lkml.org 
[lkml]   [2007]   [Aug]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: NFS4 authentification / fsuid
From
Date
On Thu, 2007-08-30 at 16:12 +0200, Jan Engelhardt wrote:
> Hi,
>
>
> with NFS3, there is this 'root hole', i.e. any person who has a root
> account (perhaps by use of a laptop) can mount an export (let's say this
> export had the "root_squash" option), and still have a look at the user
> files, because he can locally setuid() into another user.
>
> So I was looking for alternatives. CIFS is my favorite candidate, but it
> has a few issues right now. So does sshfs and about everything I have
> come across. Since I remember NFS4 can use KRB5 authentification, my
> question is, will the NFS(4) server process run with an fsuid equal to
> the user that authenticated?
>
>
> thanks,
> Jan

NFSv3 should work fine with krb5 too, but that won't solve your problem
with setuid: kerberos saves the TGT in a file on /tmp, so root can still
suid and grab your cred (and the same goes for CIFS).

We've got people working on fixing this problem using David Howells'
keyrings, but it will probably be a while until we've solved all the
upcall issues, and it will probably take even longer to push the
kerberos changes back to the official MIT etc distros.

Cheers
Trond

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2007-08-30 16:31    [W:0.072 / U:0.212 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site