mount subdirectories under an export dir with acls and root_squash is enabled
Hi Team, I'm trying to mount a sub-directory under an export dir which is throwing permission denied when root squash is enabled even though it has root permissions. I have added acls on the export directory - which is sending an fsal_access call to my fsal layer with anonymous_uid so getting permission denied from my layer. I'm using ganesha v3-stable version. Am i missing anything ? Do i need make any change to allow mount only operation to use uids instead of anon uids Regards, Chakra
typo in above issue, issue is seen when using v2.3-stable version of nfs-ganesha
On 11/9/21 10:52 PM, Chakra Divi wrote:
Hi Team,
I'm trying to mount a sub-directory under an export dir which is throwing permission denied when root squash is enabled even though it has root permissions. I have added acls on the export directory - which is sending an fsal_access call to my fsal layer with anonymous_uid so getting permission denied from my layer. I'm using ganesha v3-stable version. Am i missing anything ? Do i need make any change to allow mount only operation to use uids instead of anon uids
If you have root squash on, then you need permissions to the anonymous ID, not to root. The point of root squash is that the client never shows up as root, but instead as the anonymous ID. So it seems that it's working correctly? Daniel
-----Original Message----- From: Chakra Divi [mailto:chakragithub@gmail.com] Sent: Tuesday, November 9, 2021 7:53 PM To: devel@lists.nfs-ganesha.org Subject: [NFS-Ganesha-Devel] mount subdirectories under an export dir with acls and root_squash is enabled
Hi Team,
I'm trying to mount a sub-directory under an export dir which is throwing permission denied when root squash is enabled even though it has root permissions. I have added acls on the export directory - which is sending an fsal_access call to my fsal layer with anonymous_uid so getting permission denied from my layer. I'm using ganesha v3-stable version. Am i missing anything ? Do i need make any change to allow mount only operation to use uids instead of anon uids
typo in above issue, issue is seen when using v2.3-stable version of nfs-ganesha
Could you give more information on your configuration and the setup of the export directory? As Daniel said, it sounds like working as designed. The root_squash option causes any client root credential to be squashed to anon_uid/anon_gid. What kind of ACLs are you using? It sounds like you have your own FSAL, can you share any details? Reading the above more carefully, I think you are asking about clients mounting a sub-directory of the export and perhaps the issue is that anon_uid/anon_gid doesn't have permission to access the export, just the specific sub-directories. You need to either give read-execute permission to the directory (for NFSv4 we can't distinguish between a LOOKUP that is part of a client mount command and a LOOKUP that is part of a post-mount client operation) or another option would be to create exports for each sub-directory so that the export directory only exists in the PseudoFS in which case the real export directory can have any permission desired so long as Ganesha itself has access. Also, strongly suggest moving to a more supported version of Ganesha, V2.3 is VERY old. V3.5 is the current supported release with V4.0 coming by end of year (possibly by end of November). V4-rc2 is available for non-production testing. Frank
Hi Frank, Thanks for Responding. I have tested my fsal layer with ganesha v3-Stable version and found that access calls are not coming in the same use case and is mounting without any issues. Im thinking may be in response of GET_ATTR (coming as part of lookup calls) - aces/acls are getting ignored in case of mount command in latest ganesha. Do you know about any specific changes in latest ganesha that ignores the acls ? Or is that i'm missing anything Regards, Chakra
participants (3)
-
Chakra Divi -
Daniel Gryniewicz -
Frank Filz