Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

There are some user-space based NFS clients (e.g. NFS Client library). Can I bypass file permissions by using such client?

For example:

Server1 has nfs-exported file system with files

-rwxr-xr-x  user1  file1
-rwx------  user2  file2

Client1 uses usual NFS client (kernel-mode based) and user1@client1 can read only file1, but not file2. As I understand, client1 sends uid in nfs request, server1 do a permissions check based on the request data. So, I suggest this is possible to have a client2:

Client2 uses user-space client, and hacker@client2 knows uids of user1 and user2; If he wants to read file1 he can send uid of user1; if he wants to read file2, he sends uid of user2.

Is the scheme possible?

share|improve this question

migrated from stackoverflow.com Jul 4 '11 at 17:42

This question came from our site for professional and enthusiast programmers.

1 Answer 1

up vote 1 down vote accepted

No, until hacker@client2 is root, because security of NFS is based on TCP source port of the request. If user-space library is started from hacker@client2 but not from root@client2, it can't use TCP ports <= 1024. Flag secure in /etc/exports will indicate to Server1 not to answer to requests from tcp ports > 1024. This flag is set by default.

Typical user authentication at nfs (v3) server in linux is AUTH_NONE and AUTH_USER. The second means that server trusts UID and GID in the request.

NFSv4 made this attack not possible at all, because nfs servers require the user to have a valid Kerberos ticket.

Book used: http://www.sans.org/reading_room/whitepapers/linux/nfs-security-trusted-untrusted-environments_1956

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.