Subject: Re: Mount point crossing & space_avail

From: Peter Staubach <[email-masked]>
Date: Wed, 27 Mar 2002 08:44:42 -0700 (MST)

> 
> In message <[email-masked]>, Eric Werme USG 
writes:
> > 
> > On our production systems, we export each user's directory separately so
> > that we can limit access to particular clients, e.g.:
> 
> BTW, I'm sure you know that there are some exploits possible when exporting
> a subdir or a file system---where the exploit allows you to get access to
> the rest of the f/s.  IIRC, Linux's knfsd couldn't get this working
> securely.  But, my information may be old.
> 

Could you describe one of these exploits which give access to something
which is unshared?

	Thanx...

		ps

---

From: Neil Brown <[email-masked]>
Date: Thu, 28 Mar 2002 14:40:49 +1100 (EST)

> Could you describe one of these exploits which give access to something

Providing you have complete control of a trusted client machine:

 Suppose the server has a filesystem   /a
 of which it exports  /a/b/c

 Get a filehandle from mountd for /a/b/c - FH1
 Ask the NFS server to LOOKUP(FH1, "..") -> FH2
   This is now a filehandle for /a/b
 Ask the NFS server to LOOKUP(FH2, "..") -> FH3
   This is now a filehandle for /a
 
 Present FH3 to the server and use it to walk around the /a
 filesystem, not all of which is shared.

 For the server to be able to disallow these accesses on the basis
 that that part of the filesystem isn't shared, it must be able to 
 tell from a given filehandle whether it is in a particular subtree of
 the filesystem or not.  This is much less trivial that checking if it
 is in a particular filesystem or not.

 Possibly the NFS server could reject the first LOOKUP(FH1,"..")
 but if it did, then it is probably fairly trivial to guess  the
 filehandle for the root of the filesystem.

 The Linux Kernel NFSD has export options "subtree_check" and
 "no_subtree_check".
 With the former, it insists on being able to find a path from the
 export point down to the presented filehandle, which is problematic
 on files with multiple links.
 With the latter, it doesn't perform this check.

 Note that "nfssh" run as root is a suitable tool to try this out.  I
 don't have a URL handy, but I think I have some sourcecode somewhere.

 Summary: NFS is for exporting filesystems, not filetrees.

 An NFSv4 server can avoid these problems by using volatile file
 handles and so requiring the client to demonstrate a valid path name
 if it (the server) cannot easily find one.

NeilBrown