Re: [RFC PATCH 4/6] ksmbd: map user and group ids to Windows SIDs through user space

[Ian Bridges <icb@fastmail.org>]

Hi Jan,

On Tue, Nov 10, 2026 at 09:02:46AM +0000, Jan Koester wrote:
> + * one) and ksmbd's. Built at login; a
> + * mapping user space couldn't give then is missing for the session (its
> + * ACL entries don't match: access is denied, not granted).
[...]
> +	sids = kcalloc(max, sizeof(*sids), KSMBD_DEFAULT_GFP);
> +	if (!sids)
> +		return;
> +	if (!mapped_uid_sid(user->kuid, &sids[n]))
> +		n++;

If user space cannot answer at login (-EAGAIN), ksmbd_user_set_token()
seems to leave that domain SID out of the token. It builds no token at
all when the allocation fails. The comment says access is then denied.
That holds for an allow ACE on that SID, but wouldn't a deny ACE on it
stop applying? Take a DACL with a deny of WRITE_DATA for a mapped
group, followed by an allow of full access for Everyone. Would a member
whose group SID is missing get write access through the Everyone entry
for the whole session? Could -EAGAIN and allocation failures be
returned from the token build so the login fails, while -ENOENT, for an
account with no mapping, stays as it is?

Thanks,
Ian