• Neil Brown's avatar
    [PATCH] kNFSd 11: Remove problematic "security" checks when NFS exporting. · 04146816
    Neil Brown authored
    The nfs server currently doesn't allow you to export both a
    directory and an ancestor of that directory on the same filesystem.
    
    This check is more of a problem than a solution and can be
    done in user-space if needed, so it is removed.
    
    The potential for a security problem is because the files
    below the lower directory could be accessed as though it were under
    either of the export points, and so the access control that is
    applied might not be what is expected (by the nieve admin).
    
    e.g.  export /a as readwrite and /a/b as readonly.  Then a/b/c
    can be accessed readwrite as it is in /a which might not be the
    intend.  Altering the user to this can be done in userspace though.
    
    The current restriction also stops exporting / as readonly and
    /tmp as read-write which some people want to do.  Providing
    /tmp is also exported subtree_check (the default) there is no
    security issue here.
    04146816
export.c 18 KB