Re: [RFC PATCH 0/6] ksmbd: Windows SIDs for user and group ids

[Namjae Jeon]

On Wed, Oct 28, 2026 at 3:20 PM Jan Koester <jan.koester@xxxxxxxxx> wrote:
>
> Hi,
Hi Jan,
>
> Windows names owners and ACL entries by SID; for a domain account that
> is its objectSid. ksmbd shows a file's owner, group and POSIX ACL
> entries as S-1-22 SIDs or as its server domain SID + uid, which a
> Windows client can't relate to the domain's accounts, and a SID a client
> sets for a domain account doesn't map back to an id at all. This series
> lets user space, which knows the directory, translate between ids and
> SIDs in both directions, for accounts that are logged in or not.
>
> It applies on top of the UUID/GUID id RFC (uid_r v2,
How is the uid_r RFC going? This series is based on it, so I would
like to know its current status and what you plan to do next with it.

> The user space side is sharedd (FenrirOS' ksmbd user space) with
> adconnect for the directory lookups. Tested in a VM against a directory
> server: owner and group of accounts that aren't logged in, ownership and
> group changes, DACL round trips, a session getting access only through
> a nested group, inherited CREATOR OWNER ACEs, and the directory going
> away (cached mappings stay, new ones fail cleanly).
>
> Questions:
> - Is a netlink round trip per uncached id acceptable here, or would you
>   rather have user space push the mappings of a session's ids at login
>   only? The latter can't cover owners that aren't logged in.
On-demand lookup on a cache miss looks right to me. ksmbd kernel
should cache the results as proposed and query userspace again only
when an entry expires or is not cached. Loading all mappings up front
does not scale well and is difficult to keep current.

> - compare_sids() matches a SID against any prefix of it; the token uses
>   an exact comparison. Should the existing callers move to that too?
Please don't change the existing callers. Some of them rely on prefix
matching on purpose. If exact comparison is needed, add an exact-match
helper and convert only the relevant callers.

Thanks.