Re: Kernel nfsd doesn't impersonate the client user?

On Thursday 12 July 2012 wrote Lorenzo Marcantonio:
> A while ago I asked if rsbac cooperated correctly with kernel based nfs.
> Well, it seems that's not the case...
>
> Using NFS4 from Linux to Linux, the uid is the same on both machine
> (uid=1000, by the way). Only host based authentication (no kerberos
> involved). Mounting is ok
>
> Trying to create a file in the exported directory (like a touch x) gives on
> the server (I enabled debugging for adf_rc):
>
> 0000003060|check_comp_rc(): pid 3717 (nfsd), owner 0, rc_role 999999, DIR
> rc_type 14, request CREATE -> NOT_GRANTED!
>
> 0000003061|rsbac_adf_request(): request CREATE, pid 3717, ppid 2, prog_name
> nfsd, uid 0, target_type DIR, tid Device 253:02 Inode 1232771217 Path
> /data/progetti/Appoggio, attr create_data, value FILE x, mode 644, result
> NOT_GRANTED by RC
>
> (That operation should have succeeded by the way)
>
> It seems that nfsd (a kernel thread) still run as root with the boot role!
> That would make nfs a no go with RSBAC... at least with the kernel server
> (samba for example setuids so it works fine)
>
> Any idea on this? kernel is 3.1.5-rsbac

Kernel nfsd runs completely in kernel, as its name says. This is inherently 
insecure and not supported by RSBAC so far. If you really need support for 
it, we will need to discuss how we can do that.

Amon.
-- 
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22