Mandatory Access Control implantation against potential NFS vulnerabilities

This paper proposes a technical solution for protecting users using a shared NFS service possibly controlled by a malicious user. The main goal is to protect the integrity and confidentiality of user´s resources. Moreover, we propose to solve a more difficult challenge: how to prevent a malicious user from exploiting a supposed NFS vulnerability in order to read or write the resources of another user? Thus, this paper assumes that a vulnerability might exist in the NFS protocol or software components that gives the ability to a malicious user to execute any arbitrary code on the NFS server. Technical details about the implantation of mandatory access control mechanisms with multi categories on the server side are given. The proposed solution avoids heavy modifications of the clients and only relies on the authentication of these clients.