Re: [PATCH 1/2] ksmbd: evaluate the DACL in order for requested access

[Namjae Jeon]

On Fri, Oct 30, 2026 at 11:05 AM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> On an acl_xattr share, smb_check_perm_dacl() evaluates the whole DACL in
> order only for a MAXIMUM_ALLOWED open. Any other open is checked against
> a single ACE, the first one whose SID matches the caller.
>
> If that ACE is a deny, the caller gets every right the deny does not
> name. For example, a deny for writing grants read. Later ACEs are never
> checked, and an inherit-only ACE counts as if it applied to the file.
>
> Evaluate the DACL in order (MS-DTYP 2.5.3.2) for every open, as the
> MAXIMUM_ALLOWED path already does. The extra rights that path gives the
> owner, and the execute right it adds, stay limited to MAXIMUM_ALLOWED.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ian Bridges <icb@xxxxxxxxxxxx>
Can you check Sashiko's review comments ?

https://sashiko.dev/#/patchset/20261030020523.302085-1-icb%40fastmail.org

Thanks!