[0/4] cifs: Fix gettting and setting parts of security descriptor

Message

Pali Rohár Dec. 22, 2024, 3:10 p.m. UTC

This patch series fixes getting and setting SACLs over all SMB dialects
(SMB1, SMB2, SMB3) under different conditions (including the case when
user does not have granted access to READ DACLs, but has privilege to
access and change SACLs) and allows to change ownership of files by
users who have special privilege for it, without accessing DACLs.

As for each part of security descriptor (OWNER+GROUP, DACL, SACL) is
needed different permission and every user can have different access
rights and privileges, it is needed to have more granularity when
changing security descriptor.

Therefore this patch series introduce a new xattrs to change just
SACL (system.smb3_ntsd_sacl) or just OWNER/GROUP (system.smb3_ntsd_owner).

So with this patch series there are xattrs:
- system.smb3_acl - DACL only
- system.smb3_ntsd_sacl - SACL only (new one)
- system.smb3_ntsd_owner - OWNER and GROUP only (new one)
- system.smb3_ntsd - OWNER, GROUP, DACL
- system.smb3_ntsd_full - OWNER, GROUP, DACL, SACL

Pali Rohár (4):
  cifs: Fix getting and setting SACLs over SMB1
  cifs: Change ->get_acl() API callback to request only for asked info
  cifs: Add a new xattr system.smb3_ntsd_sacl for getting or setting
    SACLs
  cifs: Add a new xattr system.smb3_ntsd_owner for getting or setting
    owner

 fs/smb/client/cifsacl.c   | 27 ++++++++++++---------
 fs/smb/client/cifsproto.h |  2 +-
 fs/smb/client/cifssmb.c   |  5 ++--
 fs/smb/client/smb2pdu.c   |  4 +---
 fs/smb/client/xattr.c     | 49 ++++++++++++++++++++++++++++++++++++---
 5 files changed, 66 insertions(+), 21 deletions(-)