nfs permission issue

[emily_3]

I have a server exportfs the following directory:
# exportfs
/opt/appl -anon=106

One another server uid=106 tried to do NFS mount:
# mount
:/opt/appl/scripts/SRC1 /opt/appl/scripts
Permission Denied

However the following is successful
# mount
:/opt/appl/scripts /opt/appl/scripts

Can you advice why mount on parents directory is successfully but in sub directory is denied? Thanks.

[RAC_1]

Little confusion here. When uid 106 tries to mount it gets perms error. Right? And when root tries it mounts. Right? If this is the case it is doing what it should be.

For uid 106 and root, what does showmount -e "nfs_server" says?

[emily_3]

I need to better understanding the meaning of /opt/appl -anon=106
Does the above line means the only uid=106 is allowed to nfs?

[RAC_1]

NO. That means user with that uid is treated a anonlynous user and will be denied access.

man exportfs for details.

[emily_3]

Does that means that only uid=106 is not allowed to access, while root and other uid all can access?

[Peter Nikitka]

No,

that meens uid 106 gets the access rights of 'world', not that of 'owner' with uid 106 at the nfs server.

mfG Peter

[emily_3]

In this case, how about the other uid? Can't access the 'world', but can they be allowed to mount the nfs? I am a little bit confused, can explain more in this point?
And what's the root cause for the nfs mount Permission Denied? Thanks.

[Peter Nikitka · Accepted solution]

Hi,

you have to differ between
- mounting denied:
that has nothing to do with option '-anon'
- access to files in the filesystem denied

Look at that example:
Server: /exportdir 700 (mode) name106 (user with id 106)

exports: -anon=106

When accessing that directory on a NFSclient
- with an existing userid on the server, but not root and not id 106, you won't get access to that directory
- as root on the client or non-existing userid on the server, or as id 106 you will
get access.

HTH.

mfG Peter
- as root or non-existing

[emily_3]

Thanks. it looks like my issue is "mount deny" issue not "access issue". As you say it has nothing to do with -anon, what may the root cause of the mount deny?
# mount
:/opt/appl/script/SRC1 /opt/appl/script
Permission Denied

However the following is successful
# mount
:/opt/appl/script /opt/appl/script

For my case, why mount on /opt/appl/script is successful but on /opt/appl/script/SRC1 is denied? Thanks.

[Peter Nikitka]

Hi,

if you have mounted the filesystem like you have done in the second case:

Which ids have access to the SRC1 directory on the NFSclient (if any)?

mfG Peter

[emily_3]

if I am not wrong, you want to know after I mount the /opt/appl/script to mount point /opt/appl/script, you want to know the permission of SRC1, correct?
After mount the parent dir successfully, I did "ll" and the output is as following:
# ll /opt/appl/scripts
lrwxrwxr-x 1 root sys 12 Jul 4 10:13 SRC1

[Peter Nikitka]

Hi,

you wrote:
# ll /opt/appl/scripts
lrwxrwxr-x 1 root sys 12 Jul 4 10:13 SRC1

so /opt/appl/scripts/SRC1 is a symbolic link!

You cannot simply mount a symolic link - export and use the directory it points to.

If you want to access a file/directory a symbolic link points to, you must know that the destination of that link is resolved on the NFS-client.

If that text is a relative pathname within the exported directory structure, this will succeed (permissions granted ...).

If this is an absolute link, it depends:
Assume
/opt/appl/scripts/tmp -> /tmp

This will result in an access at a NFS client to its local /tmp directory!

If the link points to something on the NFS-Server which is outside of the exported directory structure, you usually won't get access. You need to setup an additional NFS-export and -mount for that directory the link points to - exactly as the link text gets resolved on the NFS client(s).

mfG Peter

[emily_3]

Ok, I see. thanks.