Re: [PATCH v2 1/2] ksmbd: evaluate the DACL in order for explicit access requests

[Namjae Jeon]

> @@ -1680,7 +1706,8 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
>                     !(ace->flags & INHERIT_ONLY_ACE))
>                         or_ace = true;
>                 if (!compare_sids(&sid_everyone, &ace->sid) ||
> -                   !compare_sids(&sid_authusers, &ace->sid))
> +                   (authusers &&
> +                    !compare_sids(&sid_authusers, &ace->sid)))
>                         others_ace = ace;
For a guest session, this can leave both found and others_ace clear,
allowing the POSIX ACL fallback to overwrite the ordered DACL result.
For example, consider a file whose DACL grants only FILE_READ_DATA to
Authenticated Users, with a named POSIX ACL entry granting rw to the
guest UID. An explicit FILE_WRITE_DATA check returns -EACCES on the
base tree, but succeeds after this patch. A preceding deny ACE for one
of the guest's groups can also be bypassed through this path.
Please retain the fact that an Authenticated Users ACE was present
when deciding whether to use the POSIX ACL fallback, while excluding
that ACE from the rights granted to the guest. This also affects
anonymous sessions and remains after applying patch 2/2.

Thanks.