Subject: [nfsv4] Root Access Problem

From: <[email-masked]>
Date: Fri, 24 Jun 2011 14:52:13 -0400

Here's the description of the Root Access Problem for Labeled NFS:

---------

Consider a label-aware server and clients that have full MAC support.
The server has neither RPCSEC_GSSv3 support for fine-grain subject labels
nor the ability to infer per-client subject labels.

Any client can connect to an exported NFS filesystem in which everything
is labeled, list the root directory, and get all of its contents back,
including things that this client should never see.  In particular, a
client that should not be able to access anything in the filesystem can
list the root directory.

---------

In order to fix this, a subject label has to be assigned to the client
very early.  SET_LABEL is one way to do this; another is to infer the
label from client IP address and/or other config info.

A possible workaround that affects the file namespace is for the root
directory of the exported FS to not contain any sensitive information.
One way to do this is for the root directory to contain exactly one
directory entry, e.g., secure_root, and to label that sub-directory.

Thanks,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------