From: Volker Lendecke <vl@samba.org>
Date: Fri, 29 May 2026 15:11:49 +0000 (+0200)
Subject: ndr/security: Fix up SACLs broken by Samba before 4.18
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bb59106e4412e9aa3bc1caa8d9b21316b2ffdd5c;p=thirdparty%2Fsamba.git

ndr/security: Fix up SACLs broken by Samba before 4.18

The information of the claims is lost, make smbd at least read the
full acl properly, synthesize an empty claims struct

Bug: https://bugzilla.samba.org/show_bug.cgi?id=16096
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---

diff --git a/librpc/ndr/ndr_sec_helper.c b/librpc/ndr/ndr_sec_helper.c
index 55e373cfdac..0ab83773a41 100644
--- a/librpc/ndr/ndr_sec_helper.c
+++ b/librpc/ndr/ndr_sec_helper.c
@@ -113,7 +113,36 @@ _PUBLIC_ enum ndr_err_code ndr_pull_security_ace(struct ndr_pull *ndr, ndr_flags
 		NDR_CHECK(ndr_maybe_pull_security_ace_object_ctr(ndr, NDR_SCALARS, r));
 		NDR_CHECK(ndr_pull_dom_sid(ndr, NDR_SCALARS, &r->trustee));
 		sub_size = ndr_subcontext_size_of_ace_coda(r, r->size, ndr->flags);
-		if (sub_size == 0 && !sec_ace_has_extra_blob(r->type)) {
+		if ((sub_size == 0) &&
+		    (r->type == SEC_ACE_TYPE_SYSTEM_RESOURCE_ATTRIBUTE)) {
+			/*
+			 * Samba < 4.19 dropped the
+			 * CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1
+			 * from SYSTEM_RESOURCE_ATTRIBUTE_ACEs
+			 * when storing on disk. We need to
+			 * fake a meaningless but valid struct
+			 * so that file servers with that
+			 * broken xattr will continue to
+			 * function.
+			 */
+
+			r->coda.claim = (struct
+					 CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1){
+				.name = talloc_strdup(ndr->current_mem_ctx,
+						      ""),
+				.value_type =
+					CLAIM_SECURITY_ATTRIBUTE_TYPE_UINT64,
+			};
+			if (r->coda.claim.name == NULL) {
+				return ndr_pull_error(
+					ndr,
+					NDR_ERR_ALLOC,
+					"out of memory synthesising "
+					"empty claim for zero-coda "
+					"SYSTEM_RESOURCE_ATTRIBUTE_"
+					"ACE");
+			}
+		} else if ((sub_size == 0) && !sec_ace_has_extra_blob(r->type)) {
 			r->coda.ignored.data = NULL;
 			r->coda.ignored.length = 0;
 		} else {
diff --git a/selftest/knownfail.d/ntacl_broken_418 b/selftest/knownfail.d/ntacl_broken_418
deleted file mode 100644
index a1d4ae5dab6..00000000000
--- a/selftest/knownfail.d/ntacl_broken_418
+++ /dev/null
@@ -1 +0,0 @@
-^samba.tests.ntacl_resource_attr_ace.samba.tests.ntacl_resource_attr_ace.NtaclCheckBrokenXattr.test_broken_4_18_sd*