Re: NFS4 authentification / fsuid

[Trond Myklebust <trond.myklebust@fys.uio.no>]

On Thu, 2007-08-30 at 16:12 +0200, Jan Engelhardt wrote:
> Hi,
> 
> 
> with NFS3, there is this 'root hole', i.e. any person who has a root 
> account (perhaps by use of a laptop) can mount an export (let's say this 
> export had the "root_squash" option), and still have a look at the user 
> files, because he can locally setuid() into another user.
> 
> So I was looking for alternatives. CIFS is my favorite candidate, but it 
> has a few issues right now. So does sshfs and about everything I have 
> come across. Since I remember NFS4 can use KRB5 authentification, my 
> question is, will the NFS(4) server process run with an fsuid equal to 
> the user that authenticated?
> 
> 
> thanks,
> 	Jan

NFSv3 should work fine with krb5 too, but that won't solve your problem
with setuid: kerberos saves the TGT in a file on /tmp, so root can still
suid and grab your cred (and the same goes for CIFS).

We've got people working on fixing this problem using David Howells'
keyrings, but it will probably be a while until we've solved all the
upcall issues, and it will probably take even longer to push the
kerberos changes back to the official MIT etc distros.

Cheers
  Trond