ksmbd: preserve VFS inherited POSIX ACL mask

The VFS initializes a child's POSIX ACL from the parent's default ACL and
the requested creation mode. Do not mutate the parent ACL or overwrite the
child's VFS-computed access and default ACLs afterwards.

This preserves restrictive ACL_MASK entries and prevents SMB object creation
from widening effective permissions.

Reported-by: Charles Vosburgh <trilobyte777@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index d0a0ad15d80376af75582497d24fc441eeb01725..d324585c0566bda47147ec92a1fceca648f2ba2f 100644 (file)
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -1886,10 +1886,6 @@ int ksmbd_vfs_inherit_posix_acl(struct mnt_idmap *idmap,
                                const struct path *path, struct inode *parent_inode)
 {
        struct posix_acl *acls;
-       struct posix_acl_entry *pace;
-       struct dentry *dentry = path->dentry;
-       struct inode *inode = d_inode(dentry);
-       int rc, i;
 
        if (!IS_ENABLED(CONFIG_FS_POSIX_ACL))
                return -EOPNOTSUPP;
@@ -1897,29 +1893,9 @@ int ksmbd_vfs_inherit_posix_acl(struct mnt_idmap *idmap,
        acls = get_inode_acl(parent_inode, ACL_TYPE_DEFAULT);
        if (IS_ERR_OR_NULL(acls))
                return -ENOENT;
-       pace = acls->a_entries;
-
-       for (i = 0; i < acls->a_count; i++, pace++) {
-               if (pace->e_tag == ACL_MASK) {
-                       pace->e_perm = 0x07;
-                       break;
-               }
-       }
-
-       rc = set_posix_acl(idmap, dentry, ACL_TYPE_ACCESS, acls);
-       if (rc < 0)
-               ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_ACCESS) failed, rc : %d\n",
-                           rc);
-       if (S_ISDIR(inode->i_mode)) {
-               rc = set_posix_acl(idmap, dentry, ACL_TYPE_DEFAULT,
-                                  acls);
-               if (rc < 0)
-                       ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_DEFAULT) failed, rc : %d\n",
-                                   rc);
-       }
 
        posix_acl_release(acls);
-       return rc;
+       return 0;
 }
 
 void ksmbd_vfs_update_compressed_fattr(struct dentry *dentry, __le32 *fattr)