Re: [PATCH v3 0/2] ksmbd: fix explicit DACL checks and parent-derived rights

[Namjae Jeon]

On Mon, Nov 9, 2026 at 3:20 AM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> smb_check_perm_dacl() mishandles explicit access requests. It can turn a
> deny ACE into a grant, ignore earlier deny ACEs, and treat guest and
> anonymous sessions as Authenticated Users. This can grant read or write
> access that the stored DACL does not grant.
>
> The function also ignores rights granted by the parent directory.
> FILE_DELETE_CHILD can grant DELETE on a child, and FILE_LIST_DIRECTORY
> can grant FILE_READ_ATTRIBUTES.
>
> Patch 1 evaluates explicit requests in DACL order and excludes guest and
> anonymous sessions from Authenticated Users. Patch 2 obtains explicitly
> requested DELETE and FILE_READ_ATTRIBUTES rights from the parent DACL.
>
> Patch 2 uses the authentication state added by patch 1. It also restores
> parent-derived rights that patch 1 can remove from guests. Backport the
> patches in order.
>
> Older stable trees first need commit cc2f133e80eb ("ksmbd: fix maximum
> allowed access checks") and the preceding DACL fixes through "ksmbd:
> grant a caller what its groups and OWNER RIGHTS ACEs allow".
>
> Changes since v2:
> - Patch 1: keep the POSIX ACL fallback from replacing the DACL result
>   when an Authenticated Users ACE is present, including for guest and
>   anonymous sessions. Namjae found that the fallback could otherwise
>   grant access denied by the DACL.
> - Rebase onto the current ksmbd-for-next.
>
> Changes since v1:
> - Patch 2: let group and OWNER RIGHTS ACEs decide the strict parent
>   check before the POSIX ACL fallback. Sashiko's review of v1 found that
>   a POSIX ACL entry could otherwise hide a FILE_DELETE_CHILD grant.
> - Patch 2: add a comment on which MAXIMUM_ALLOWED requests omit group
>   ACEs.
>
> v1: https://lore.kernel.org/linux-cifs/20261107062233.1579198-1-icb@xxxxxxxxxxxx/
> v2: https://lore.kernel.org/linux-cifs/20261107231941.1824289-1-icb@xxxxxxxxxxxx/
>
> Both patches were tested with KASAN on ksmbd-for-next 6f42553e493d.
> Its fs/smb/server tree is identical to current head 2f14fe2d5895.
> smbtorture results are unchanged.
>
> This series was developed with LLM assistance.
>
> Ian Bridges (2):
>   ksmbd: evaluate the DACL in order for explicit access requests
>   ksmbd: let the parent's DACL grant DELETE and FILE_READ_ATTRIBUTES
Applied them to #ksmbd-for-next.
Thanks!