Bug#384922: NFS insecure without support for squashing multiple groups
I will re-phrase the problem, this may be clearer for some people:
The root_squash option is to protect from an "evil root". Though group
staff is root-equivalent, root_squash does not currently squash that group
(for various reasons, the kernel not supporting such options being one).
An "evil root" could become group staff on the client, not get squashed
across NFS, then become root on the server: root_squash is defeated.
Methods of exploitation, and ways to fix, were discussed already.
I know this bug renders my systems exploitable as we relied on the default
root_squash working, and never set non-default permissions on /usr/local or
altered root's PATH. I beleive it renders many other systems exploitable
also, but have no ways to test that hypothesis.
Cheers,
Paul Szabo psz@maths.usyd.edu.au http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics University of Sydney Australia
Reply to: