Re: [PATCH 0/2] ksmbd: fix DACL evaluation for denies and guest sessions

[Namjae Jeon]

On Fri, Oct 30, 2026 at 11:05 AM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> On an acl_xattr share, smb_check_perm_dacl() has two evaluation errors.
> Patch 1 makes every open evaluate the DACL in order. Today a deny ACE
> that is the first one matching the caller grants every right it does not
> name. Patch 2 stops guest and anonymous sessions from matching
> Authenticated Users ACEs.
>
> The two patches belong together. Each one alone moves some guest results
> the wrong way through the other error. Patch 1 alone lets a guest gather
> rights from Authenticated Users ACEs as it walks the DACL. Patch 2 alone
> can leave an Everyone deny as the first ACE a guest matches, and that
> deny then grants every right it does not name.
>
> With both applied, every combination of one or two allow or deny ACEs
> for the caller, Everyone and Authenticated Users was tested, with
> READ_DATA, WRITE_DATA, WRITE_EA, APPEND_DATA or full access as the mask
> (930 DACLs). Each DACL also ended with an allow ACE giving the owner
> full access. The tests ran as an authenticated user, a guest and an
> anonymous session. Compared with the base, every result that changes
> agrees with ordered evaluation (MS-DTYP 2.5.3.2) and the definition of
> Authenticated Users (MS-DTYP 2.4.2.4), and no result that agreed
> changes.
>
> Both patches carry Cc stable and need to be backported in this order.
>
> Ian Bridges (2):
>   ksmbd: evaluate the DACL in order for requested access
>   ksmbd: exclude guest and anonymous sessions from Authenticated Users
>     ACEs
This patch conflicts with your "[PATCH v2] ksmbd: enforce the DACL
permission check on delete-on-close opens" patch when applied. Can you
check it?