From: jrs@world.std.com (Rick Sladkey)
Newsgroups: comp.os.linux.announce
Subject: Re: Linux NFS server version 1.5
Date: 12 Apr 1993 12:01:09 GMT
Approved: linux-announce@tc.cornell.edu (Matt Welsh)
Message-ID: <JRS.93Apr12020632@lepton.world.std.com>

>>>>> On 11 Apr 1993 22:52:42 GMT, jrs@world.std.com (Rick Sladkey) said:

Rick> * the owner of a file can always read or write files regardless
Rick>   of permissions (this means that RCS now works over NFS)

I have received serveral messages from people concerned that this is a
security hole or that it is undesirable.  Let me explain why it is not
a security hole and why it is necessary.  That two-liner is what might
be called a "cryptic bombshell."  I will try to elucidate and defuse
it.

Why it is not a security hole:

In short, NFS file permissions are always checked twice.  Once by the
client and once by the server.  Since the client also checks
permissions, changing the NFS server doesn't affect whether a user is
permitted to write to read-only files.  And since the changed server
checks that a file is owned by the requesting user before permitting
writes even if the file is read-only, it doesn't do anything that that
the user couldn't have done themselves, e.g., chmod the file to be
writable, write to it, and change it back to read-only.

Why it is necessary:

The primary goal of NFS is emulate standard Unix filesystem semantics
for remotely mounted files.  A secondary goal is to make the NFS
server stateless so that clients can pick up right where they left off
after a server reboot.  Since the NFS server doesn't record what
clients have what files open, it is possible that a user on a client
legitimately has a file already open for writing but the file was
subsequently chmoded to be read-only.  Now we have a situation where
the client's permission checking says it's OK to write to that file
but the server's unmodified permission checking says it's not.  Our
solution modifies the server's permission checking in such a way that
this example works without compromising security.

If you don't believe me:

If it's any consolation, SunOS does it the same way.  At least that's
what Hal Stern suggests somewhere in "Managing NFS and NIS."  But
this is all moot anyway since NFS itself is one giant security hole...

-- 
Send submissions for comp.os.linux.announce to: linux-announce@tc.cornell.edu
