[NFS-Ganesha-Devel] Re: Guidance: keeping `RecoveryRoot` inside an exported tree via a nested export with `Access_Type = None`
On Thu, 20 Aug 2026 17:57:44 -0700, "Frank Filz"
<ffilzlnx(a)mindspring.com> wrote:
How does FSID_Override prevent handle guessing?
You can take the inode portion of a handle, and wrap it in export ID and
FSID that match an export you have access to. The open_by_handle_at system
call will then happily access the file or directory.
Good point! That is still possible...
To secure it properly, we would have to use a subdirectory mount of the
cluster filesystem per export. With Lustre we would then need the
distinct FSID on each export to allow NFS-Ganesha to find the
"filesystem" associated with the export to get the mount_fd to do
open_by_handle_at().
I know this will be secure because resolving a handle from a subsequent
subdirectory mount doesn't work (ESTALE) if we use the mount_fd for the
first subdirectory mount... because all the subdirectory mounts
have the same default FSID. That's the behaviour we see without
FSID_Override=True.
Good to know about recovery_fs_ng. We should take a look at that code
and
figure out if it makes any sense and either make it usable or discard it.
Yeah, as per my other reply, it wasn't a very educated guess. I took a
fairly quick look and gave up early...
peace & happiness,
martin