Parent directory NFS exports


Summary

Access to parents of NFS exported directories

Impact

NFS export restrictions can be bypassed

Background

The NFS (Network File System) provides a means to transparently share file systems between system of different types. File systems are often shared as a whole. For example, a UNIX file server exports a file system by exporting that file system's root directory (and thus, everything within that file system below the exported directory).

Instead of exporting complete file systems, an NFS server can be configured to export file system subtrees. For example, a UNIX file server exports a directory somewhere in the middle of a file system (and thus, everything within that file system below the exported directory).

Whenever an NFS client wants to access a remote file system for the first time, it first needs to obtain a file (directory, etc.) handle within the exported directory tree. To this end, the client host sends a mount request to the server's mount daemon. The mount daemon knows what is being exported. When the mount daemon grants access, it sends a file (directory, etc.) handle back to the NFS client.

The problem

Some NFS servers do not really know what subtree of a file system is being exported. Given a file handle for an exported subdirectory, a malicious NFS client can access its parent directory by asking the NFS server the file handle for "..", and so on, up to the root directory of that file system. Since the malicious client can acquire the file handle of the file system root directory, it is just as if the server is exporting the complete file system instead of just a subtree of it.

Fix

The fix is to make the NFS server code aware of what file system subtrees are actually being exported. This requires non-trivial changes to the NFS server software, typically something that only your vendor can do.

Workaround

When your NFS server allows access to parents of exported directories, avoid exporting subtrees of file systems. Instead, arrange your file systems such that you export only complete file systems.

Other tips