I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to gain access to unauthorised files.
For example, here we have one such statement:
[In the context of Kerberos-authenticated NFS] ... NFSv4 still relies on the client to honestly report which user is accessing the files (now using the alphabetic loginID rather than the numeric UID).
And here we have a contradictory statement:
With the RPCSEC_GSS Kerberos mechanism, the server no longer depends on the client to correctly represent which user is accessing the file, as is the case with AUTH_SYS. Instead, it uses cryptography to authenticate users to the server, preventing a malicious client from impersonating a user without having that user's kerberos credentials.
What is the actual state of affairs with regard to NFSv4 file access?