Received-SPF: pass (google.com: best guess record for domain of linux-nfs-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH] exports man page: warn about subdirectory exports
To:     "J. Bruce Fields" <bfields@fieldses.org>
Cc:     linux-nfs@vger.kernel.org
References: <20200316210146.GJ6938@fieldses.org>
From:   Steve Dickson <SteveD@RedHat.com>
Message-ID: <b1934589-28f1-6da7-7803-eb5bee71e878@RedHat.com>
Date:   Fri, 27 Mar 2020 15:15:39 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.5.0
MIME-Version: 1.0
In-Reply-To: <20200316210146.GJ6938@fieldses.org>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk


On 3/16/20 5:01 PM, J. Bruce Fields wrote:
> From: "J. Bruce Fields" <bfields@redhat.com>
> 
> Subdirectory exports have a number of problems which have been poorly
> documented.
> 
> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Committed... (tag: nfs-utils-2-4-4-rc2)

steved.
> ---
>  utils/exportfs/exports.man | 27 +++++++++++++++++++++++++++
>  1 file changed, 27 insertions(+)
> 
> diff --git a/utils/exportfs/exports.man b/utils/exportfs/exports.man
> index e3a16f6b276a..1d1718494e83 100644
> --- a/utils/exportfs/exports.man
> +++ b/utils/exportfs/exports.man
> @@ -494,6 +494,33 @@ export entry for
>  .B /home/joe
>  in the example section below, which maps all requests to uid 150 (which
>  is supposedly that of user joe).
> +
> +.SS Subdirectory Exports
> +
> +Normally you should only export only the root of a filesystem.  The NFS
> +server will also allow you to export a subdirectory of a filesystem,
> +however, this has drawbacks:
> +
> +First, it may be possible for a malicious user to access files on the
> +filesystem outside of the exported subdirectory, by guessing filehandles
> +for those other files.  The only way to prevent this is by using the
> +.IR no_subtree_check
> +option, which can cause other problems.
> +
> +Second, export options may not be enforced in the way that you would
> +expect.  For example, the
> +.IR security_label
> +option will not work on subdirectory exports, and if nested subdirectory
> +exports change the
> +.IR security_label
> +or
> +.IR sec=
> +options, NFSv4 clients will normally see only the options on the parent
> +export.  Also, where security options differ, a malicious client may use
> +filehandle-guessing attacks to access the files from one subdirectory
> +using the options from another.
> +
> +
>  .SS Extra Export Tables
>  After reading 
>  .I /etc/exports 
>