-----Original Message----- From: Chakra Divi [mailto:chakragithub@gmail.com] Sent: Tuesday, November 9, 2021 7:53 PM To: devel@lists.nfs-ganesha.org Subject: [NFS-Ganesha-Devel] mount subdirectories under an export dir with acls and root_squash is enabled
Hi Team,
I'm trying to mount a sub-directory under an export dir which is throwing permission denied when root squash is enabled even though it has root permissions. I have added acls on the export directory - which is sending an fsal_access call to my fsal layer with anonymous_uid so getting permission denied from my layer. I'm using ganesha v3-stable version. Am i missing anything ? Do i need make any change to allow mount only operation to use uids instead of anon uids
typo in above issue, issue is seen when using v2.3-stable version of nfs-ganesha
Could you give more information on your configuration and the setup of the export directory? As Daniel said, it sounds like working as designed. The root_squash option causes any client root credential to be squashed to anon_uid/anon_gid. What kind of ACLs are you using? It sounds like you have your own FSAL, can you share any details? Reading the above more carefully, I think you are asking about clients mounting a sub-directory of the export and perhaps the issue is that anon_uid/anon_gid doesn't have permission to access the export, just the specific sub-directories. You need to either give read-execute permission to the directory (for NFSv4 we can't distinguish between a LOOKUP that is part of a client mount command and a LOOKUP that is part of a post-mount client operation) or another option would be to create exports for each sub-directory so that the export directory only exists in the PseudoFS in which case the real export directory can have any permission desired so long as Ganesha itself has access. Also, strongly suggest moving to a more supported version of Ganesha, V2.3 is VERY old. V3.5 is the current supported release with V4.0 coming by end of year (possibly by end of November). V4-rc2 is available for non-production testing. Frank