Re: [PATCH] ksmbd: require DELETE access for delete-on-close opens

[Namjae Jeon]

On Thu, Oct 29, 2026 at 12:24 AM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> smb2_open() accepts FILE_DELETE_ON_CLOSE on an existing file without
> DELETE in DesiredAccess. When the request asks only for
> FILE_READ_ATTRIBUTES or READ_CONTROL, it also skips inode_permission()
> and the parent directory MAY_WRITE | MAY_EXEC check that delete-on-close
> is meant to get. The file is then marked for deletion by a caller who
> could not delete it.
>
> The unlink happens later, in __ksmbd_inode_close(), when the last handle
> on the inode is closed, and it runs with the credentials of that handle.
> If the caller closes last, the unlink fails. If another user who can
> write the parent directory, such as the file's owner, still has the file
> open, the file is deleted when that user closes it. Until then new opens
> of the file fail with STATUS_DELETE_PENDING. So a user with only search
> permission on a directory can delete a file in it, or block opens of it,
> while the owner has it open.
>
> A MAXIMUM_ALLOWED open that also requests DELETE has the same problem.
> The requested access is replaced with the maximal access, which does not
> include DELETE when the caller cannot write the parent directory, and the
> later permission checks are skipped as already done.
>
> MS-FSA 2.1.5.1 requires an open with FILE_DELETE_ON_CLOSE and without
> DELETE in DesiredAccess to fail with STATUS_INVALID_PARAMETER, and Samba
> does the same. Add that check to the CreateOptions validation, using
> the generic-mapped DesiredAccess so that GENERIC_ALL still qualifies.
> This also refuses MAXIMUM_ALLOWED with FILE_DELETE_ON_CLOSE but no
> explicit DELETE, as MS-FSA and Samba do. When MAXIMUM_ALLOWED is
> requested with DELETE but the maximal access does not include DELETE,
> fail with STATUS_ACCESS_DENIED. With DELETE requested, delete-on-close
> opens go through the existing parent directory check.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ian Bridges <icb@xxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!