[RFC PATCH 2/6] ksmbd: keep named ACL entries effective when a DACL sets a POSIX ACL

[RFC PATCH 2/6] ksmbd: keep named ACL entries effective when a DACL sets a POSIX ACL

[Jan Koester]

parse_dacl() turns ACEs for other users into named POSIX ACL entries
with an rwx mask, but leaves the group bits of fattr->cf_mode as the
owning group's ACE made them. set_info_sec() sets the ACL first and
then the mode, and on an inode with an extended ACL the mode's group
bits are the mask: a DACL without an ACE for the owning group (as
Windows writes them) left the mask at --- and every named entry
without effect.

Put the mask into the mode's group bits when there are named entries.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Jan Koester <jan.koester@tuxist.de>
---
 fs/smb/server/smbacl.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index d1cf63a9fe..b3daf65798 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -680,6 +680,12 @@ static int parse_dacl(struct mnt_idmap *idmap,
 
 	if (acl_state.users->n || acl_state.groups->n) {
 		acl_state.mask.allow = 0x07;
+		/*
+		 * With named entries the mode's group bits are the ACL's mask:
+		 * the chmod after setting the ACL mustn't mask them all off.
+		 */
+		fattr->cf_mode = (fattr->cf_mode & ~0070) |
+				 (acl_state.mask.allow << 3);
 
 		if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) {
 			fattr->cf_acls =
-- 
2.56.0

Re: [RFC PATCH 2/6] ksmbd: keep named ACL entries effective when a DACL sets a POSIX ACL

[Ian Bridges]

Hi Jan,

On Tue, Nov 10, 2026 at 09:02:33AM +0000, Jan Koester wrote:
> +		fattr->cf_mode = (fattr->cf_mode & ~0070) |
> +				 (acl_state.mask.allow << 3);

set_info_sec() seems to only log a failed set_posix_acl() and carry
on, after ksmbd_vfs_remove_acl_xattrs() has removed the old ACL. With
this change, would the chmod that follows then set the group bits to
rwx on a file that has no ACL left, giving the owning group rwx in the
file system?

Could the mode be set first, with the owning group's permissions in
cf_mode rather than the mask? A successful set_posix_acl() would then
set the group bits from the mask entry. Should a failed
set_posix_acl() also be returned rather than only logged?

Thanks,
Ian

[RFC PATCH 2/6] ksmbd: keep named ACL entries effective when a DACL sets a POSIX ACL

[Jan Koester]

parse_dacl() turns ACEs for other users into named POSIX ACL entries
with an rwx mask, but leaves the group bits of fattr->cf_mode as the
owning group's ACE made them. set_info_sec() sets the ACL first and
then the mode, and on an inode with an extended ACL the mode's group
bits are the mask: a DACL without an ACE for the owning group (as
Windows writes them) left the mask at --- and every named entry
without effect.

Put the mask into the mode's group bits when there are named entries.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Jan Koester <jan.koester@tuxist.de>
---
 fs/smb/server/smbacl.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index d1cf63a9fe..b3daf65798 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -680,6 +680,12 @@ static int parse_dacl(struct mnt_idmap *idmap,
 
 	if (acl_state.users->n || acl_state.groups->n) {
 		acl_state.mask.allow = 0x07;
+		/*
+		 * With named entries the mode's group bits are the ACL's mask:
+		 * the chmod after setting the ACL mustn't mask them all off.
+		 */
+		fattr->cf_mode = (fattr->cf_mode & ~0070) |
+				 (acl_state.mask.allow << 3);
 
 		if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) {
 			fattr->cf_acls =
-- 
2.56.0