Bug 1804912
| Summary: | insecure export option is ignored if a wildcard entry matches the client IP, even if the export path does not match | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Frank Sorenson <fsorenso> |
| Component: | nfs-utils | Assignee: | Steve Dickson <steved> |
| Status: | CLOSED ERRATA | QA Contact: | Yongcheng Yang <yoyang> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | high | ||
| Version: | 8.1 | CC: | bfields, dwysocha, jiyin, jshivers, steved, swhiteho, xzhou, yieli, yoyang |
| Target Milestone: | rc | Keywords: | Patch, Reproducer, Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | nfs-utils-2.3.3-41.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-05-18 15:04:48 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1825061 | ||
(In reply to Frank Sorenson from comment #0) > ... > The presence of the wildcard entry causes 'secure' to be enforced, > regardless of whether the wildcard or specific entry is the one specifying > 'insecure'; either is sufficient for 'secure' to be enforced (for example, > the following all enforce 'secure' for both exports: > > /srv/nfs_export1 *(sync,sec=sys,anonuid=65534,anongid=65534,insecure) > /srv/nfs_export2 127.0.0.1(sync,sec=sys,anonuid=65534,anongid=65534,secure) > and > /srv/nfs_export1 *(sync,sec=sys,anonuid=65534,anongid=65534,insecure) > /srv/nfs_export2 127.0.0.1(sync,sec=sys,anonuid=65534,anongid=65534) > and > /srv/nfs_export1 *(sync,sec=sys,anonuid=65534,anongid=65534,secure) > /srv/nfs_export2 127.0.0.1(sync,sec=sys,anonuid=65534,anongid=65534,insecure) > Have reproduced this problem. Will try to add them into testcase. P.s. there're 2 other issues in parsing options: Bug 1246387 - Can mount a sub-directory disregarding the IP-restrict when the export has a wildcard and an IP-restricted submount export Bug 1359042 - /etc/exports parsing is broken leading default option cannot be overridden by the host-specific option SteveD, this looks like an important one to fix. Please take a look. SteveD, please provide an update for this bug, since it is on the RPL I too was able to reproduce this and what is causing the failure, as "rpcdebug -m nfsd -s proc" shows, a callback socket can not be created. NFSD: warning: no callback path to client Linux NFSv4.2: error -22 which probably has something to do with the ssh tunnel. Is this a truly supported configuration? Now the secure vs insecure issue... I 'm thinking it is valid for an wildcard secure export to override an explicit address insecure export since the address is included in the wildcard The same goes for the same two explicit addresses. The secure export should override the insecure export. Adding Bruce in to get his thoughts. Apologies, I haven't looked into this in detail, but one thing that jumps out at me: (In reply to Frank Sorenson from comment #0) > When a wildcard entry exists which matches the IP performing a mount, and an > entry exists for the specific IP, the 'insecure' export option ignored for > all exports matching the IP, regardless of whether the path being mounted > actually matches the export being accessed. Those exports might actually match, in a sense: > setup: > # ssh -L 12345:127.0.0.1:2049 localhost > > # mkdir -p /srv/nfs_export{1,2} /mnt/tmp > # touch /srv/nfs_export1/file_on_nfs_export1 > # touch /srv/nfs_export2/file_on_nfs_export2 Both of them are on the same filesystem. In some cases it can be difficult for the server to distinguish two exports that share the same filesystem. I haven't thought through whether this falls into one of those cases, but it would worth actually mounting different filesystems on /srv/nfs_export1 and /srv/nfs_export2 and seeing if the problem still reproduces. > I too was able to reproduce this and what is causing the failure, as "rpcdebug -m nfsd -s proc" > shows, a callback socket can not be created. With NFS versions 4.1 and higher, the backchannel shares the preexisting tcp connection. I don't know why that's failing. Also, I wouldn't necessarily expect that "no callback path" problem to cause the mount to fail. A network trace might be interesting. (In reply to J. Bruce Fields from comment #5) > Both of them are on the same filesystem. In some cases it can be difficult > for the server to distinguish two exports that share the same filesystem. See also https://bugzilla.redhat.com/show_bug.cgi?id=1624841 Looking more carefully, I think there's a real bug in nfs-utils/utils/mountd/v4root.c: Feb 19 14:05:17 vm8 rpc.mountd[16043]: auth_unix_ip: inbuf 'nfsd 127.0.0.1' Feb 19 14:05:17 vm8 rpc.mountd[16043]: v4root_create: path '/' flags 0x12407 Feb 19 14:05:17 vm8 rpc.mountd[16043]: v4root_create: path '/srv' flags 0x10407 Feb 19 14:05:17 vm8 rpc.mountd[16043]: v4root_create: path '/' flags 0x12405 Feb 19 14:05:17 vm8 rpc.mountd[16043]: v4root_create: path '/srv' flags 0x10405 NFSEXP_INSECURE_PORT is 2, so 0x12407 has that bit set, and 0x12405 does not. And sure NFSEXP_INSECURE_PORT isn't ending up set on "/": # cat /proc/net/rpc/nfsd.export/content #path domain(flags) / *,127.0.0.1(ro,root_squash,sync,no_wdelay,no_subtree_check,v4root,fsid=0,uuid=78e19a2c:05c8424d:b5c60aef:753975e5,sec=390003:390004:390005:1) The pseudofs root should have permissions as permissive as any of the exports under it, otherwise a v4 client can't traverse down to the export it's looking for. But this seems to instead be some sort of last-writer-wins behavior. Actually--remembering now how this works--mountd creates two exports with path "/", one with 127.0.0.1 and with *, and in happens that * is the one that ends up matching in this case. I think we probably need to have both exports, so we have to arrange for both of them to get the insecure flag. I'll see if I can come up with a patch. Patches posted upstream. Confession: I haven't actually tested.... They seem simple enough, and it sounds like Steve and Frank both had easy reproducers set up, so I was hoping one of you wouldn't mind trying it. https://lore.kernel.org/linux-nfs/1606949804-31417-1-git-send-email-bfields@fieldses.org/T/#t (In reply to J. Bruce Fields from comment #18) > Patches posted upstream. Confession: I haven't actually tested.... They > seem simple enough, and it sounds like Steve and Frank both had easy > reproducers set up, so I was hoping one of you wouldn't mind trying it. > > https://lore.kernel.org/linux-nfs/1606949804-31417-1-git-send-email- > bfields/T/#t Tested the patches. Now the 'insecure' export option is associated with the corresponding export as expected: Hello Trevor, Thank you for your patience while I tested the recently submitted patches. I can confirm that the patches do allow for the expected interpretation of the insecure export option based on the associated export. # git clone git://git.linux-nfs.org/projects/steved/nfs-utils.git # cd nfs-utils # git pull master # git checkout -b fs-mountd # wget 'https://lore.kernel.org/linux-nfs/1606958097-9041-1-git-send-email-bfields@fieldses.org/raw' -O mountd-1.patch # wget 'https://lore.kernel.org/linux-nfs/1606958097-9041-2-git-send-email-bfields@fieldses.org/raw' -O mountd-2.patch # patch -p1 < mountd-1.patch # patch -p1 < mountd-2.patch # sh autogen.sh # ./configure # make # make install # rpc.mountd --version rpc.mountd version 2.5.2 # mkdir -p /srv/nfs_export{1,2} /mnt/tmp # touch /srv/nfs_export1/file_on_nfs_export1 # touch /srv/nfs_export2/file_on_nfs_export2 # cat <<EOF >> /etc/exports > /srv/nfs_export1 *(sync,sec=sys,anonuid=65534,anongid=65534) > /srv/nfs_export2 127.0.0.1(sync,sec=sys,anonuid=65534,anongid=65534,insecure) > EOF # exportfs -arv # systemctl start nfs-server # ssh -L 12345:127.0.0.1:2049 localhost # mount.nfs 127.0.0.1:/srv/nfs_export2 /mnt/tmp -o port=12345,hard,sec=sys,tcp,vers=4.2 # grep /mnt/tmp /proc/self/mounts 127.0.0.1:/srv/nfs_export2 /mnt/tmp nfs4 rw,relatime,vers=4.2,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,port=12345,timeo=600,retrans=2,sec=sys,clientaddr=127.0.0.1,local_lock=none,addr=127.0.0.1 0 0 commit cb5f167cf9c2af94d9928c1ee3aa72c8e5c812f4
Author: J. Bruce Fields <bfields>
Date: Sat Dec 26 14:21:10 2020 -0500
mountd: never root squash on the pseudofs
commit 0b83ba9466b27a54672c75ad651ebb2535afecf1
Author: J. Bruce Fields <bfields>
Date: Sat Dec 26 14:18:12 2020 -0500
mountd: allow high ports on all pseudofs exports
Verified in nfs-utils-2.3.3-41.el8:
~~~~~~~~~~~~~~~~~~~~~~~~
[root@kvm-06-guest17 ~]# ssh -L 12345:127.0.0.1:2049 localhost
root@localhost's password:
...
Last login: Thu Jan 21 03:57:28 2021 from ::1
[root@kvm-06-guest17 ~]# systemctl restart nfs-server
[root@kvm-06-guest17 ~]# rpm -q nfs-utils
nfs-utils-2.3.3-41.el8.x86_64
[root@kvm-06-guest17 ~]# exportfs -v
/srv/nfs_export2
127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,ro,insecure,root_squash,no_all_squash)
/srv/nfs_export1
<world>(sync,wdelay,hide,no_subtree_check,sec=sys,ro,secure,root_squash,no_all_squash)
[root@kvm-06-guest17 ~]# mount.nfs 127.0.0.1:/srv/nfs_export2 /mnt/tmp -o port=12345,hard,sec=sys,tcp,vers=4.2
[root@kvm-06-guest17 ~]# nfsstat -m
/mnt/tmp from 127.0.0.1:/srv/nfs_export2
Flags: rw,relatime,vers=4.2,rsize=524288,wsize=524288,namlen=255,hard,proto=tcp,port=12345,timeo=600,retrans=2,sec=sys,clientad
dr=127.0.0.1,local_lock=none,addr=127.0.0.1
[root@kvm-06-guest17 ~]# umount /mnt/tmp/
[root@kvm-06-guest17 ~]# exit
logout
Connection to localhost closed.
[root@kvm-06-guest17 ~]#
Compared with the prevous logs of failure:
~~~~~~~~~~~~~~~~~~~~~~~~~~
[root@kvm-06-guest17 ~]# exportfs -v
/srv/nfs_export2
127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,ro,insecure,root_squash,no_all_squash)
/srv/nfs_export1
<world>(sync,wdelay,hide,no_subtree_check,sec=sys,ro,secure,root_squash,no_all_squash)
[root@kvm-06-guest17 ~]# mount.nfs 127.0.0.1:/srv/nfs_export2 /mnt/tmp -o port=12345,hard,sec=sys,tcp,vers=4.2
mount.nfs: Operation not permitted <<<<<<<
[root@kvm-06-guest17 ~]# rpm -q nfs-utils
nfs-utils-2.3.3-40.el8.x86_64
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (nfs-utils bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:1669 |
Description of problem: When a wildcard entry exists which matches the IP performing a mount, and an entry exists for the specific IP, the 'insecure' export option ignored for all exports matching the IP, regardless of whether the path being mounted actually matches the export being accessed. Version-Release number of selected component (if applicable): kernels: kernel-4.18.0-147.el8.x86_64 upstream (as of 5.6.0-rc2) nfs-utils 2.3.3-14.el8.x86_64 How reproducible: easy, see steps below Steps to Reproduce: create ssh tunnel, forwarding port to 2049, try to mount through the tunnel: setup: # ssh -L 12345:127.0.0.1:2049 localhost # mkdir -p /srv/nfs_export{1,2} /mnt/tmp # touch /srv/nfs_export1/file_on_nfs_export1 # touch /srv/nfs_export2/file_on_nfs_export2 # echo "/srv/nfs_export1 *(sync,sec=sys,anonuid=65534,anongid=65534) /srv/nfs_export2 127.0.0.1(sync,sec=sys,anonuid=65534,anongid=65534,insecure)" >> /etc/exports # exportfs -arv exporting 127.0.0.1:/srv/nfs_export2 exporting *:/srv/nfs_export1 mount: # mount.nfs 127.0.0.1:/srv/nfs_export2 /mnt/tmp -o port=12345,hard,sec=sys,tcp,vers=4.2 mount.nfs: Operation not permitted Actual results: mount fails (note that the wildcard export entry which has the default 'secure' is for a separate path than is being mounted) Expected results: mount succeeds Additional info: enabled some rpcdebug: # rpcdebug -m nfsd -s export # rpcdebug -m nfs -s root client mount also enabled mountd debugging in /etc/nfs.conf: [mountd] debug=all # systemctl restart nfs-mountd.service regardless of whether mount attempt is for /srv/nfs_export1 or /srv/nfs_export2, it fails; the /proc/net/rpc/nfsd.export/content contains the following: # cat /proc/net/rpc/nfsd.export/content #path domain(flags) / *,127.0.0.1(ro,root_squash,sync,no_wdelay,no_subtree_check,v4root,fsid=0,uuid=78e19a2c:05c8424d:b5c60aef:753975e5,sec=390003:390004:390005:1) # mount.nfs 127.0.0.1:/srv/nfs_export2 /mnt/tmp -o port=12345,hard,sec=sys,tcp,vers=4.2 mount.nfs: Operation not permitted messages show: Feb 19 14:05:17 vm8 kernel: NFS: parsing nfs mount option 'source' Feb 19 14:05:17 vm8 kernel: NFS: parsing nfs mount option 'port' Feb 19 14:05:17 vm8 kernel: NFS: parsing nfs mount option 'hard' Feb 19 14:05:17 vm8 kernel: NFS: parsing nfs mount option 'sec' Feb 19 14:05:17 vm8 kernel: NFS: parsing sec=sys option Feb 19 14:05:17 vm8 kernel: NFS: parsing nfs mount option 'tcp' Feb 19 14:05:17 vm8 kernel: NFS: parsing nfs mount option 'vers' Feb 19 14:05:17 vm8 kernel: NFS: parsing nfs mount option 'addr' Feb 19 14:05:17 vm8 kernel: NFS: parsing nfs mount option 'clientaddr' Feb 19 14:05:17 vm8 kernel: NFS: MNTPATH: '/srv/nfs_share2' Feb 19 14:05:17 vm8 kernel: --> nfs4_try_get_tree() Feb 19 14:05:17 vm8 kernel: nfs_create_rpc_client: cannot create RPC client. Error = -22 Feb 19 14:05:17 vm8 rpc.mountd[16043]: auth_unix_ip: inbuf 'nfsd 127.0.0.1' Feb 19 14:05:17 vm8 rpc.mountd[16043]: v4root_create: path '/' flags 0x12407 Feb 19 14:05:17 vm8 rpc.mountd[16043]: v4root_create: path '/srv' flags 0x10407 Feb 19 14:05:17 vm8 rpc.mountd[16043]: v4root_create: path '/' flags 0x12405 Feb 19 14:05:17 vm8 rpc.mountd[16043]: v4root_create: path '/srv' flags 0x10405 Feb 19 14:05:17 vm8 rpc.mountd[16043]: auth_unix_ip: client 0x556fc16870a0 '*,127.0.0.1' Feb 19 14:05:17 vm8 rpc.mountd[16043]: nfsd_fh: inbuf '*,127.0.0.1 1 \x00000000' Feb 19 14:05:17 vm8 rpc.mountd[16043]: nfsd_fh: found 0x556fc1687d30 path / Feb 19 14:05:17 vm8 kernel: found domain *,127.0.0.1 Feb 19 14:05:17 vm8 kernel: found fsidtype 1 Feb 19 14:05:17 vm8 kernel: found fsid length 4 Feb 19 14:05:17 vm8 kernel: Path seems to be </> Feb 19 14:05:17 vm8 kernel: Found the path / Feb 19 14:05:17 vm8 kernel: nfs4_get_rootfh: getroot error = 1 Feb 19 14:05:17 vm8 kernel: NFS4: Couldn't follow remote path Feb 19 14:05:17 vm8 kernel: <-- nfs4_try_get_tree() = -1 [error] modifying /etc/exports to remove the wildcard, the expected 'secure'/'insecure' will be effective: /srv/nfs_export1 127.0.0.1(sync,sec=sys,anonuid=65534,anongid=65534) /srv/nfs_export2 127.0.0.1(sync,sec=sys,anonuid=65534,anongid=65534,insecure) # exportfs -arv exporting 127.0.0.1:/srv/nfs_export2 exporting 127.0.0.1:/srv/nfs_export1 # mount.nfs 127.0.0.1:/srv/nfs_export2 /mnt/tmp -o port=12345,hard,sec=sys,tcp,vers=4.2 (success) Feb 19 14:09:16 vm8 kernel: NFS: parsing nfs mount option 'source' Feb 19 14:09:16 vm8 kernel: NFS: parsing nfs mount option 'port' Feb 19 14:09:16 vm8 kernel: NFS: parsing nfs mount option 'hard' Feb 19 14:09:16 vm8 kernel: NFS: parsing nfs mount option 'sec' Feb 19 14:09:16 vm8 kernel: NFS: parsing sec=sys option Feb 19 14:09:16 vm8 kernel: NFS: parsing nfs mount option 'tcp' Feb 19 14:09:16 vm8 kernel: NFS: parsing nfs mount option 'vers' Feb 19 14:09:16 vm8 kernel: NFS: parsing nfs mount option 'addr' Feb 19 14:09:16 vm8 kernel: NFS: parsing nfs mount option 'clientaddr' Feb 19 14:09:16 vm8 kernel: NFS: MNTPATH: '/srv/nfs_export2' Feb 19 14:09:16 vm8 kernel: --> nfs4_try_get_tree() Feb 19 14:09:16 vm8 kernel: nfs_create_rpc_client: cannot create RPC client. Error = -22 Feb 19 14:09:16 vm8 rpc.mountd[16043]: auth_unix_ip: inbuf 'nfsd 127.0.0.1' Feb 19 14:09:16 vm8 rpc.mountd[16043]: v4root_create: path '/' flags 0x12405 Feb 19 14:09:16 vm8 rpc.mountd[16043]: v4root_create: path '/srv' flags 0x10405 Feb 19 14:09:16 vm8 rpc.mountd[16043]: auth_unix_ip: client 0x556fc167c850 '127.0.0.1' Feb 19 14:09:16 vm8 rpc.mountd[16043]: nfsd_fh: inbuf '127.0.0.1 1 \x00000000' Feb 19 14:09:16 vm8 rpc.mountd[16043]: nfsd_fh: found 0x556fc1687d30 path / Feb 19 14:09:16 vm8 kernel: found domain 127.0.0.1 Feb 19 14:09:16 vm8 kernel: found fsidtype 1 Feb 19 14:09:16 vm8 kernel: found fsid length 4 Feb 19 14:09:16 vm8 kernel: Path seems to be </> Feb 19 14:09:16 vm8 kernel: Found the path / Feb 19 14:09:16 vm8 kernel: Server FSID: 0:0 Feb 19 14:09:16 vm8 kernel: Pseudo-fs root FH at 0000000076ca0527 is 8 bytes, crc: 0x62d40c52: Feb 19 14:09:16 vm8 kernel: 01000100 00000000 Feb 19 14:09:16 vm8 kernel: NFS: parsing nfs mount option 'source' Feb 19 14:09:16 vm8 kernel: NFS: MNTPATH: '/' Feb 19 14:09:16 vm8 rpc.mountd[16043]: nfsd_export: inbuf '127.0.0.1 /srv' Feb 19 14:09:16 vm8 rpc.mountd[16043]: nfsd_export: found 0x556fc1688230 path /srv Feb 19 14:09:16 vm8 rpc.mountd[16043]: nfsd_fh: inbuf '127.0.0.1 7 \x981102080000000078e19a2c05c8424db5c60aef753975e5' Feb 19 14:09:16 vm8 rpc.mountd[16043]: nfsd_fh: found 0x556fc1688240 path /srv Feb 19 14:09:16 vm8 kernel: found domain 127.0.0.1 Feb 19 14:09:16 vm8 kernel: found fsidtype 7 Feb 19 14:09:16 vm8 kernel: found fsid length 24 Feb 19 14:09:16 vm8 kernel: Path seems to be </srv> Feb 19 14:09:16 vm8 kernel: Found the path /srv Feb 19 14:09:16 vm8 kernel: NFS: parsing nfs mount option 'source' Feb 19 14:09:16 vm8 kernel: NFS: MNTPATH: '/srv' Feb 19 14:09:16 vm8 rpc.mountd[16043]: nfsd_export: inbuf '127.0.0.1 /srv/nfs_export2' Feb 19 14:09:16 vm8 rpc.mountd[16043]: nfsd_export: found 0x556fc168c0c0 path /srv/nfs_export2 Feb 19 14:09:16 vm8 kernel: <-- nfs4_try_get_tree() = 0 # cat /proc/net/rpc/nfsd.export/content #path domain(flags) /srv/nfs_export2 127.0.0.1(ro,insecure,root_squash,sync,wdelay,no_subtree_check,uuid=78e19a2c:05c8424d:b5c60aef:753975e5,sec=1) / 127.0.0.1(ro,insecure,root_squash,sync,no_wdelay,no_subtree_check,v4root,fsid=0,uuid=78e19a2c:05c8424d:b5c60aef:753975e5,sec=390003:390004:390005:1) /srv 127.0.0.1(ro,insecure,root_squash,sync,no_wdelay,no_subtree_check,v4root,uuid=78e19a2c:05c8424d:b5c60aef:753975e5,sec=390003:390004:390005:1) attempting to mount export1 fails (also as expected), and the following is added to the kernel's export cache: /srv/nfs_export1 127.0.0.1(ro,root_squash,sync,wdelay,no_subtree_check,uuid=78e19a2c:05c8424d:b5c60aef:753975e5,sec=1) Feb 19 14:13:31 vm8 kernel: NFS: parsing nfs mount option 'source' Feb 19 14:13:31 vm8 kernel: NFS: parsing nfs mount option 'port' Feb 19 14:13:31 vm8 kernel: NFS: parsing nfs mount option 'hard' Feb 19 14:13:31 vm8 kernel: NFS: parsing nfs mount option 'sec' Feb 19 14:13:31 vm8 kernel: NFS: parsing sec=sys option Feb 19 14:13:31 vm8 kernel: NFS: parsing nfs mount option 'tcp' Feb 19 14:13:31 vm8 kernel: NFS: parsing nfs mount option 'vers' Feb 19 14:13:31 vm8 kernel: NFS: parsing nfs mount option 'addr' Feb 19 14:13:31 vm8 kernel: NFS: parsing nfs mount option 'clientaddr' Feb 19 14:13:31 vm8 kernel: NFS: MNTPATH: '/srv/nfs_export1' Feb 19 14:13:31 vm8 kernel: --> nfs4_try_get_tree() Feb 19 14:13:31 vm8 kernel: nfs_create_rpc_client: cannot create RPC client. Error = -22 Feb 19 14:13:31 vm8 kernel: Server FSID: 0:0 Feb 19 14:13:31 vm8 kernel: Pseudo-fs root FH at 0000000096bed493 is 8 bytes, crc: 0x62d40c52: Feb 19 14:13:31 vm8 kernel: 01000100 00000000 Feb 19 14:13:31 vm8 kernel: NFS: parsing nfs mount option 'source' Feb 19 14:13:31 vm8 kernel: NFS: MNTPATH: '/' Feb 19 14:13:31 vm8 kernel: NFS: parsing nfs mount option 'source' Feb 19 14:13:31 vm8 kernel: NFS: MNTPATH: '/srv' Feb 19 14:13:31 vm8 rpc.mountd[16043]: nfsd_export: inbuf '127.0.0.1 /srv/nfs_export1' Feb 19 14:13:31 vm8 rpc.mountd[16043]: nfsd_export: found 0x556fc1687810 path /srv/nfs_export1 Feb 19 14:13:31 vm8 kernel: NFS4: Couldn't follow remote path Feb 19 14:13:31 vm8 kernel: <-- nfs4_try_get_tree() = -1 [error] # mount.nfs 127.0.0.1:/srv/nfs_share1 /mnt/tmp -o port=12345,hard,sec=sys,tcp,vers=4.2 mount.nfs: Operation not permitted kernel logs: [76747.915596] NFS: parsing nfs mount option 'source' [76747.915602] NFS: parsing nfs mount option 'port' [76747.915605] NFS: parsing nfs mount option 'hard' [76747.915607] NFS: parsing nfs mount option 'sec' [76747.915609] NFS: parsing sec=sys option [76747.915610] NFS: parsing nfs mount option 'tcp' [76747.915612] NFS: parsing nfs mount option 'vers' [76747.915614] NFS: parsing nfs mount option 'addr' [76747.915617] NFS: parsing nfs mount option 'clientaddr' [76747.915620] NFS: MNTPATH: '/srv/nfs_share1' [76747.915624] --> nfs4_try_get_tree() [76747.915949] nfs_create_rpc_client: cannot create RPC client. Error = -22 [76747.937776] Server FSID: 0:0 [76747.937782] Pseudo-fs root FH at 000000009df23515 is 8 bytes, crc: 0x62d40c52: [76747.937803] 01000100 00000000 [76747.939280] NFS: parsing nfs mount option 'source' [76747.939283] NFS: MNTPATH: '/' [76747.942762] found domain *,127.0.0.1 [76747.942764] found fsidtype 7 [76747.942765] found fsid length 24 [76747.942767] Path seems to be </srv> [76747.942769] Found the path /srv [76747.953781] NFS4: Couldn't follow remote path [76747.954155] <-- nfs4_try_get_tree() = -1 [error] (order in exports file does not matter) some other export options are not affected in this way: for example, wdelay/no_wdelay: /srv/nfs_export1 *(sync,sec=sys,anonuid=65534,anongid=65534,insecure,wdelay) /srv/nfs_export2 127.0.0.1(sync,sec=sys,anonuid=65534,anongid=65534,insecure,no_wdelay) # mount.nfs 127.0.0.1:/srv/nfs_export1 /mnt/tmp -o port=12345,hard,sec=sys,tcp,vers=4.2 # umount /mnt/tmp # mount.nfs 127.0.0.1:/srv/nfs_export2 /mnt/tmp -o port=12345,hard,sec=sys,tcp,vers=4.2 # umount /mnt/tmp # cat /proc/net/rpc/nfsd.export/content #path domain(flags) /srv/nfs_export1 *,127.0.0.1(ro,insecure,root_squash,sync,wdelay,no_subtree_check,uuid=78e19a2c:05c8424d:b5c60aef:753975e5,sec=1) /srv/nfs_export2 *,127.0.0.1(ro,insecure,root_squash,sync,no_wdelay,no_subtree_check,uuid=78e19a2c:05c8424d:b5c60aef:753975e5,sec=1) / *,127.0.0.1(ro,insecure,root_squash,sync,no_wdelay,no_subtree_check,v4root,fsid=0,uuid=78e19a2c:05c8424d:b5c60aef:753975e5,sec=390003:390004:390005:1) /srv *,127.0.0.1(ro,insecure,root_squash,sync,no_wdelay,no_subtree_check,v4root,uuid=78e19a2c:05c8424d:b5c60aef:753975e5,sec=390003:390004:390005:1) (unless accompanied by 'insecure': /srv/nfs_export1 *(sync,sec=sys,anonuid=65534,anongid=65534,wdelay) /srv/nfs_export2 127.0.0.1(sync,sec=sys,anonuid=65534,anongid=65534,insecure,no_wdelay) # mount.nfs 127.0.0.1:/srv/nfs_export2 /mnt/tmp -o port=12345,hard,sec=sys,tcp,vers=4.2 mount.nfs: Operation not permitted # mount.nfs 127.0.0.1:/srv/nfs_export1 /mnt/tmp -o port=12345,hard,sec=sys,tcp,vers=4.2 mount.nfs: Operation not permitted # cat /proc/net/rpc/nfsd.export/content #path domain(flags) / *,127.0.0.1(ro,root_squash,sync,no_wdelay,no_subtree_check,v4root,fsid=0,uuid=78e19a2c:05c8424d:b5c60aef:753975e5,sec=390003:390004:390005:1) The presence of the wildcard entry causes 'secure' to be enforced, regardless of whether the wildcard or specific entry is the one specifying 'insecure'; either is sufficient for 'secure' to be enforced (for example, the following all enforce 'secure' for both exports: /srv/nfs_export1 *(sync,sec=sys,anonuid=65534,anongid=65534,insecure) /srv/nfs_export2 127.0.0.1(sync,sec=sys,anonuid=65534,anongid=65534,secure) and /srv/nfs_export1 *(sync,sec=sys,anonuid=65534,anongid=65534,insecure) /srv/nfs_export2 127.0.0.1(sync,sec=sys,anonuid=65534,anongid=65534) and /srv/nfs_export1 *(sync,sec=sys,anonuid=65534,anongid=65534,secure) /srv/nfs_export2 127.0.0.1(sync,sec=sys,anonuid=65534,anongid=65534,insecure)