Re: [PATCH] ksmbd: keep group denials when a POSIX ACL entry decides access

[Namjae Jeon]

On Tue, Nov 10, 2026 at 11:33 AM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> When no ACE names the caller, Everyone or Authenticated Users,
> smb_check_perm_dacl() lets a POSIX ACL entry for the caller decide
> access. The entry's rights replace the result of the DACL walk. Deny
> ACEs for the caller's groups, and OWNER RIGHTS for the owner, are then
> lost.
>
> For example, a deny of FILE_WRITE_DATA for one of the caller's groups
> should refuse writes. A POSIX ACL entry that gives the caller write
> access still lets the caller write.
>
> Remove the requested rights that those ACEs deny from the entry's
> rights. The DACL walk already records them in grp_denied.
>
> Fixes: 42ac1f1917ae ("ksmbd: grant a caller what its groups and OWNER RIGHTS ACEs allow")
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Link: https://sashiko.dev/#/patchset/20261102200353.884509-1-icb%40fastmail.org
> Link: https://sashiko.dev/#/patchset/20261103150458.11591-1-icb%40fastmail.org
> Link: https://sashiko.dev/#/patchset/20261107062233.1579198-1-icb%40fastmail.org?part=1
> Link: https://sashiko.dev/#/patchset/20261107231941.1824289-1-icb%40fastmail.org?part=1
> Link: https://sashiko.dev/#/patchset/20261108182011.1888520-1-icb%40fastmail.org?part=1
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ian Bridges <icb@xxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!