Is it possible to bypass NFS file permissions by using a user-space NFS client

Question

There are some user-space based NFS clients (e.g. NFS Client library). Can I bypass file permissions by using such client?

For example:

Server1 has nfs-exported file system with files

-rwxr-xr-x  user1  file1
-rwx------  user2  file2

Client1 uses usual NFS client (kernel-mode based) and user1@client1 can read only file1, but not file2. As I understand, client1 sends uid in nfs request, server1 do a permissions check based on the request data. So, I suggest this is possible to have a client2:

Client2 uses user-space client, and hacker@client2 knows uids of user1 and user2; If he wants to read file1 he can send uid of user1; if he wants to read file2, he sends uid of user2.

Is the scheme possible?

Answer 1

No, until hacker@client2 is root, because security of NFS is based on TCP source port of the request. If user-space library is started from hacker@client2 but not from root@client2, it can't use TCP ports <= 1024. Flag secure in /etc/exports will indicate to Server1 not to answer to requests from tcp ports > 1024. This flag is set by default.

Typical user authentication at nfs (v3) server in linux is AUTH_NONE and AUTH_USER. The second means that server trusts UID and GID in the request.

NFSv4 made this attack not possible at all, because nfs servers require the user to have a valid Kerberos ticket.

Book used: http://www.sans.org/reading_room/whitepapers/linux/nfs-security-trusted-untrusted-environments_1956