3 ms·

See also (1)mount's nosuid/nodev options, because plugging in a USB stick with a setuid-root shell on it apparently used to work.

• acdha 7y ago
  Or, years before, NFS: the NFS permissions model trusts the client and server implicitly. In many environments, that meant that getting root[1] on any system quickly cascaded across all of them if you could write to, say, someone's shell profile, SSH keys, or a shared binary in a common location — which was not uncommon at all when people were trying to conserve storage costs by only installing things in one place. No suid, nodev, and the various options for preventing uid=0 access were all attempts to bandaid around the lack of a better authentication option until people started switching to Kerberos. 1. Or, if they didn't require trusted ports, any account at all using https://github.com/NetDirect/nfsshell https://github.com/NetDirect/nfsshell