Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There are some user-space based NFS clients (e.g. NFS Client library). Can I bypass file permissions by using such client?

For example:

Server1 has nfs-exported file system with files

-rwxr-xr-x  user1  file1
-rwx------  user2  file2

Client1 uses usual NFS client (kernel-mode based) and user1@client1 can read only file1, but not file2. As I understand, client1 sends uid in nfs request, server1 do a permissions check based on the request data. So, I suggest this is possible to have a client2:

Client2 uses user-space client, and hacker@client2 knows uids of user1 and user2; If he wants to read file1 he can send uid of user1; if he wants to read file2, he sends uid of user2.

Is the scheme possible?

share|improve this question

migrated from Jul 4 '11 at 17:42

This question came from our site for professional and enthusiast programmers.

up vote 2 down vote accepted

No, until hacker@client2 is root, because security of NFS is based on TCP source port of the request. If user-space library is started from hacker@client2 but not from root@client2, it can't use TCP ports <= 1024. Flag secure in /etc/exports will indicate to Server1 not to answer to requests from tcp ports > 1024. This flag is set by default.

Typical user authentication at nfs (v3) server in linux is AUTH_NONE and AUTH_USER. The second means that server trusts UID and GID in the request.

NFSv4 made this attack not possible at all, because nfs servers require the user to have a valid Kerberos ticket.

Book used:

share|improve this answer
This is all fine, if you assume that only root user can have a tcp socket from a port lower than 1024. While this is a default setting in most linux systems, I wouldn't put my money on it. – Reef Dec 18 '14 at 17:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .