The server binds 127.0.0.1 (remote hosts excluded — good), but that bind is the only gate: NFS AUTH_UNIX is unauthenticated, the adapter never consults caller credentials, and access via raw RPC bypasses the mount point's Unix permission bits. Any other local user can speak NFS3 to the port and read (and, on writable mounts, write/delete) another user's environment, forging any uid. Compounding it, NFS wire filenames aren't sanitized: CREATE(dir, "../../../home/user/.bashrc") escapes the overlay directory via overlay_dir.join(...). A loopback-TCP NFS server is inherently shared among local users; at minimum this needs prominent documentation, ideally peer-credential rejection.
The server binds
127.0.0.1(remote hosts excluded — good), but that bind is the only gate: NFSAUTH_UNIXis unauthenticated, the adapter never consults caller credentials, and access via raw RPC bypasses the mount point's Unix permission bits. Any other local user can speak NFS3 to the port and read (and, on writable mounts, write/delete) another user's environment, forging any uid. Compounding it, NFS wire filenames aren't sanitized:CREATE(dir, "../../../home/user/.bashrc")escapes the overlay directory viaoverlay_dir.join(...). A loopback-TCP NFS server is inherently shared among local users; at minimum this needs prominent documentation, ideally peer-credential rejection.