Consider the following setup:

An NFS server exports the directory /srv/nfsv4 to one client. It is exported with the option “fsid=0” for use with NFSv4.

/srv/nfsv4              192.168.0.10/24(ro,sync,secure,root_squash,subtree_check,fsid=0)

The bind-mounted directory within it, foo, is exported as well. Client 192.168.0.10 can successfully mount and write to it.

/srv/nfsv4/foo          192.168.0.10/24(rw,sync,secure,root_squash,subtree_check)

“foo” has multiple subdirectories. While client 192.168.0.10 should have full read-write access to all of them, another client, 192.168.0.20, should only see a specific subset of these directories. Everything else should not only be read-only, but not mountable at all.

At first, I did it like this:

/srv/nfsv4              192.168.0.10/24(ro,sync,secure,root_squash,subtree_check,fsid=0) \
                        192.168.0.20/24(ro,sync,secure,root_squash,subtree_check,fsid=0)

/srv/nfsv4/foo          192.168.0.10/24(rw,sync,secure,root_squash,subtree_check) \
                        192.168.0.20/24(ro,sync,secure,root_squash,subtree_check)

/srv/nfsv4/foo/dir1     192.168.0.20/24(rw,sync,secure,root_squash,subtree_check)

/srv/nfsv4/foo/dir2     192.168.0.20/24(rw,sync,secure,root_squash,subtree_check)

With the effect that client 192.168.0.20 could still mount all other subdirectories of foo (even though read-only).

So, in an attempt to achieve the desired behavior, I created a second parent directory /srv/nfsv4/bar/ that has only the intended set of subdirectories bind-mounted to it:

srv/
└── nfsv4/
    ├── foo/
    │   ├── dir1
    │   ├── dir2
    │   ├── dir3
    │   └── dir4
    └── bar/
        ├── dir1
        └── dir2

And changed /etc/exports to look like this:

/srv/nfsv4              192.168.0.10/24(ro,sync,secure,root_squash,subtree_check,fsid=0) \
                        192.168.0.20/24(ro,sync,secure,root_squash,subtree_check,fsid=0)

/srv/nfsv4/foo          192.168.0.10/24(rw,sync,secure,root_squash,subtree_check)

/srv/nfsv4/bar          192.168.0.20/24(rw,sync,secure,root_squash,subtree_check)

Now, when I mount nfs-server:/bar on client 192.168.0.20, everything seems as expected. Except that I could still mount nfs-server:/ (the exported root) and have read access to foo. My understanding was that, unless I explicitly exported foo to 192.168.0.20, it should not be visible to it.

What did I do wrong?

  • joulethief@discuss.tchncs.deOPEnglish
    1·
    7 hours ago

    Thank you. I’m closer to what I want now. Can you help me explain this behavior though:

    For testing purposes, I commented out every line in /etc/exports but these:

    /srv/nfsv4              192.168.0.10(ro,sync,secure,root_squash,subtree_check,fsid=0) \
                        192.168.0.20(ro,sync,secure,root_squash,subtree_check,fsid=0)

    Client 192.168.0.20 can mount nfs-server:/ and listing the contents gives both directories foo and bar. It cannot see the contents of foo, as intended, but it can see what’s inside bar (EDIT: it can see down one level, so the subdirectories of bar, but nothing further down). I cannot figure out why? I rebooted the machine in hopes it was just a caching thing, to no avail.

    Apart from that, I was hoping 192.168.0.20 could not even mount foo, but as long as its contents are hidden, I can live with that for now.

    • joulethief@discuss.tchncs.deOPEnglish
      1·
      6 hours ago

      Even with bar exported to this client, it cannot see its subdirectories’ contents. What the hell is going on? Just to be clear, I did run exportfs -arv after every change to /etc/exports.