Blame SOURCES/nfs-utils-2.3.3-exportfs-man-labels.patch

73ac72
commit 7d5dcd2358df55353eed94a0e84b77bb3597634e
73ac72
Author: J. Bruce Fields <bfields@redhat.com>
73ac72
Date:   Fri Mar 27 13:11:28 2020 -0400
73ac72
73ac72
    exports man page: warn about subdirectory exports
73ac72
    
73ac72
    Subdirectory exports have a number of problems which have been poorly
73ac72
    documented.
73ac72
    
73ac72
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
73ac72
    Signed-off-by: Steve Dickson <steved@redhat.com>
73ac72
73ac72
diff --git a/utils/exportfs/exports.man b/utils/exportfs/exports.man
73ac72
index e3a16f6b..1d171849 100644
73ac72
--- a/utils/exportfs/exports.man
73ac72
+++ b/utils/exportfs/exports.man
73ac72
@@ -494,6 +494,33 @@ export entry for
73ac72
 .B /home/joe
73ac72
 in the example section below, which maps all requests to uid 150 (which
73ac72
 is supposedly that of user joe).
73ac72
+
73ac72
+.SS Subdirectory Exports
73ac72
+
73ac72
+Normally you should only export only the root of a filesystem.  The NFS
73ac72
+server will also allow you to export a subdirectory of a filesystem,
73ac72
+however, this has drawbacks:
73ac72
+
73ac72
+First, it may be possible for a malicious user to access files on the
73ac72
+filesystem outside of the exported subdirectory, by guessing filehandles
73ac72
+for those other files.  The only way to prevent this is by using the
73ac72
+.IR no_subtree_check
73ac72
+option, which can cause other problems.
73ac72
+
73ac72
+Second, export options may not be enforced in the way that you would
73ac72
+expect.  For example, the
73ac72
+.IR security_label
73ac72
+option will not work on subdirectory exports, and if nested subdirectory
73ac72
+exports change the
73ac72
+.IR security_label
73ac72
+or
73ac72
+.IR sec=
73ac72
+options, NFSv4 clients will normally see only the options on the parent
73ac72
+export.  Also, where security options differ, a malicious client may use
73ac72
+filehandle-guessing attacks to access the files from one subdirectory
73ac72
+using the options from another.
73ac72
+
73ac72
+
73ac72
 .SS Extra Export Tables
73ac72
 After reading 
73ac72
 .I /etc/exports