Bug 14496 - ACL modification with "smbcacls" misbehaves when multiple ACEs for a single user are present
Summary: ACL modification with "smbcacls" misbehaves when multiple ACEs for a single u...
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Tools (show other bugs)
Version: 4.12.2
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-09-15 02:24 UTC by Micah Veilleux
Modified: 2020-09-15 02:24 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Micah Veilleux 2020-09-15 02:24:38 UTC 
Attempting to modify an ACE with "smbcacls", when another ACE exists that applies to the same user, can lead to unintended removal of the ACE:
------------------------------
mcrs3:/TCS # smbcacls //mcrs3/TCS /testdir -k yes
REVISION:1
CONTROL:SR|DP
OWNER:VPTC3\cifsuser
GROUP:VPTC3\Domain Users
ACL:VPTC3\Domain Admins:ALLOWED/CI/FULL
ACL:VPTC3\Domain Admins:ALLOWED/OI|IO/RWDPO
ACL:VPTC3\ptstest:ALLOWED/CI/READ
ACL:VPTC3\ptstest:ALLOWED/OI|IO/R
ACL:VPTC3\cifsuser:ALLOWED/CI/FULL
ACL:VPTC3\cifsuser:ALLOWED/OI|IO/RWDPO
mcrs3:/TCS # smbcacls //mcrs3/TCS /testdir -k yes -M "ACL:VPTC3\ptstest:ALLOWED/CI/FULL"
mcrs3:/TCS # smbcacls //mcrs3/TCS /testdir -k yes
REVISION:1
CONTROL:SR|DP
OWNER:VPTC3\cifsuser
GROUP:VPTC3\Domain Users
ACL:VPTC3\Domain Admins:ALLOWED/CI/FULL
ACL:VPTC3\Domain Admins:ALLOWED/OI|IO/RWDPO
ACL:VPTC3\ptstest:ALLOWED/CI/FULL   # the "ALLOWED/OI|IO/R" ACE that applies to "VPTC3\ptstest" is missing
ACL:VPTC3\cifsuser:ALLOWED/CI/FULL
ACL:VPTC3\cifsuser:ALLOWED/OI|IO/RWDPO
mcrs3:/TCS #
------------------------------

The smbcacls man page states that the "-M" option should "Modify the mask value (permissions) for the ACEs specified on the command line", with no mention of the flags.  The ACE is defined as "ACL:<sid or name>:<type>/<flags>/<mask>".  In this case, my expectation is that for any ACE in which the name, type, and flags match, the mask will be updated.

It also seems incorrect that the entries are prefixed with "ACL" rather than "ACE".

My version of sernet-samba is 99:4.12.2-11.suse150.