT_ONLY_ACE))
or_ace = true;
if (!compare_sids(&sid_everyone, &ace->sid) ||
- !compare_sids(&sid_authusers, &ace->sid))
+ (authusers &&
+ !compare_sids(&sid_authusers, &ace->sid)))
others_ace = ace;
+ if (!compare_sids(&sid_authusers, &ace->sid))
+ au_ace = true;
ace = (struct smb_ace *)((char *)ace + le16_to_cpu(ace->size));
}
if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) {
posix_acls = get_inode_acl(d_inode(path->dentry), ACL_TYPE_ACCESS);
- if (!IS_ERR_OR_NULL(posix_acls) && !found && !others_ace) {
+ /*
+ * An Authenticated Users ACE keeps the POSIX ACL from deciding,
+ * also for sessions that it does not match.
+ */
+ if (!IS_ERR_OR_NULL(posix_acls) && !found && !others_ace &&
+ !au_ace) {
unsigned int id = -1;
pa_entry = posix_acls->a_entries;
@@ -1752,7 +1786,7 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
}
}
- if (!maximal) {
+ if (!maximal && obj_deny) {
switch (ace->type) {
case ACCESS_ALLOWED_ACE_TYPE:
access_bits = le32_to_cpu(ace->access_req);
diff --git a/fs/smb/server/smbacl.h b/fs/smb/server/smbacl.h
index 3342cebab333..bbd35948a379 100644
--- a/fs/smb/server/smbacl.h
+++ b/fs/smb/server/smbacl.h
@@ -97,7 +97,7 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, const struct path *path,
unsigned int uid, unsigned int gid);
int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
__le32 *pdaccess, __le32 raw_daccess, int uid,
- bool strict);
+ bool authenticated, bool strict);
int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon,
const struct path *path, struct smb_ntsd *pntsd, int ntsd_len,
bool type_check, bool get_write, bool posix_open,
diff --git a/fs/smb/server/tests/smbacl_kunit.c b/fs/smb/server/tests/smbacl_kunit.c
index 33496b4d31a3..bf28439a7696 100644
--- a/fs/smb/server/tests/smbacl_kunit.c
+++ b/fs/smb/server/tests/smbacl_kunit.c
@@ -229,7 +229,7 @@ static void ksmbd_smb_check_perm_dacl_boundary_test(struct kunit *test)
goto out;
rc = smb_check_perm_dacl(NULL, &file->f_path, &daccess,
- cpu_to_le32(FILE_READ_DATA), 0, false);
+ cpu_to_le32(FILE_READ_DATA), 0, true, false);
/*
* The post-boundary ACE (ACE #2, beyond pdacl->size) grants
@@ -271,7 +271,7 @@ ksmbd_smb_check_perm_dacl_maximal_boundary_test(struct kunit *test)
goto out;
rc = smb_check_perm_dacl(NULL, &file->f_path, &daccess,
- FILE_MAXIMAL_ACCESS_LE, 0, false);
+ FILE_MAXIMAL_ACCESS_LE, 0, true, false);
KUNIT_EXPECT_EQ(test, 0, rc);
if (rc)
goto out;
--
2.47.3
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH v3 2/2] ksmbd: let the parent's DACL grant DELETE and FILE_READ_ATTRIBUTES
2026-11-08 18:20 [PATCH v3 0/2] ksmbd: fix explicit DACL checks and parent-derived rights Ian Bridges
2026-11-08 18:20 ` [PATCH v3 1/2] ksmbd: evaluate the DACL in order for explicit access requests Ian Bridges
@ 2026-11-08 18:20 ` Ian Bridges
1 sibling, 0 replies; 3+ messages in thread
From: Ian Bridges @ 2026-11-08 18:20 UTC (permalink / raw)
To: linkinjeon
Cc: senozhatsky, tom, chenxiaosong, linux-cifs, linux-kernel,
Ian Bridges, stable
FILE_DELETE_CHILD on a directory can grant DELETE on its children.
FILE_LIST_DIRECTORY can similarly grant FILE_READ_ATTRIBUTES. Because
ksmbd checks only the child's DACL, it can refuse rename, deletion and
attribute opens that the parent permits.
When the child does not grant an explicitly requested DELETE or
FILE_READ_ATTRIBUTES, check the parent for FILE_DELETE_CHILD or
FILE_LIST_DIRECTORY. Use exact SID matching, evaluate group allows and
denies, and exclude guest and anonymous sessions from Authenticated
Users. Fail closed on non-inherit-only object deny ACEs, missing or
unreadable parent DACLs and the mount root.
For the strict parent check, let applicable group and OWNER RIGHTS ACEs
decide before the POSIX ACL fallback. Otherwise a POSIX ACL entry can
hide a FILE_DELETE_CHILD grant.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: Ian Bridges <icb@fastmail.org>
---
Notes:
Parent-derived rights apply only when the request names DELETE or
FILE_READ_ATTRIBUTES. Plain MAXIMUM_ALLOWED requests and
maximal-access replies remain unchanged. Deriving DELETE there can
make an existing open fail when POSIX denies write access to the
parent.
An open that requests both DELETE and a maximal-access reply can
still fail when the child DACL grants nothing. DELETE also continues
to require POSIX read access to the child.
Other permission checks retain the existing POSIX ACL precedence
over group and OWNER RIGHTS ACEs.
fs/smb/server/smbacl.c | 99 ++++++++++++++++++++++++++++++++++--------
1 file changed, 81 insertions(+), 18 deletions(-)
diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index 50a03101cd8a..1b387c262d59 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -1494,6 +1494,11 @@ static bool smb_sid_is_owner_rights(const struct smb_sid *sid)
!compare_sids(sid, &sid_owner_rights);
}
+static unsigned int smb_parent_derived_rights(struct ksmbd_conn *conn,
+ const struct path *path, int uid,
+ bool authenticated,
+ unsigned int want);
+
int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
__le32 *pdaccess, __le32 raw_daccess, int uid,
bool authenticated, bool strict)
@@ -1514,16 +1519,19 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
unsigned int grp_allowed = 0, grp_denied = 0, bits;
struct smb_ace *others_ace = NULL;
bool or_ace = false, obj_deny = false, au_ace = false, member, counted;
+ bool grp_ace = false;
struct posix_acl_entry *pa_entry;
unsigned int sid_type = SIDOWNER;
unsigned short ace_size;
bool is_owner, owner_rights = false;
bool maximal = *pdaccess & FILE_MAXIMAL_ACCESS_LE;
/*
- * MAXIMUM_ALLOWED requests match every session against
- * Authenticated Users.
+ * MAXIMUM_ALLOWED requests that are not strict match every session
+ * against Authenticated Users and do not count ACEs for the
+ * caller's groups. Strict ones match SIDs as explicit requests do.
*/
- bool authusers = authenticated || maximal;
+ bool open_max = maximal && !strict;
+ bool authusers = authenticated || open_max;
vfsuid_t vfsuid;
ksmbd_debug(SMB, "check permission using windows acl\n");
@@ -1557,13 +1565,16 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
/*
* An empty (present, zero-ACE) DACL grants no access to
* anyone except the object owner's implicit READ_CONTROL
- * and WRITE_DAC (MS-DTYP 2.4.5). Deny every other caller,
- * deny the owner any access beyond those two bits, and do
- * not let trailing bytes after a zero-ACE DACL become an
- * implicit grant.
+ * and WRITE_DAC (MS-DTYP 2.5.3.2), besides what the parent
+ * grants. Deny every other right, and do not let trailing
+ * bytes after a zero-ACE DACL become an implicit grant.
*/
if (is_owner)
allowed = READ_CONTROL | WRITE_DAC;
+ if (!strict)
+ allowed |= smb_parent_derived_rights(conn, path, uid,
+ authenticated,
+ requested & ~allowed);
if (maximal)
requested |= allowed;
if (!allowed || requested & ~allowed)
@@ -1576,9 +1587,10 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
/*
* Evaluate the DACL in order (MS-DTYP 2.5.3.2). access_bits collects
* the result for the ACEs that apply to the caller, without its groups
- * for MAXIMUM_ALLOWED. grp_granted collects what ACEs for the caller's
- * groups, or OWNER RIGHTS for the owner, grant. It is used when the
- * SID lookup and POSIX ACL fallback below do not decide.
+ * for a MAXIMUM_ALLOWED request that is not strict. grp_granted
+ * collects what ACEs for the caller's groups, or OWNER RIGHTS for the
+ * owner, grant. It is used when the SID lookup and POSIX ACL fallback
+ * below do not decide.
*/
ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl));
aces_size = pdacl_size - sizeof(struct smb_acl);
@@ -1623,8 +1635,8 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
compare_sids(&sid_owner_rights, &ace->sid) &&
!member))
goto next_ace;
- /* An explicit request counts only SIDs that match exactly */
- if (!maximal && !member &&
+ /* Other requests count only SIDs that match exactly */
+ if (!open_max && !member &&
!smb_sid_equal(&sid, &ace->sid) &&
!smb_sid_equal(&sid_everyone, &ace->sid) &&
!(authusers && smb_sid_equal(&sid_authusers, &ace->sid)) &&
@@ -1634,10 +1646,11 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
bits = le32_to_cpu(ace->access_req);
switch (ace->type) {
case ACCESS_ALLOWED_ACE_TYPE:
+ grp_ace |= counted;
if (counted)
grp_allowed |= bits;
- /* MAXIMUM_ALLOWED takes no group grants */
- if (maximal && member)
+ /* An open's MAXIMUM_ALLOWED takes no group grants */
+ if (open_max && member)
break;
if (counted)
grp_granted |= bits;
@@ -1645,10 +1658,11 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
break;
case ACCESS_DENIED_ACE_TYPE:
case ACCESS_DENIED_CALLBACK_ACE_TYPE:
+ grp_ace |= counted;
if (counted)
grp_denied |= ~grp_allowed & bits;
- /* MAXIMUM_ALLOWED takes no group denials either */
- if (!(maximal && member))
+ /* nor group denials */
+ if (!(open_max && member))
denied |= ~access_bits & bits;
break;
}
@@ -1663,6 +1677,9 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
access_bits |= READ_CONTROL | WRITE_DAC |
FILE_READ_ATTRIBUTES | DELETE;
access_bits &= ~denied;
+ /* An object deny ACE could deny the parent's rights */
+ if (!open_max && obj_deny)
+ access_bits = 0;
if ((raw_daccess & FILE_GENERIC_EXECUTE_LE) &&
S_ISREG(d_inode(path->dentry)->i_mode) &&
(access_bits & GENERIC_READ_FLAGS) == GENERIC_READ_FLAGS)
@@ -1719,10 +1736,13 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
posix_acls = get_inode_acl(d_inode(path->dentry), ACL_TYPE_ACCESS);
/*
* An Authenticated Users ACE keeps the POSIX ACL from deciding,
- * also for sessions that it does not match.
+ * also for sessions that it does not match. For a strict
+ * MAXIMUM_ALLOWED request, ACEs for the caller's groups or
+ * OWNER RIGHTS decide before the POSIX ACL, unless the DACL has
+ * an object deny ACE, which ksmbd does not parse.
*/
if (!IS_ERR_OR_NULL(posix_acls) && !found && !others_ace &&
- !au_ace) {
+ !au_ace && !(strict && maximal && grp_ace && !obj_deny)) {
unsigned int id = -1;
pa_entry = posix_acls->a_entries;
@@ -1774,6 +1794,10 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
*/
if (!obj_deny)
allowed |= grp_granted;
+ if (!strict)
+ allowed |= smb_parent_derived_rights(conn, path, uid,
+ authenticated,
+ requested & ~allowed);
if (maximal)
requested |= allowed;
if (!allowed || requested & ~allowed) {
@@ -1820,6 +1844,45 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
}
EXPORT_SYMBOL_IF_KUNIT(smb_check_perm_dacl);
+/*
+ * Return the rights in @want that @path gets from its parent directory:
+ * DELETE if the parent's DACL grants FILE_DELETE_CHILD, and
+ * FILE_READ_ATTRIBUTES if it grants FILE_LIST_DIRECTORY
+ * (MS-FSA 2.1.5.1.2.1). A parent with no DACL, or with one that ksmbd
+ * cannot read, gives nothing. Callers pass only rights that the request
+ * names.
+ */
+static unsigned int smb_parent_derived_rights(struct ksmbd_conn *conn,
+ const struct path *path, int uid,
+ bool authenticated,
+ unsigned int want)
+{
+ struct path parent = { .mnt = path->mnt };
+ __le32 granted = FILE_MAXIMAL_ACCESS_LE;
+ unsigned int rights = 0;
+ int rc;
+
+ if (!(want & (DELETE | FILE_READ_ATTRIBUTES)))
+ return 0;
+
+ /* The root of the mount, or a disconnected dentry, has no parent */
+ if (path->dentry == path->mnt->mnt_root || IS_ROOT(path->dentry))
+ return 0;
+
+ parent.dentry = dget_parent(path->dentry);
+ /* Strict, so the parent's own parent is not consulted */
+ rc = smb_check_perm_dacl(conn, &parent, &granted, 0, uid,
+ authenticated, true);
+ dput(parent.dentry);
+ if (rc || granted == FILE_MAXIMAL_ACCESS_LE)
+ return 0;
+ if (granted & FILE_DELETE_CHILD_LE)
+ rights |= DELETE;
+ if (granted & FILE_LIST_DIRECTORY_LE)
+ rights |= FILE_READ_ATTRIBUTES;
+ return rights & want;
+}
+
int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon,
const struct path *path, struct smb_ntsd *pntsd, int ntsd_len,
bool type_check, bool get_write, bool posix_open,
--
2.47.3
^ permalink raw reply [flat|nested] 3+ messages in thread