[RFC PATCH 2/6] ksmbd: keep named ACL entries effective when a DACL sets a POSIX ACL

[Jan Koester]

parse_dacl() turns ACEs for other users into named POSIX ACL entries
with an rwx mask, but leaves the group bits of fattr->cf_mode as the
owning group's ACE made them. set_info_sec() sets the ACL first and
then the mode, and on an inode with an extended ACL the mode's group
bits are the mask: a DACL without an ACE for the owning group (as
Windows writes them) left the mask at --- and every named entry
without effect.

Put the mask into the mode's group bits when there are named entries.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Jan Koester <jan.koester@xxxxxxxxx>
---
 fs/smb/server/smbacl.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index d1cf63a9fe..b3daf65798 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -680,6 +680,12 @@ static int parse_dacl(struct mnt_idmap *idmap,
 
 	if (acl_state.users->n || acl_state.groups->n) {
 		acl_state.mask.allow = 0x07;
+		/*
+		 * With named entries the mode's group bits are the ACL's mask:
+		 * the chmod after setting the ACL mustn't mask them all off.
+		 */
+		fattr->cf_mode = (fattr->cf_mode & ~0070) |
+				 (acl_state.mask.allow << 3);
 
 		if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) {
 			fattr->cf_acls =
-- 
2.56.0