I have a computer on my network which I want to run multiple NFS servers on.
Let's say I have a directory
/export, and inside I have
dir2, etc, and I want to export the directories under
/export to other nodes in my network.
It is essential that the NFS server exporting
dir1 won't have access to
I tried to use Ganesha NFS Server that runs in user mode and put it inside a cage (chrooted, with its own namespaces), but the fact it uses
open_by_handle_at system call allows it to escape and access files outside (like it's done in Shocker).
I want the each NFS server instance will export a different directory under
/export and will have access only to this directory.
How can I limit an NFS server that uses
open_by_handle_at system call to have access to just a specific directory?