From: "J. Bruce Fields" <bfields@fieldses.org>
Subject: Re: NFS FAQ updates
Date: Mon, 14 Mar 2005 13:09:30 -0500
Message-ID: <20050314180930.GD27626@fieldses.org>
References: <482A3FA0050D21419C269D13989C611308539875@lavender-fe.eng.netapp.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>,
	nfs@lists.sourceforge.net
To: "Lever, Charles" <Charles.Lever@netapp.com>
In-Reply-To: <482A3FA0050D21419C269D13989C611308539875@lavender-fe.eng.netapp.com>
Sender: nfs-admin@lists.sourceforge.net
Errors-To: nfs-admin@lists.sourceforge.net

On Mon, Mar 14, 2005 at 09:48:05AM -0800, Lever, Charles wrote:
> thanks for your comments, guys.  i've simplified C7 a bit, see if it
> helps:
> 
>   http://nfs.sourceforge.net/index.cel.php#faq_c7

I found it a little difficult to understand what you meant by "files
sensitive to access by root" on my first reading:

	"If you are still concerned about the minor security
	implications described above, export only whole file systems if
	the file system contains files sensitive to access by root (such
	as setuid binaries)."

And I wouldn't downplay the security concern quite so much.  How about
just this?:

	"If you need to be certain that clients cannot access files
	outside the exported part of a filesystem, set up the partitions
	on your server so that you need only export whole filesystems."

A related complaint: the world "filesystem" has a lot of different
meanings.  I'm not sure if I'd be able to tell from this answer exactly
which boundaries I could count on being respected by nfsd with subtree
checking turned off.  I think "partition" would convey something more
concrete to most administrators.  Would it be inaccurate to replace
"filesystem" by "partition" everywhere in this answer?

--b.


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs