Re: question about nfs4 with krb5 behavior

[Kevin Coffman <kwc@citi.umich.edu>]

On Mon, Jan 10, 2011 at 2:55 PM, Roman Shtylman <shtylman@athenacr.com> wrote:
> I have setup nfs4 with krb5 server and successfully mounted a client. Two
> people can log into the client box and both access their respective shares and
> not each other's. However, when one user (who lets say has root privs) uses
> root to become the second user (using su) then that user can now access the
> info of the user he became.
>
> I was under the impression that this should not be possible as the tickets for
> access should still be tied to the first user they logged in as. Is this true?
> Or do I have an error in my setup?
>
> Process:
> Login as user A
> (User B logs into the machine from another terminal)
> sudo su B (to become user B on the machine)
> <can now edit files which belong to B>

User A is now "user B" and has access to the Kerberos credentials
created by user B when they logged in.  Even if user B logged out and
deleted their kerberos credentials before user A did the "sudo su B",
if user B had already accessed NFS, a kernel gss context with the
server would have been created.  That will still be available and
usable when user A becomes user B, until it expires.

> If User B does not login before user A becomes user B, user A is not able to
> edit user B's files even after he becomes user B.

In this case, user B had not previously created Kerberos credentials.

> Kernel version: 2.6.32-24
>
> any clarification on behavior would be appreciated.
>
> cheers,
> ~Roman
> --
> To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html