On Thu, Jul 04, 2024 at 08:24:44AM +1000, NeilBrown wrote: > 3/ The current code uses the 'struct cred' of the application to look up > the file in the server code. When a request goes over the wire the > credential is translated to uid/gid (or krb identity) and this is > mapped back to a credential on the server which might be in a > different uid name space (might it? Does that even work for nfsd?) > > I think that if rootsquash or allsquash is in effect the correct > server-side credential is used but otherwise the client-side > credential is used. That is likely correct in many cases but I'd > like to be convinced that it is correct in all case. Maybe it is > time to get a deeper understanding of uid name spaces. > > Have I missed anything? Any other thoughts? Still getting up to speed with the code (and only the current one posted by Mike, I haven't looked at your series yet), and the fundamental underlying problem seems to be that while the code to open the file resides in the nfsd code, it is called from client context. If opening the file was done in normal nfsd context with all the usual limitations and then handed out it would work exactly like FD passing and avoid almost all possibility of privilege escalation. I'm not sure how to best archive that, though.
