9:52 p.m.
Hi Team,
I'm trying to mount a sub-directory under an export dir which is throwing permission
denied when root squash is enabled even though it has root permissions. I have added acls
on the export directory - which is sending an fsal_access call to my fsal layer with
anonymous_uid so getting permission denied from my layer. I'm using ganesha v3-stable
version. Am i missing anything ? Do i need make any change to allow mount only operation
to use uids instead of anon uids
Regards,
Chakra
1:32 a.m.
New subject: mount subdirectories under an export dir with acls and root_squash is enabled
typo in above issue, issue is seen when using v2.3-stable version of nfs-ganesha
7:58 a.m.
New subject: mount subdirectories under an export dir with acls and root_squash is enabled
On 11/9/21 10:52 PM, Chakra Divi wrote:
Hi Team,
I'm trying to mount a sub-directory under an export dir which is throwing permission
denied when root squash is enabled even though it has root permissions. I have added acls
on the export directory - which is sending an fsal_access call to my fsal layer with
anonymous_uid so getting permission denied from my layer. I'm using ganesha v3-stable
version. Am i missing anything ? Do i need make any change to allow mount only operation
to use uids instead of anon uids
If you have root squash on, then you need permissions to the anonymous
ID, not to root. The point of root squash is that the client never
shows up as root, but instead as the anonymous ID. So it seems that
it's working correctly?
Daniel
9:08 a.m.
New subject: mount subdirectories under an export dir with acls and root_squash is enabled
-----Original Message-----
From: Chakra Divi [mailto:chakragithub@gmail.com]
Sent: Tuesday, November 9, 2021 7:53 PM
To: devel(a)lists.nfs-ganesha.org
Subject: [NFS-Ganesha-Devel] mount subdirectories under an export dir with acls
and root_squash is enabled
Hi Team,
I'm trying to mount a sub-directory under an export dir which is throwing
permission denied when root squash is enabled even though it has root
permissions. I have added acls on the export directory - which is sending an
fsal_access call to my fsal layer with anonymous_uid so getting permission
denied from my layer. I'm using ganesha v3-stable version. Am i missing anything
? Do i need make any change to allow mount only operation to use uids instead
of anon uids
typo in above issue, issue is seen when using v2.3-stable version of nfs-ganesha
Could you give more information on your configuration and the setup of the export
directory? As Daniel said, it sounds like working as designed. The root_squash option
causes any client root credential to be squashed to anon_uid/anon_gid.
What kind of ACLs are you using? It sounds like you have your own FSAL, can you share any
details?
Reading the above more carefully, I think you are asking about clients mounting a
sub-directory of the export and perhaps the issue is that anon_uid/anon_gid doesn't
have permission to access the export, just the specific sub-directories. You need to
either give read-execute permission to the directory (for NFSv4 we can't distinguish
between a LOOKUP that is part of a client mount command and a LOOKUP that is part of a
post-mount client operation) or another option would be to create exports for each
sub-directory so that the export directory only exists in the PseudoFS in which case the
real export directory can have any permission desired so long as Ganesha itself has
access.
Also, strongly suggest moving to a more supported version of Ganesha, V2.3 is VERY old.
V3.5 is the current supported release with V4.0 coming by end of year (possibly by end of
November). V4-rc2 is available for non-production testing.
Frank
10:59 p.m.
New subject: mount subdirectories under an export dir with acls and root_squash is enabled
Hi Frank,
Thanks for Responding.
I have tested my fsal layer with ganesha v3-Stable version and found that access calls are
not coming in the same use case and is mounting without any issues.
Im thinking may be in response of GET_ATTR (coming as part of lookup calls) - aces/acls
are getting ignored in case of mount command in latest ganesha.
Do you know about any specific changes in latest ganesha that ignores the acls ? Or is
that i'm missing anything
Regards,
Chakra
895
days inactive
897
days old
4 comments
3 participants
participants (3)
-
Chakra Divi -
Daniel Gryniewicz -
Frank Filz