linux-kernel - [PATCH 0/4] cifs: Fix gettting and setting parts of security descriptor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241222151051.23917-1-pali@kernel.org>
Date: Sun, 22 Dec 2024 16:10:47 +0100
From: Pali Rohár <pali@...nel.org>
To: Steve French <sfrench@...ba.org>,
	Paulo Alcantara <pc@...guebit.com>,
	Ronnie Sahlberg <ronniesahlberg@...il.com>
Cc: linux-cifs@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH 0/4] cifs: Fix gettting and setting parts of security descriptor

This patch series fixes getting and setting SACLs over all SMB dialects
(SMB1, SMB2, SMB3) under different conditions (including the case when
user does not have granted access to READ DACLs, but has privilege to
access and change SACLs) and allows to change ownership of files by
users who have special privilege for it, without accessing DACLs.

As for each part of security descriptor (OWNER+GROUP, DACL, SACL) is
needed different permission and every user can have different access
rights and privileges, it is needed to have more granularity when
changing security descriptor.

Therefore this patch series introduce a new xattrs to change just
SACL (system.smb3_ntsd_sacl) or just OWNER/GROUP (system.smb3_ntsd_owner).

So with this patch series there are xattrs:
- system.smb3_acl - DACL only
- system.smb3_ntsd_sacl - SACL only (new one)
- system.smb3_ntsd_owner - OWNER and GROUP only (new one)
- system.smb3_ntsd - OWNER, GROUP, DACL
- system.smb3_ntsd_full - OWNER, GROUP, DACL, SACL

Pali Rohár (4):
  cifs: Fix getting and setting SACLs over SMB1
  cifs: Change ->get_acl() API callback to request only for asked info
  cifs: Add a new xattr system.smb3_ntsd_sacl for getting or setting
    SACLs
  cifs: Add a new xattr system.smb3_ntsd_owner for getting or setting
    owner

 fs/smb/client/cifsacl.c   | 27 ++++++++++++---------
 fs/smb/client/cifsproto.h |  2 +-
 fs/smb/client/cifssmb.c   |  5 ++--
 fs/smb/client/smb2pdu.c   |  4 +---
 fs/smb/client/xattr.c     | 49 ++++++++++++++++++++++++++++++++++++---
 5 files changed, 66 insertions(+), 21 deletions(-)

-- 
2.20.1