linux-kernel - Re: NFS4 authentification / fsuid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1188484155.6755.38.camel@heimdal.trondhjem.org>
Date:	Thu, 30 Aug 2007 10:29:15 -0400
From:	Trond Myklebust <trond.myklebust@....uio.no>
To:	Jan Engelhardt <jengelh@...putergmbh.de>
Cc:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: NFS4 authentification / fsuid

On Thu, 2007-08-30 at 16:12 +0200, Jan Engelhardt wrote:
> Hi,
> 
> 
> with NFS3, there is this 'root hole', i.e. any person who has a root 
> account (perhaps by use of a laptop) can mount an export (let's say this 
> export had the "root_squash" option), and still have a look at the user 
> files, because he can locally setuid() into another user.
> 
> So I was looking for alternatives. CIFS is my favorite candidate, but it 
> has a few issues right now. So does sshfs and about everything I have 
> come across. Since I remember NFS4 can use KRB5 authentification, my 
> question is, will the NFS(4) server process run with an fsuid equal to 
> the user that authenticated?
> 
> 
> thanks,
> 	Jan

NFSv3 should work fine with krb5 too, but that won't solve your problem
with setuid: kerberos saves the TGT in a file on /tmp, so root can still
suid and grab your cred (and the same goes for CIFS).

We've got people working on fixing this problem using David Howells'
keyrings, but it will probably be a while until we've solved all the
upcall issues, and it will probably take even longer to push the
kerberos changes back to the official MIT etc distros.

Cheers
  Trond

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/