Re: [SECURITY] ksmbd: SMB CREATE widens inherited POSIX ACL masks
Namjae Jeon <[email protected]> Fri, 17 Jul 2026 12:14:51 +0900
| Newsgroups | org.kernel.vger.linux-cifs |
|---|---|
| Message-ID | <CAKYAXd-4MuqT49GwTO2meR0Lt338vTygzTrQ+6xBNpVW7kE0Xg@mail.gmail.com> |
On Fri, Jul 17, 2026 at 6:58 AM Charles Research <[email protected]> wrote: > > Hello KSMBD maintainers, Hi Charles, > > KSMBD widens an inherited POSIX ACL mask to rwx when an SMB client creates a file or directory. A named user or group entry that an administrator intentionally made ineffective with a restrictive mask can therefore become effective on the new object. For a new directory, KSMBD also installs the widened ACL as the default ACL, so the exposure propagates to descendants. Can you confirm if this patch fixes this issue? Thanks for the report.
0001-ksmbd-preserve-VFS-inherited-POSIX-ACL-mask.patch
(text/x-patch, 2.1 KB)
From 7fc6a727c66587b826bbdcbac9d71beef5417161 Mon Sep 17 00:00:00 2001 From: Namjae Jeon <[email protected]> Date: Fri, 17 Jul 2026 11:06:45 +0900 Subject: [PATCH 1/3] ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and default ACLs afterwards. This preserves restrictive ACL_MASK entries and prevents SMB object creation from widening effective permissions. Reported-by: Charles Research <[email protected]> Signed-off-by: Namjae Jeon <[email protected]> --- fs/smb/server/vfs.c | 26 +------------------------- 1 file changed, 1 insertion(+), 25 deletions(-) diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c index dbaa83887775..854a09020a97 100644 --- a/fs/smb/server/vfs.c +++ b/fs/smb/server/vfs.c @@ -2150,10 +2150,6 @@ int ksmbd_vfs_inherit_posix_acl(struct mnt_idmap *idmap, const struct path *path, struct inode *parent_inode) { struct posix_acl *acls; - struct posix_acl_entry *pace; - struct dentry *dentry = path->dentry; - struct inode *inode = d_inode(dentry); - int rc, i; if (!IS_ENABLED(CONFIG_FS_POSIX_ACL)) return -EOPNOTSUPP; @@ -2161,29 +2157,9 @@ int ksmbd_vfs_inherit_posix_acl(struct mnt_idmap *idmap, acls = get_inode_acl(parent_inode, ACL_TYPE_DEFAULT); if (IS_ERR_OR_NULL(acls)) return -ENOENT; - pace = acls->a_entries; - - for (i = 0; i < acls->a_count; i++, pace++) { - if (pace->e_tag == ACL_MASK) { - pace->e_perm = 0x07; - break; - } - } - - rc = set_posix_acl(idmap, dentry, ACL_TYPE_ACCESS, acls); - if (rc < 0) - ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_ACCESS) failed, rc : %d\n", - rc); - if (S_ISDIR(inode->i_mode)) { - rc = set_posix_acl(idmap, dentry, ACL_TYPE_DEFAULT, - acls); - if (rc < 0) - ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_DEFAULT) failed, rc : %d\n", - rc); - } posix_acl_release(acls); - return rc; + return 0; } void ksmbd_vfs_update_compressed_fattr(struct dentry *dentry, __le32 *fattr) -- 2.25.1