Re: [PATCH 2/2] ksmbd: exclude guest and anonymous sessions from Authenticated Users ACEs

[Namjae Jeon]

> @@ -1611,7 +1612,8 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
>                         break;
>                 }
>                 if (!compare_sids(&sid_everyone, &ace->sid) ||
> -                   !compare_sids(&sid_authusers, &ace->sid))
> +                   (authenticated &&
> +                    !compare_sids(&sid_authusers, &ace->sid)))
>                         others_ace = ace;
Skipping this ACE for a guest can leave both found and others_ace
unset. The POSIX ACL fallback then runs. That code compares ACL_GROUP
gids with the caller's uid instead of checking group membership. For
example, consider a guest with uid 1000 who does not belong to group
1000. The file's DACL contains:

  DENY    Authenticated Users   READ_DATA
  ALLOW  S-1-22-2-1000            read access
  ALLOW  owner                         full access

With S-1-22-2-1000 also set as the descriptor's Group SID, DACL
conversion creates a POSIX group:1000:r-- entry. Before this patch,
ABE hides the file. After this patch, the fallback mistakes group 1000
for user 1000 and lists the file, although the guest still fails the
POSIX read permission check. Please also fix the fallback to check
actual group membership for ACL_GROUP entries. The UID/GID comparison
bug already exists, but this change exposes it for the DACL above.