[lkml]   [2004]   [Mar]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: UID/GID mapping system
    On Friday 12 March 2004 09:00, Søren Hansen wrote:
    > fre, 2004-03-12 kl. 14:52 skrev Jesse Pollard:
    > > > Let's just for a second assume that I'm the slow one here. Why is the
    > > > world a less secure place after this system is incorporated into the
    > > > kernel?
    > >
    > > Because a rogue client will have access to every uid on the server.
    > As opposed to now when a rogue client is very well contained?
    > > Mapping provides a shield to protect the server.
    > A mapping system could provide extra security if implemented on the
    > server. That's true. This is, however, not what I'm trying to do. This
    > system is NOT a security related one (it doesn't increase nor decrease
    > security), but rather a convenience related one.

    Then it becomes an identity mapping (as in 1:1) and is therefore
    not usefull.

    If you are doing double mapping, then I (as a server administrator)
    would not export the filesystem to you.

    The current situation is always a 1:1 mapping (NFS version < 4). Therefore
    any filesystem export is by definition within the same security domain.

    If you as an administrator of a client host violate the UIDs assigned to
    you (by hiding the audit trail), then you are violating the rules established
    in that security domain; and should not be trusted - and the client host
    should not have an available export.

    It is never necessary to map on a client. It means that the server has been
    improperly setup, or that the client is not within the proper security domain.
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:01    [W:0.021 / U:27.132 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site