Messages in this thread | | | Subject | Re: NFS4 authentification / fsuid | From | Trond Myklebust <> | Date | Thu, 30 Aug 2007 10:29:15 -0400 |
| |
On Thu, 2007-08-30 at 16:12 +0200, Jan Engelhardt wrote: > Hi, > > > with NFS3, there is this 'root hole', i.e. any person who has a root > account (perhaps by use of a laptop) can mount an export (let's say this > export had the "root_squash" option), and still have a look at the user > files, because he can locally setuid() into another user. > > So I was looking for alternatives. CIFS is my favorite candidate, but it > has a few issues right now. So does sshfs and about everything I have > come across. Since I remember NFS4 can use KRB5 authentification, my > question is, will the NFS(4) server process run with an fsuid equal to > the user that authenticated? > > > thanks, > Jan
NFSv3 should work fine with krb5 too, but that won't solve your problem with setuid: kerberos saves the TGT in a file on /tmp, so root can still suid and grab your cred (and the same goes for CIFS).
We've got people working on fixing this problem using David Howells' keyrings, but it will probably be a while until we've solved all the upcall issues, and it will probably take even longer to push the kerberos changes back to the official MIT etc distros.
Cheers Trond
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |