Re: [PATCH] ksmbd: fix maximal access leak when object has no NT ACL

On Fri, Jul 17, 2026 at 4:15 PM Gaël Blivet-Bailly
<[email protected]> wrote:
>
> From: Gael Blivet <[email protected]>
>
> smb2_open()'s maximal-access handling sets maximal_access to the
> FILE_MAXIMAL_ACCESS_LE request sentinel, then calls
> smb_check_perm_dacl() to compute the real access mask from the
> object's DACL.
>
> smb_check_perm_dacl() returns success without touching *pdaccess when
> the object has no stored NT ACL xattr (ksmbd_vfs_get_sd_xattr() fails,
> taking an early goto err_out with rc still 0). This leaves
> maximal_access holding the raw FILE_MAXIMAL_ACCESS_LE sentinel instead
> of a real access mask.
>
> Observed live: a freshly-created share root shows macOS's "no entry"
> (prohibited-access) badge on connect, even though POSIX permissions
> clearly allow access -- macOS requests maximal access via the MxAc
> create context on every share-root open, not via DesiredAccess, so it
> trusts the leaked sentinel verbatim instead of falling through to the
> correct POSIX-based path.
>
> Fall back to ksmbd_vfs_query_maximal_access() -- the same POSIX-based
> computation already used for the DesiredAccess-requested-maximal-access
> case below -- whenever the sentinel comes back unmodified.
>
> Signed-off-by: Gael Blivet <[email protected]>
> Assisted-by: Claude:claude-sonnet-5
Applied it to #ksmbd-for-next-next.
Thanks!