Re: [PATCH] ksmbd: enforce the read-only share flag when creating a stream

[Namjae Jeon]

On Thu, Oct 29, 2026 at 10:25 AM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> When a share is read-only, smb2_open() rejects opens that would create
> or truncate a file. Creating a named stream on an existing file with
> streams_xattr sets neither O_CREAT nor O_TRUNC, so it passes this check,
> and smb2_set_stream_name_xattr() then creates the stream. On a Time
> Machine share, opening a missing AFP_AfpInfo stream also writes one. A
> user who can write a file at the filesystem level can therefore add
> streams to it through a read-only share.
>
> Do not create a stream or synthesize AFP_AfpInfo when the share is not
> writable. Existing streams still open normally, and a missing stream
> opened with FILE_OPEN still returns STATUS_OBJECT_NAME_NOT_FOUND.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Fixes: eaff8e924f60 ("ksmbd: synthesize empty AFP_AfpInfo xattr on first probe")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ian Bridges <icb@xxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!