cifs: Fake rwx permissions if we can not read the CIFS ACL

PATCH Applied Ronnie Sahlberg 2 participants 3 messages Oct 4, 2017 2 messages not in the archive

Subsystems (2)

SMB client (CIFS) Kernel SMB3 server (ksmbd)

lore

Share & tools

lore

Ronnie Sahlberg

author

2017-10-04 04:59 UTC #0 lore raw

PATCH 1/1 cifs: Fake rwx permissions if we can not read the CIFS ACL

If the cifsacl mount option is used and we try to list a directory that contains entries where we do not have READ_CONTROL access we will see errors such as "ls: cannot access '...': Permission denied"
and the directory listing will show files with funny attributes like
"-?????????? ? ? ? ? ? foo002.txt"

This patch fixes this by checking the error from reading the security descriptor and if it failed with EACCES we fake the attributes as all 0.

Signed-off-by Ronnie Sahlberg <[email protected]>

---
 fs/cifs/cifsacl.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

fs/cifs/cifsacl.c +9 -1

index b98436f5c7c7..11d0d135a9b7 100644
@@ -1155,7 +1155,15 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
 	/* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
 	if (IS_ERR(pntsd)) {
 		rc = PTR_ERR(pntsd);
-		cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc);
+		if (rc == -EACCES) {
+			/* If we do not have permission to read the ACL
+			   just clear all rwx permissions */
+			cifs_dbg(NOISY, "%s: EACCES reading ACL\n", __func__);
+			fattr->cf_mode &= ~(S_IRWXUGO);
+			rc = 0;
+		} else
+			cifs_dbg(VFS, "%s: error %d getting sec desc\n",
+				 __func__, rc);
 	} else {
 		rc = parse_sec_desc(cifs_sb, pntsd, acllen, fattr);
 		kfree(pntsd);

Signature · 1 line

2.13.3

A message that is not in the archive (sent off-list or not yet received): 20171004045953.28134-1-lsahlber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org

Steve French

Applied

2017-10-04 22:06 UTC #2 lore raw

merged into cifs-2.6.git for-next but notice minor nit about comments (always run checpatch before submitting)

WARNING: Block comments use * on subsequent lines
#85: FILE: fs/cifs/cifsacl.c:1160:
+ /* If we do not have permission to read the ACL
+ just clear all rwx permissions */

Quoted 39 lines · Ronnie Sahlberg

This patch fixes this by checking the error from reading the security descriptor and if it failed with EACCES we fake the attributes as all 0.

Signed-off-by Ronnie Sahlberg <[email protected]>

---
 fs/cifs/cifsacl.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

fs/cifs/cifsacl.c +9 -2

index b98436f5c7c7..11d0d135a9b7 100644
@@ -1155,7 +1155,15 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
        /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
        if (IS_ERR(pntsd)) {
                rc = PTR_ERR(pntsd);
-               cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc);
+               if (rc == -EACCES) {
+                       /* If we do not have permission to read the ACL
+                          just clear all rwx permissions */
+                       cifs_dbg(NOISY, "%s: EACCES reading ACL\n", __func__);
+                       fattr->cf_mode &= ~(S_IRWXUGO);
+                       rc = 0;
+               } else
+                       cifs_dbg(VFS, "%s: error %d getting sec desc\n",
+                                __func__, rc);
        } else {
                rc = parse_sec_desc(cifs_sb, pntsd, acllen, fattr);
                kfree(pntsd);
--

2.13.3

Signature · 3 lines

Thanks,

Steve

A message that is not in the archive (sent off-list or not yet received): CAH2r5muHtkLFHkrKdmto04E=LSLn3BXJ54h4uGnhip7E0Z-hzQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org

Steve French

2017-10-04 22:07 UTC #4 lore raw

and added cc:stable

Quoted 55 lines · Steve French

merged into cifs-2.6.git for-next but notice minor nit about comments (always run checpatch before submitting)
WARNING: Block comments use * on subsequent lines
#85: FILE: fs/cifs/cifsacl.c:1160:
fs/cifs/cifsacl.c +2 -0
+            /* If we do not have permission to read the ACL
+               just clear all rwx permissions */
Quoted 37 lines · Ronnie Sahlberg
If the cifsacl mount option is used and we try to list a directory that contains entries where we do not have READ_CONTROL access we will see errors such as "ls: cannot access '...': Permission denied"
and the directory listing will show files with funny attributes like
"-?????????? ? ? ? ? ? foo002.txt"
This patch fixes this by checking the error from reading the security descriptor and if it failed with EACCES we fake the attributes as all 0.
Signed-off-by Ronnie Sahlberg <[email protected]>
---
 fs/cifs/cifsacl.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)
fs/cifs/cifsacl.c +9 -2
index b98436f5c7c7..11d0d135a9b7 100644
@@ -1155,7 +1155,15 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
        /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
        if (IS_ERR(pntsd)) {
                rc = PTR_ERR(pntsd);
-               cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc);
+               if (rc == -EACCES) {
+                       /* If we do not have permission to read the ACL
+                          just clear all rwx permissions */
+                       cifs_dbg(NOISY, "%s: EACCES reading ACL\n", __func__);
+                       fattr->cf_mode &= ~(S_IRWXUGO);
+                       rc = 0;
+               } else
+                       cifs_dbg(VFS, "%s: error %d getting sec desc\n",
+                                __func__, rc);
        } else {
                rc = parse_sec_desc(cifs_sb, pntsd, acllen, fattr);
                kfree(pntsd);
--
Quoted 2 lines
2.13.3
--
Thanks,
Steve

Signature · 3 lines

Thanks,

Steve