[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: bin/45556: Two problems with NFS server.
The following reply was made to PR bin/45556; it has been noted by GNATS.
From: David Laight <david%l8s.co.uk@localhost>
Subject: Re: bin/45556: Two problems with NFS server.
Date: Wed, 2 Nov 2011 08:24:09 +0000
On Wed, Nov 02, 2011 at 06:15:04AM +0000, matthew green wrote:
> The following reply was made to PR bin/45556; it has been noted by GNATS.
> From: matthew green <mrg%eterna.com.au@localhost>
> To: gnats-bugs%NetBSD.org@localhost
> Cc: gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost
> Subject: re: bin/45556: Two problems with NFS server.
> Date: Wed, 02 Nov 2011 17:10:19 +1100
> i guess your /long and /longer are both on /? this isn't how NFS works.
> see, eg from exports(5):
> space. The second is to specify the pathname of the root of the
> tem followed by the -alldirs flag; this form allows the host(s) to
> at any point within the filesystem, including regular files. Note that
> the -alldirs option should not be used as a security measure to make
> clients mount only those subdirectories that they should have access
> A client can still access the whole filesystem via individual RPCs if
> wanted to, even if just one subdirectory has been mounted. The
> you can really only apply exports across an actual filesystem.
That note is probably their because the client can fake up file handles
to other parts of the filesystem. I believe a well behaved client can
only access the exported part of the file system.
(Faking file handles is a little harder now the generation number
Netbsd might check access permissions more often but I've seen systems
that only checked during mount. This meant:
1) If you export part of a filesystem, you export all of it.
2) If you give any remote system access, you give all systems access.
3) If you give any system write access, you give all systems write access.
David Laight: david%l8s.co.uk@localhost
Main Index |
Thread Index |