zlacker

>>chmayn+(OP)
I remember an issue that it's security model involved trusting the client. If you exported a file system to a PC, somebody could reboot the PC with Linux to get root and ignore the user permissions.

>>incomp+4b
They can get every user except root (assuming that root squash is in place).

NFSv3 and below trusts any uid/gids presented by the client unless they are squashed.