On Tue, Dec 10, 2024 at 11:13:16AM +0100, Christian Brauner wrote: > So I'm happy to drop the exportfs preliminary we have now preventing > kernfs from being exported but then Christoph and you should figure out > what the security implications of allowing kernfs instances to be > exported areare because I'm not an NFS export expert. I'm pretty sure you can do all kinds of really stupid things with it, and very few if any useful ones. But the litmus tests is if those are things that only the kernel nfs server can do vs things that a userland nfs (or other protocol) server could do the open by handle syscalls. Because if they aren't specific to the kernel nfs server they are just random policy for privileged actions.
