A water utility Linux host mounts an NFS share exported with no_root_squash. During privilege-escalation enumeration, how should the tester interpret that export option?
Select an answer to reveal the explanation.
Short Explanation
Picture a shared filing cabinet that trusts whoever walks up wearing a "root" badge from another building. no_root_squash means the NFS server does not demote remote root to a nobody-style user, so client root often keeps powerful rights on the share. That is a classic Linux priv-esc adjacent finding worth highlighting—not a harmless speed tweak.
Full Explanation
NFS export options control how the server maps remote UIDs, especially UID 0. With root_squash (the safer default), remote root is remapped to an unprivileged identity; no_root_squash leaves root intact on the exported filesystem. On engagements this is treated as a privilege-escalation adjacent misconfiguration class because a foothold with root on a permitted client can abuse the share. Testers should note the finding conceptually and stay within RoE; it is unrelated to Kerberos ticket forwarding or SMB signing.