Re: FS: hardlinks on directories

From: Trond Myklebust <trond.myklebust@fys.uio.no>
To: Jesse Pollard <jesse@cats-chateau.net>
Cc: Stephan von Krawczynski <skraw@ithnet.com>,
	root@chaos.analogic.com, helgehaf@aitel.hist.no,
	linux-kernel@vger.kernel.org
Subject: Re: FS: hardlinks on directories
Date: 05 Aug 2003 17:44:06 +0200	[thread overview]
Message-ID: <shsk79s6reh.fsf@charged.uio.no> (raw)
In-Reply-To: <03080510020503.05972@tabby>

>>>>> " " == Jesse Pollard <jesse@cats-chateau.net> writes:

     > You do have to remember that any NFS export gives IMPLICIT
     > access to the entire filesystem (it is the device number that
     > is actually exported). If the attacker can generate
     > device:inode number, then that file reference can be opened. I
     > haven't read/seen anything yet that has said different.

Not entirely true. The default under Linux is to enable subtree
checks. This means that knfsd must establish that the file being
accessed lies within a subtree the head of which is the export point.
This wreaks havoc with cross-directory renames etc, so a lot of people
disable it, however it is a slightly safer default...

Of course if you start playing with the idea of hard linked
directories then subtree checks are no longer an option as the path
connecting an export point and the file is no longer guaranteed to be
unique (and some paths may not even be finite).

Cheers,
  Trond