[SCM] Samba Shared Repository - branch v4-23-test updated
Björn Jacke
bjacke at samba.org
Tue Sep 8 17:14:02 UTC 2026
The branch, v4-23-test has been updated
via f8d5826c9e1 smbd: check the return value before the ACE-lists out args
via 5505575d986 smbd: prepare for correct error handling for callers of unpack_canon_ace()
via 382d31037be smbtorture: add test smb2.acls.NON-CANONICAL-ORDER
via 17ea2b3f54b smbtorture: split smb2.acls into acls-with-sysacl and acls-ignore-sysacl
from a3c156cbc74 VERSION: Bump version up to Samba 4.23.13...
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-23-test
- Log -----------------------------------------------------------------
commit f8d5826c9e1594fc19547824d53b3dffea398d4f
Author: Ralph Boehme <slow at samba.org>
Date: Mon Jun 8 14:12:14 2026 +0200
smbd: check the return value before the ACE-lists out args
If unpack_canon_ace() fails and returns false, file_ace_list and dir_ace_list
will be left at their initial NULL values, so we exit out at
if (!file_ace_list && !dir_ace_list) {
return NT_STATUS_OK;
}
instead of at the subsequent error checking code for acl_perms.
This subtle change was introduced by commit
81533e2d39cae11b7ea06f289a7c398ed3c51da9 and causes attempts to set an
non-canonical ACL by clients to return NT_STATUS_OK, instead of failing with
NT_STATUS_ACCESS_DENIED.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16097
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
Autobuild-User(master): Ralph Böhme <slow at samba.org>
Autobuild-Date(master): Fri Jun 26 12:50:29 UTC 2026 on atb-devel-224
(cherry picked from commit 4cc867cc6fe1afef85b7f88b55e4c8e0058fc7a4)
Autobuild-User(v4-23-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-23-test): Tue Sep 8 17:13:15 UTC 2026 on atb-devel-224
commit 5505575d9869966d2980f4775dcffe087b2da6d9
Author: Ralph Boehme <slow at samba.org>
Date: Mon Jun 8 14:11:33 2026 +0200
smbd: prepare for correct error handling for callers of unpack_canon_ace()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16097
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
(cherry picked from commit 1d19ca727c6f6fc6fec4a070dc90b04058b316d8)
commit 382d31037be75de775bee578a85a956846cb947a
Author: Ralph Boehme <slow at samba.org>
Date: Mon Jun 8 15:18:35 2026 +0200
smbtorture: add test smb2.acls.NON-CANONICAL-ORDER
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16097
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
(cherry picked from commit 64a20d65df6c828dee1ca3230c82868969a60afc)
commit 17ea2b3f54bedd3de762da40f81ed63a523c8607
Author: Ralph Boehme <slow at samba.org>
Date: Mon Jun 8 15:49:57 2026 +0200
smbtorture: split smb2.acls into acls-with-sysacl and acls-ignore-sysacl
The smb2.acls test suite contains tests (OWNER-RIGHTS-DENY1 and DENY1) that use
non-canonical ACLs (containing out-of-order DENY ACEs). Under standard POSIX
draft/system ACL mapping, such non-canonical ACLs cannot be represented
on the underlying file system, hence the current code is supposed to fail
attempts to set such ACLs in the Samba POSIX ACL mapping backend.
However, as the current code wrongly silently swallows the error returned from
the low level mapping function unpack_canon_ace() and a subsequent commit is
going to fix this, the tests mentioned above will start failing.
As these non-canonical ACL are in fact valid ACLs and eg Windows allows setting
them and they only fail when Samba uses POSIX ACL backend, adjust the tests to
run against a share that uses acl_xattr without POSIX ACLs:
- smb2.acls-with-sysacl: Runs tests that are compatible with system POSIX
ACL mapping, executed against the standard 'tmp' share.
- smb2.acls-ignore-sysacl: Contains tests that require Windows-like ACL
handling (like non-canonical ACE ordering) which are executed against
the 'acl_xattr_ign_sysacl_windows' share (where system ACLs are ignored).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16097
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
(cherry picked from commit 8d5674bccfdfecde34ea7a1b1fd384b0cff60d82)
-----------------------------------------------------------------------
Summary of changes:
selftest/flapping | 4 +-
selftest/knownfail | 8 +--
source3/selftest/tests.py | 7 +++
source3/smbd/posix_acls.c | 13 +++--
source4/torture/smb2/acls.c | 116 +++++++++++++++++++++++++++++++++++++++++---
source4/torture/smb2/smb2.c | 3 +-
6 files changed, 131 insertions(+), 20 deletions(-)
Changeset truncated at 500 lines:
diff --git a/selftest/flapping b/selftest/flapping
index 8c3f9e8969a..ffd83b58c32 100644
--- a/selftest/flapping
+++ b/selftest/flapping
@@ -19,8 +19,8 @@
^samba3.rpc.spoolss.printer.addprinterex.print_job_enum # fails on some hosts due to bug 10930
^samba3.rpc.lsa.privileges.lsa.Privileges\(nt4_dc\) # fails sometimes on sn-devel
^samba4.blackbox.gentest # is flakey due to timing
-^samba3.smb2.acls.INHERITANCE\(ad_dc\) # Seems to flap - succeeds on sn-devel, fails on Fedora 16
-^samba3.smb2.acls.DYNAMIC\(ad_dc\) # Seems to flap - succeeds on sn-devel, fails on Fedora 16
+^samba3.smb2.acls-with-sysacl.INHERITANCE\(ad_dc\) # Seems to flap - succeeds on sn-devel, fails on Fedora 16
+^samba3.smb2.acls-with-sysacl.DYNAMIC\(ad_dc\) # Seems to flap - succeeds on sn-devel, fails on Fedora 16
^samba3.raw.acls.dynamic\(ad_dc\) # Seems to flap - succeeds on sn-devel, fails on Fedora 16
^samba3.raw.acls.inheritance\(ad_dc\) # Seems to flap - succeeds on sn-devel, fails on Fedora 16
^samba3.raw.samba3checkfsp.samba3checkfsp\(ad_dc_smb1\) # Seems to flap - succeeds on sn-devel, fails on Fedora 16
diff --git a/selftest/knownfail b/selftest/knownfail
index ab2d79d7114..f68b5b40e29 100644
--- a/selftest/knownfail
+++ b/selftest/knownfail
@@ -146,10 +146,10 @@
^samba4.smb2.create.*.impersonation
^samba4.smb2.create.quota-fake-file\(ad_dc_ntvfs\) # not supported by the NTVFS
^samba4.smb2.create.dosattr_tmp_dir\(ad_dc_ntvfs\)
-^samba4.smb2.acls.*.generic
-^samba4.smb2.acls.*.inheritflags
-^samba4.smb2.acls.*.owner
-^samba4.smb2.acls.*.ACCESSBASED
+^samba4.smb2.acls-with-sysacl.*.generic
+^samba4.smb2.acls-with-sysacl.*.inheritflags
+^samba4.smb2.acls-with-sysacl.*.owner
+^samba4.smb2.acls-with-sysacl.*.ACCESSBASED
^samba4.ldap.dirsync.python.ad_dc_ntvfs..__main__.SimpleDirsyncTests.test_dirsync_deleted_items_OBJECT_SECURITY
#^samba4.ldap.dirsync.python.ad_dc_ntvfs..__main__.ExtendedDirsyncTests.*
^samba4.libsmbclient.opendir.(NT1|SMB3).opendir # This requires netbios browsing
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 73cb7a982fe..ccdfee88fbc 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -156,6 +156,9 @@ for t in fileserver_tests:
fileserver_env = "fileserver_smb1"
if "SMB2" in t:
fileserver_env = "fileserver"
+ if t == "OWNER-RIGHTS":
+ plantestsuite("samba3.smbtorture_s3.plain.%s" % t, fileserver_env, [os.path.join(samba3srcdir, "script/tests/test_smbtorture_s3.sh"), t, '//$SERVER_IP/acl_xattr_ign_sysacl_windows', '$USERNAME', '$PASSWORD', smbtorture3, "", "-l $LOCAL_PATH"])
+ continue
plantestsuite("samba3.smbtorture_s3.plain.%s" % t, fileserver_env, [os.path.join(samba3srcdir, "script/tests/test_smbtorture_s3.sh"), t, '//$SERVER_IP/tmp', '$USERNAME', '$PASSWORD', smbtorture3, "", "-l $LOCAL_PATH"])
plantestsuite("samba3.smbtorture_s3.crypt_client.%s" % t, "nt4_dc_smb1", [os.path.join(samba3srcdir, "script/tests/test_smbtorture_s3.sh"), t, '//$SERVER_IP/tmp', '$USERNAME', '$PASSWORD', smbtorture3, "-e", "-l $LOCAL_PATH"])
if t == "TORTURE":
@@ -1397,6 +1400,10 @@ for t in tests:
plansmbtorture4testsuite(t, "ad_dc", '//$SERVER/tmp -U$USERNAME%$PASSWORD')
elif t == "smb2.fileid":
plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/vfs_fruit_xattr -U$USERNAME%$PASSWORD')
+ elif t == "smb2.acls-with-sysacl":
+ plansmbtorture4testsuite(t, "fileserver", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD')
+ elif t == "smb2.acls-ignore-sysacl":
+ plansmbtorture4testsuite(t, "fileserver", '//$SERVER_IP/acl_xattr_ign_sysacl_windows -U$USERNAME%$PASSWORD')
elif t == "smb2.acls_non_canonical":
plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/acls_non_canonical -U$USERNAME%$PASSWORD')
elif t == "smb2.async_dosmode":
diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 47d310a946e..cc1d4527edc 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -2407,7 +2407,7 @@ static bool unpack_canon_ace(files_struct *fsp,
if(security_info_sent == 0) {
DEBUG(0,("unpack_canon_ace: no security info sent !\n"));
- return False;
+ return True;
}
/*
@@ -3677,12 +3677,6 @@ NTSTATUS set_nt_acl(files_struct *fsp, uint32_t security_info_sent, const struct
acl_perms = unpack_canon_ace(fsp, &fsp->fsp_name->st, &file_owner_sid,
&file_grp_sid, &file_ace_list,
&dir_ace_list, security_info_sent, psd);
-
- /* Ignore W2K traverse DACL set. */
- if (!file_ace_list && !dir_ace_list) {
- return NT_STATUS_OK;
- }
-
if (!acl_perms) {
DEBUG(3,("set_nt_acl: cannot set permissions\n"));
free_canon_ace_list(file_ace_list);
@@ -3690,6 +3684,11 @@ NTSTATUS set_nt_acl(files_struct *fsp, uint32_t security_info_sent, const struct
return NT_STATUS_ACCESS_DENIED;
}
+ /* Ignore W2K traverse DACL set. */
+ if (!file_ace_list && !dir_ace_list) {
+ return NT_STATUS_OK;
+ }
+
/*
* Only change security if we got a DACL.
*/
diff --git a/source4/torture/smb2/acls.c b/source4/torture/smb2/acls.c
index 0459d6547dc..e83d8997b04 100644
--- a/source4/torture/smb2/acls.c
+++ b/source4/torture/smb2/acls.c
@@ -3239,12 +3239,102 @@ done:
return ret;
}
+static bool test_non_canonical_order(struct torture_context *tctx,
+ struct smb2_tree *tree)
+{
+ const char *fname = BASEDIR "\\test_non_canonical_order.dat";
+ struct smb2_create cr = {};
+ struct smb2_handle testdirh = {};
+ struct smb2_handle handle = {};
+ union smb_setfileinfo si;
+ struct security_descriptor *sd = NULL;
+ NTSTATUS status;
+ bool ret = true;
+
+ smb2_deltree(tree, BASEDIR);
+
+ status = torture_smb2_testdir(tree, BASEDIR, &testdirh);
+ torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+ "torture_smb2_testdir failed\n");
+ status = smb2_util_close(tree, testdirh);
+ torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+ "smb2_util_close failed\n");
+ ZERO_STRUCT(testdirh);
+
+ /*
+ * Create an ACL with an allow ACE before a deny ACE. That is
+ * non-canonical order, Windows allows this but our POSIX ACL mapping
+ * code chokes on this.
+ */
+
+ sd = security_descriptor_dacl_create(tctx,
+ 0,
+ NULL,
+ NULL,
+ SID_WORLD,
+ SEC_ACE_TYPE_ACCESS_ALLOWED,
+ SEC_RIGHTS_DIR_ALL,
+ SEC_ACE_FLAG_OBJECT_INHERIT
+ | SEC_ACE_FLAG_CONTAINER_INHERIT,
+
+ SID_WORLD,
+ SEC_ACE_TYPE_ACCESS_DENIED,
+ SEC_RIGHTS_DIR_ALL,
+ SEC_ACE_FLAG_OBJECT_INHERIT
+ | SEC_ACE_FLAG_CONTAINER_INHERIT,
+
+ NULL);
+ torture_assert_not_null_goto(tctx, sd, ret, done, "SD create failed\n");
+
+ cr = (struct smb2_create) {
+ .in.desired_access = SEC_STD_WRITE_DAC,
+ .in.file_attributes = FILE_ATTRIBUTE_NORMAL,
+ .in.share_access = NTCREATEX_SHARE_ACCESS_MASK,
+ .in.create_disposition = NTCREATEX_DISP_OPEN_IF,
+ .in.impersonation_level = NTCREATEX_IMPERSONATION_ANONYMOUS,
+ .in.fname = fname,
+ };
+
+ status = smb2_create(tree, tctx, &cr);
+ torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+ "smb2_create failed\n");
+ handle = cr.out.file.handle;
+
+ si = (union smb_setfileinfo) {
+ .set_secdesc.level = RAW_SFILEINFO_SEC_DESC,
+ .set_secdesc.in.file.handle = handle,
+ .set_secdesc.in.secinfo_flags = SECINFO_DACL,
+ .set_secdesc.in.sd = sd,
+ };
+
+ status = smb2_setinfo_file(tree, &si);
+ torture_assert_ntstatus_equal_goto(tctx, status,
+ NT_STATUS_ACCESS_DENIED,
+ ret, done,
+ "smb2_setinfo_file failed\n");
+
+ status = smb2_util_close(tree, handle);
+ torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+ "smb2_util_close failed\n");
+ ZERO_STRUCT(handle);
+
+done:
+ if (!smb2_util_handle_empty(testdirh)) {
+ smb2_util_close(tree, testdirh);
+ }
+ if (!smb2_util_handle_empty(handle)) {
+ smb2_util_close(tree, handle);
+ }
+ smb2_deltree(tree, BASEDIR);
+ return ret;
+}
+
/*
basic testing of SMB2 ACLs
*/
-struct torture_suite *torture_smb2_acls_init(TALLOC_CTX *ctx)
+struct torture_suite *torture_smb2_acls_with_sysacl_init(TALLOC_CTX *ctx)
{
- struct torture_suite *suite = torture_suite_create(ctx, "acls");
+ struct torture_suite *suite = torture_suite_create(ctx, "acls-with-sysacl");
torture_suite_add_1smb2_test(suite, "CREATOR", test_creator_sid);
torture_suite_add_1smb2_test(suite, "GENERIC", test_generic_bits);
@@ -3261,15 +3351,29 @@ struct torture_suite *torture_smb2_acls_init(TALLOC_CTX *ctx)
torture_suite_add_1smb2_test(suite, "OWNER-RIGHTS", test_owner_rights);
torture_suite_add_1smb2_test(suite, "OWNER-RIGHTS-DENY",
test_owner_rights_deny);
+ torture_suite_add_1smb2_test(suite, "MXAC-NOT-GRANTED",
+ test_mxac_not_granted);
+ torture_suite_add_1smb2_test(suite, "OVERWRITE_READ_ONLY_FILE", test_overwrite_read_only_file);
+ torture_suite_add_1smb2_test(suite, "NON-CANONICAL-ORDER", test_non_canonical_order);
+
+ suite->description = talloc_strdup(suite, "SMB2-ACLS-WITH-SYSACL tests");
+
+ return suite;
+}
+
+/*
+ basic testing of SMB2 ACLs
+*/
+struct torture_suite *torture_smb2_acls_ignore_sysacl_init(TALLOC_CTX *ctx)
+{
+ struct torture_suite *suite = torture_suite_create(ctx, "acls-ignore-sysacl");
+
torture_suite_add_1smb2_test(suite, "OWNER-RIGHTS-DENY1",
test_owner_rights_deny1);
torture_suite_add_1smb2_test(suite, "DENY1",
test_deny1);
- torture_suite_add_1smb2_test(suite, "MXAC-NOT-GRANTED",
- test_mxac_not_granted);
- torture_suite_add_1smb2_test(suite, "OVERWRITE_READ_ONLY_FILE", test_overwrite_read_only_file);
- suite->description = talloc_strdup(suite, "SMB2-ACLS tests");
+ suite->description = talloc_strdup(suite, "SMB2-ACLS-IGNORE-SYSACL tests");
return suite;
}
diff --git a/source4/torture/smb2/smb2.c b/source4/torture/smb2/smb2.c
index cf426b2252a..5b444c8c03a 100644
--- a/source4/torture/smb2/smb2.c
+++ b/source4/torture/smb2/smb2.c
@@ -157,7 +157,8 @@ NTSTATUS torture_smb2_init(TALLOC_CTX *ctx)
torture_suite_add_suite(suite, torture_smb2_create_init(suite));
torture_suite_add_suite(suite, torture_smb2_twrp_init(suite));
torture_suite_add_suite(suite, torture_smb2_fileid_init(suite));
- torture_suite_add_suite(suite, torture_smb2_acls_init(suite));
+ torture_suite_add_suite(suite, torture_smb2_acls_with_sysacl_init(suite));
+ torture_suite_add_suite(suite, torture_smb2_acls_ignore_sysacl_init(suite));
torture_suite_add_suite(suite, torture_smb2_acls_non_canonical_init(suite));
torture_suite_add_suite(suite, torture_smb2_notify_init(suite));
torture_suite_add_suite(suite, torture_smb2_notify_inotify_init(suite));
--
Samba Shared Repository
More information about the samba-cvs
mailing list