On Tue, 2013-04-23 at 11:42 -0400, Chuck Lever wrote: > On Apr 23, 2013, at 10:51 AM, Simo Sorce <simo@xxxxxxxxxx> wrote: > > Also why a xattr in the trusted namespace ? What are the security > > considerations that warrants a trusted attribute rather than a normal > > one ? (Links to RFCs or other docs are just fine) > > This is another historical design decision. If there is consensus that we don't need to protect junction metadata from unintended or malicious local changes, then we can put these in another namespace. However, without strong security here, redirecting network clients to another server and export can be hijacked, sending remote users to who knows where. Is it enough simply to insist that junctions be owned by root? Junctions resolve into mountpoints on clients. Allowing arbitrary users to change the junction parameters basically means giving them the ability to control the namespace on clients. They can for instance redirect an application from a trusted server onto an untrusted one. I therefore strongly recommend that we ensure the creation, deletion and modification of a junction remains a privileged operation on the server. -- Trond Myklebust Linux NFS client maintainer NetApp Trond.Myklebust@xxxxxxxxxx www.netapp.com -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
