Re: [PATCH 1/2] ksmbd: let the owner read and change the DACL when no ACE names it

[Namjae Jeon]

On Mon, Nov 2, 2026 at 3:16 PM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> smb_check_perm_dacl() refuses the owner when neither its DACL lookup nor
> the POSIX ACL fallback matches. The owner then cannot read or replace
> the DACL over SMB. MS-DTYP 2.5.3.2 grants the owner READ_CONTROL and
> WRITE_DAC unless an OWNER RIGHTS ACE applies.
>
> An empty DACL allows the owner's explicit requests for these rights but
> refuses MAXIMUM_ALLOWED. smb2_open() uses that check for the maximal
> access reply (MS-SMB2 3.3.5.9.5), so even a READ_CONTROL open fails when
> it asks for that reply.
>
> Grant the owner's implicit rights on both paths, for explicit requests
> and MAXIMUM_ALLOWED, unless an OWNER RIGHTS ACE applies.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ian Bridges <icb@xxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!