Linux-CIFS Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH][SMB3] Fix modefromsid newly created files to allow more permission on server
@ 2020-01-17  2:28 Steve French
  2020-01-17  3:04 ` Ronnie Sahlberg
  0 siblings, 1 reply; 4+ messages in thread
From: Steve French @ 2020-01-17  2:28 UTC (permalink / raw)
  To: CIFS

[-- Attachment #1: Type: text/plain, Size: 680 bytes --]

    When mounting with "modefromsid" mount parm most servers will require
    that some default permissions are given to users in the ACL on newly
    created files, and for files created with the new 'sd context' -
when passing in
    an sd context on create, permissions are not inherited from the parent
    directory, so in addition to the ACE with the special SID (which contains
    the mode), we also must pass in an ACE allowing users to access the file
    (GENERIC_ALL for authenticated users seemed like a reasonable default,
    although later we could allow a mount option or config switch to make
    it GENERIC_ALL for EVERYONE special sid).




-- 
Thanks,

Steve

[-- Attachment #2: 0002-smb3-fix-default-permissions-on-new-files-when-mount.patch --]
[-- Type: text/x-patch, Size: 3966 bytes --]

From 5cc1624433deead76820bb1b65c393433355df89 Mon Sep 17 00:00:00 2001
From: Steve French <stfrench@microsoft.com>
Date: Thu, 16 Jan 2020 19:55:33 -0600
Subject: [PATCH 2/3] smb3: fix default permissions on new files when mounting
 with modefromsid

When mounting with "modefromsid" mount parm most servers will require
that some default permissions are given to users in the ACL on newly
created files, files created with the new 'sd context' - when passing in
an sd context on create, permissions are not inherited from the parent
directory, so in addition to the ACE with the special SID which contains
the mode, we also must pass in an ACE allowing users to access the file
(GENERIC_ALL for authenticated users seemed like a reasonable default,
although later we could allow a mount option or config switch to make
it GENERIC_ALL for EVERYONE special sid).

CC: Stable <stable@vger.kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
---
 fs/cifs/cifsacl.c   | 20 ++++++++++++++++++++
 fs/cifs/cifsproto.h |  1 +
 fs/cifs/smb2pdu.c   | 11 ++++++++---
 3 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 96ae72b556ac..fb41e51dd574 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -802,6 +802,26 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
 	return;
 }
 
+unsigned int setup_authusers_ACE(struct cifs_ace *pntace)
+{
+	int i;
+	unsigned int ace_size = 20;
+
+	pntace->type = ACCESS_ALLOWED_ACE_TYPE;
+	pntace->flags = 0x0;
+	pntace->access_req = cpu_to_le32(GENERIC_ALL);
+	pntace->sid.num_subauth = 1;
+	pntace->sid.revision = 1;
+	for (i = 0; i < NUM_AUTHS; i++)
+		pntace->sid.authority[i] =  sid_authusers.authority[i];
+
+	pntace->sid.sub_auth[0] =  sid_authusers.sub_auth[0];
+
+	/* size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth*4) */
+	pntace->size = cpu_to_le16(ace_size);
+	return ace_size;
+}
+
 /*
  * Fill in the special SID based on the mode. See
  * http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index f6f3cc90cd18..948bf3474db1 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -213,6 +213,7 @@ extern struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *,
 						const struct cifs_fid *, u32 *);
 extern int set_cifs_acl(struct cifs_ntsd *, __u32, struct inode *,
 				const char *, int);
+extern unsigned int setup_authusers_ACE(struct cifs_ace *pace);
 extern unsigned int setup_special_mode_ACE(struct cifs_ace *pace, __u64 nmode);
 
 extern void dequeue_mid(struct mid_q_entry *mid, bool malformed);
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index a23ca3d0dcd9..7083d79de4e4 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2199,13 +2199,14 @@ create_sd_buf(umode_t mode, unsigned int *len)
 	struct cifs_ace *pace;
 	unsigned int sdlen, acelen;
 
-	*len = roundup(sizeof(struct crt_sd_ctxt) + sizeof(struct cifs_ace), 8);
+	*len = roundup(sizeof(struct crt_sd_ctxt) + sizeof(struct cifs_ace) * 2,
+			8);
 	buf = kzalloc(*len, GFP_KERNEL);
 	if (buf == NULL)
 		return buf;
 
 	sdlen = sizeof(struct smb3_sd) + sizeof(struct smb3_acl) +
-		 sizeof(struct cifs_ace);
+		 (2 * sizeof(struct cifs_ace));
 
 	buf->ccontext.DataOffset = cpu_to_le16(offsetof
 					(struct crt_sd_ctxt, sd));
@@ -2232,8 +2233,12 @@ create_sd_buf(umode_t mode, unsigned int *len)
 	/* create one ACE to hold the mode embedded in reserved special SID */
 	pace = (struct cifs_ace *)(sizeof(struct crt_sd_ctxt) + (char *)buf);
 	acelen = setup_special_mode_ACE(pace, (__u64)mode);
+	/* and one more ACE to allow access for authenticated users */
+	pace = (struct cifs_ace *)(acelen + (sizeof(struct crt_sd_ctxt) +
+		(char *)buf));
+	acelen += setup_authusers_ACE(pace);
 	buf->acl.AclSize = cpu_to_le16(sizeof(struct cifs_acl) + acelen);
-	buf->acl.AceCount = cpu_to_le16(1);
+	buf->acl.AceCount = cpu_to_le16(2);
 	return buf;
 }
 
-- 
2.24.1


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH][SMB3] Fix modefromsid newly created files to allow more permission on server
  2020-01-17  2:28 [PATCH][SMB3] Fix modefromsid newly created files to allow more permission on server Steve French
@ 2020-01-17  3:04 ` Ronnie Sahlberg
  2020-01-17  4:48   ` Steve French
  0 siblings, 1 reply; 4+ messages in thread
From: Ronnie Sahlberg @ 2020-01-17  3:04 UTC (permalink / raw)
  To: Steve French; +Cc: CIFS

[-- Attachment #1.1: Type: text/plain, Size: 1057 bytes --]

Reviewed-By: Ronnie Sahlberg <lsahlber@redhat.com>

But drop the extra parenthesises here :
+		 (2 * sizeof(struct cifs_ace));

----- Original Message -----
From: "Steve French" <smfrench@gmail.com>
To: "CIFS" <linux-cifs@vger.kernel.org>
Sent: Friday, 17 January, 2020 12:28:03 PM
Subject: [PATCH][SMB3] Fix modefromsid newly created files to allow more permission on server

    When mounting with "modefromsid" mount parm most servers will require
    that some default permissions are given to users in the ACL on newly
    created files, and for files created with the new 'sd context' -
when passing in
    an sd context on create, permissions are not inherited from the parent
    directory, so in addition to the ACE with the special SID (which contains
    the mode), we also must pass in an ACE allowing users to access the file
    (GENERIC_ALL for authenticated users seemed like a reasonable default,
    although later we could allow a mount option or config switch to make
    it GENERIC_ALL for EVERYONE special sid).




-- 
Thanks,

Steve

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH][SMB3] Fix modefromsid newly created files to allow more permission on server
  2020-01-17  3:04 ` Ronnie Sahlberg
@ 2020-01-17  4:48   ` Steve French
  2020-01-22  0:04     ` Pavel Shilovsky
  0 siblings, 1 reply; 4+ messages in thread
From: Steve French @ 2020-01-17  4:48 UTC (permalink / raw)
  To: Ronnie Sahlberg; +Cc: CIFS

updated with your suggestion and reviewed-by

On Thu, Jan 16, 2020 at 9:04 PM Ronnie Sahlberg <lsahlber@redhat.com> wrote:
>
> Reviewed-By: Ronnie Sahlberg <lsahlber@redhat.com>
>
> But drop the extra parenthesises here :
> +                (2 * sizeof(struct cifs_ace));
>
> ----- Original Message -----
> From: "Steve French" <smfrench@gmail.com>
> To: "CIFS" <linux-cifs@vger.kernel.org>
> Sent: Friday, 17 January, 2020 12:28:03 PM
> Subject: [PATCH][SMB3] Fix modefromsid newly created files to allow more permission on server
>
>     When mounting with "modefromsid" mount parm most servers will require
>     that some default permissions are given to users in the ACL on newly
>     created files, and for files created with the new 'sd context' -
> when passing in
>     an sd context on create, permissions are not inherited from the parent
>     directory, so in addition to the ACE with the special SID (which contains
>     the mode), we also must pass in an ACE allowing users to access the file
>     (GENERIC_ALL for authenticated users seemed like a reasonable default,
>     although later we could allow a mount option or config switch to make
>     it GENERIC_ALL for EVERYONE special sid).
>
>
>
>
> --
> Thanks,
>
> Steve



-- 
Thanks,

Steve

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH][SMB3] Fix modefromsid newly created files to allow more permission on server
  2020-01-17  4:48   ` Steve French
@ 2020-01-22  0:04     ` Pavel Shilovsky
  0 siblings, 0 replies; 4+ messages in thread
From: Pavel Shilovsky @ 2020-01-22  0:04 UTC (permalink / raw)
  To: Steve French; +Cc: Ronnie Sahlberg, CIFS

Looks good.

Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>

--
Best regards,
Pavel Shilovsky

чт, 16 янв. 2020 г. в 21:26, Steve French <smfrench@gmail.com>:
>
> updated with your suggestion and reviewed-by
>
> On Thu, Jan 16, 2020 at 9:04 PM Ronnie Sahlberg <lsahlber@redhat.com> wrote:
> >
> > Reviewed-By: Ronnie Sahlberg <lsahlber@redhat.com>
> >
> > But drop the extra parenthesises here :
> > +                (2 * sizeof(struct cifs_ace));
> >
> > ----- Original Message -----
> > From: "Steve French" <smfrench@gmail.com>
> > To: "CIFS" <linux-cifs@vger.kernel.org>
> > Sent: Friday, 17 January, 2020 12:28:03 PM
> > Subject: [PATCH][SMB3] Fix modefromsid newly created files to allow more permission on server
> >
> >     When mounting with "modefromsid" mount parm most servers will require
> >     that some default permissions are given to users in the ACL on newly
> >     created files, and for files created with the new 'sd context' -
> > when passing in
> >     an sd context on create, permissions are not inherited from the parent
> >     directory, so in addition to the ACE with the special SID (which contains
> >     the mode), we also must pass in an ACE allowing users to access the file
> >     (GENERIC_ALL for authenticated users seemed like a reasonable default,
> >     although later we could allow a mount option or config switch to make
> >     it GENERIC_ALL for EVERYONE special sid).
> >
> >
> >
> >
> > --
> > Thanks,
> >
> > Steve
>
>
>
> --
> Thanks,
>
> Steve

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, back to index

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-17  2:28 [PATCH][SMB3] Fix modefromsid newly created files to allow more permission on server Steve French
2020-01-17  3:04 ` Ronnie Sahlberg
2020-01-17  4:48   ` Steve French
2020-01-22  0:04     ` Pavel Shilovsky

Linux-CIFS Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-cifs/0 linux-cifs/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-cifs linux-cifs/ https://lore.kernel.org/linux-cifs \
		linux-cifs@vger.kernel.org
	public-inbox-index linux-cifs

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-cifs


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git