Parent directory NFS exports
Summary
Access to parents of NFS exported directories
Impact
NFS export restrictions can be bypassed
Background
The NFS (Network File System) provides a means to transparently share
file systems between system of different types. File systems are often
shared as a whole. For example, a UNIX file server exports a file
system by exporting that file system's root directory (and thus,
everything within that file system below the exported directory).
Instead of exporting complete file systems, an NFS server can be
configured to export file system subtrees. For example, a UNIX file
server exports a directory somewhere in the middle of a file system
(and thus, everything within that file system below the exported
directory).
Whenever an NFS client wants to access a remote file system for the
first time, it first needs to obtain a file (directory, etc.) handle
within the exported directory tree. To this end, the client host sends
a mount request to the server's mount daemon. The mount daemon knows
what is being exported. When the mount daemon grants access, it sends a
file (directory, etc.) handle back to the NFS client.
The problem
Some NFS servers do not really know what subtree of a file system is
being exported. Given a file handle for an exported subdirectory, a
malicious NFS client can access its parent directory by asking the NFS
server the file handle for "..", and so on, up to the root directory of
that file system. Since the malicious client can acquire the file
handle of the file system root directory, it is just as if the server
is exporting the complete file system instead of just a subtree of it.
Fix
The fix is to make the NFS server code aware of what file system
subtrees are actually being exported. This requires non-trivial
changes to the NFS server software, typically something that only your
vendor can do.
Workaround
When your NFS server allows access to parents of exported directories,
avoid exporting subtrees of file systems. Instead, arrange your file
systems such that you export only complete file systems.
Other tips
- See also Leendert van Doorn's nfsbug tool
for a more extensive test of common NFS server flaws.