|
 |
73ac72 |
commit 7d5dcd2358df55353eed94a0e84b77bb3597634e
|
|
|
73ac72 |
Author: J. Bruce Fields <bfields@redhat.com>
|
|
|
73ac72 |
Date: Fri Mar 27 13:11:28 2020 -0400
|
|
|
73ac72 |
|
|
|
73ac72 |
exports man page: warn about subdirectory exports
|
|
|
73ac72 |
|
|
|
73ac72 |
Subdirectory exports have a number of problems which have been poorly
|
|
|
73ac72 |
documented.
|
|
|
73ac72 |
|
|
|
73ac72 |
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
|
|
|
73ac72 |
Signed-off-by: Steve Dickson <steved@redhat.com>
|
|
|
73ac72 |
|
|
|
73ac72 |
diff --git a/utils/exportfs/exports.man b/utils/exportfs/exports.man
|
|
|
73ac72 |
index e3a16f6b..1d171849 100644
|
|
|
73ac72 |
--- a/utils/exportfs/exports.man
|
|
|
73ac72 |
+++ b/utils/exportfs/exports.man
|
|
|
73ac72 |
@@ -494,6 +494,33 @@ export entry for
|
|
|
73ac72 |
.B /home/joe
|
|
|
73ac72 |
in the example section below, which maps all requests to uid 150 (which
|
|
|
73ac72 |
is supposedly that of user joe).
|
|
|
73ac72 |
+
|
|
|
73ac72 |
+.SS Subdirectory Exports
|
|
|
73ac72 |
+
|
|
|
73ac72 |
+Normally you should only export only the root of a filesystem. The NFS
|
|
|
73ac72 |
+server will also allow you to export a subdirectory of a filesystem,
|
|
|
73ac72 |
+however, this has drawbacks:
|
|
|
73ac72 |
+
|
|
|
73ac72 |
+First, it may be possible for a malicious user to access files on the
|
|
|
73ac72 |
+filesystem outside of the exported subdirectory, by guessing filehandles
|
|
|
73ac72 |
+for those other files. The only way to prevent this is by using the
|
|
|
73ac72 |
+.IR no_subtree_check
|
|
|
73ac72 |
+option, which can cause other problems.
|
|
|
73ac72 |
+
|
|
|
73ac72 |
+Second, export options may not be enforced in the way that you would
|
|
|
73ac72 |
+expect. For example, the
|
|
|
73ac72 |
+.IR security_label
|
|
|
73ac72 |
+option will not work on subdirectory exports, and if nested subdirectory
|
|
|
73ac72 |
+exports change the
|
|
|
73ac72 |
+.IR security_label
|
|
|
73ac72 |
+or
|
|
|
73ac72 |
+.IR sec=
|
|
|
73ac72 |
+options, NFSv4 clients will normally see only the options on the parent
|
|
|
73ac72 |
+export. Also, where security options differ, a malicious client may use
|
|
|
73ac72 |
+filehandle-guessing attacks to access the files from one subdirectory
|
|
|
73ac72 |
+using the options from another.
|
|
|
73ac72 |
+
|
|
|
73ac72 |
+
|
|
|
73ac72 |
.SS Extra Export Tables
|
|
|
73ac72 |
After reading
|
|
|
73ac72 |
.I /etc/exports
|