[PATCH] ksmbd: grant a POSIX ACL group entry only to the group's members

[Ian Bridges]

When no ACE of the DACL matches the caller, Everyone or Authenticated
Users, smb_check_perm_dacl() falls back to the file's POSIX ACL. It
takes the first ACL_USER or ACL_GROUP entry whose id equals the
caller's uid. For ACL_GROUP, this compares a gid with the caller's uid.
A numerical match grants the group's permissions even when the caller
is not a member.

Match a group entry only when the caller is also in the group.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Reported-by: Namjae Jeon <linkinjeon@xxxxxxxxxx>
Closes: https://lore.kernel.org/linux-cifs/CAKYAXd93czbFD=znZUq_pJLXzDR5N3zc_auvAGWT7pzKR1f9Ag@xxxxxxxxxxxxxx/
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Ian Bridges <icb@xxxxxxxxxxxx>
---

Notes:
    Reachable on a share with "vfs objects = acl_xattr" when the fallback
    runs and the POSIX ACL has a group entry whose gid equals the caller's
    uid. Such entries come from setfacl or from ksmbd's own mapping of a
    DACL to POSIX. A guest account reaches it the same way on a share with
    "guest ok = yes".
    
    The fallback retains its existing id match and adds a group membership
    check.
    
    Tested on ksmbd-for-next d13da43938d1 with KASAN. Generated DACLs of one
    or two allow or deny ACEs were probed on files and directories as the
    owner, other users, group members, a guest and an anonymous session. In
    the tested cases, only the results of the guest account with the uid/gid
    collision change. It no longer gets the rights of the file's group,
    which it is not in. Its MAXIMUM_ALLOWED opens were granted with no
    access and are now refused, matching the maximal access reply.
    smbtorture gives the same results as on the base.
    
    A reproducer is available on request.
    
    This fix was developed with LLM assistance.

 fs/smb/server/smbacl.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index 664f01263611..d9ceeb84d8da 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -1625,7 +1625,10 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
 				else
 					continue;
 
-				if (id == uid) {
+				/* A group entry grants only to the group's members */
+				if (id == uid &&
+				    (pa_entry->e_tag == ACL_USER ||
+				     in_group_p(make_kgid(&init_user_ns, id)))) {
 					mode_to_access_flags(pa_entry->e_perm,
 							     0777,
 							     &access_bits);

base-commit: d13da43938d15b0b719827d8f2b32df8eaec5def
-- 
2.47.3