Re: [PATCH v2] ksmbd: enforce the DACL permission check on delete-on-close opens

[Namjae Jeon]

On Thu, Oct 29, 2026 at 11:05 PM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> smb2_open() skips the DACL check for delete-on-close opens of existing
> files. On an acl_xattr share, a caller who passes the POSIX checks can
> therefore delete a file even when its stored DACL grants no access. The
> handle can also get read or write access that the DACL denies.
>
> Add a dedicated DACL check for these opens. Evaluate the applicable ACEs
> in order (MS-DTYP 2.5.3.2). Allow the parent directory to grant DELETE
> and FILE_READ_ATTRIBUTES under MS-FSA 2.1.5.1.2.1. Use the DACL grants
> when resolving MAXIMUM_ALLOWED.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Signed-off-by: Ian Bridges <icb@xxxxxxxxxxxx>
Can you check Sashiko's review comments ?

https://sashiko.dev/#/patchset/20261029140535.260498-1-icb%40fastmail.org

Thanks.