From a5aebf936166102f26dae4ceb328d264f5018cd7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Jacke?= <bjacke@samba.org>
Date: Sun, 7 Jan 2024 14:42:20 +0100
Subject: [PATCH 14/38] vfs_worm: add FILE_WRITE_EA to write access mask

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15997
[backported for CVE-2026-2340]

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit abe1e959bf5a05a91a66b2bfaac97d000e4768ff)
---
 source3/modules/vfs_worm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source3/modules/vfs_worm.c b/source3/modules/vfs_worm.c
index 1a60e44984c..5c1bc6da650 100644
--- a/source3/modules/vfs_worm.c
+++ b/source3/modules/vfs_worm.c
@@ -29,7 +29,7 @@ struct worm_config_data {
 static const uint32_t write_access_flags = FILE_WRITE_DATA | FILE_APPEND_DATA |
 					   FILE_WRITE_ATTRIBUTES |
 					   DELETE_ACCESS | WRITE_DAC_ACCESS |
-					   WRITE_OWNER_ACCESS;
+					   WRITE_OWNER_ACCESS | FILE_WRITE_EA;
 
 static int vfs_worm_connect(struct vfs_handle_struct *handle,
 			    const char *service, const char *user)
-- 
2.43.0


