Can I export an NFS share with faked root privileges

Question

I'm writing software for an embedded linux system and I'm using an NFS share as root directory. The root filesystem resides in /srv/nfs/rootfs, and it is exported using the following /etc/exports:

/srv/nfs *(rw,no_root_squash,no_subtree_check,async,wdelay)

The content of /srv/nfs/rootfs need to be owned by root, otherwise the target system will have trouble mounting /dev. However, I need to be able to modify the files in /srv/nfs/rootfs as regular user, and I don't want to add sudo to my scripts or run sudo on every other command. Is there some way of configuring NFS to fake root privileges on /srv/nfs/rootfs? I was thinking of trying to run nfs using fakeroot, but that does not seem like the best solution to me.

Answer 1

You can use ACLs on /srv/nfs/rootfs to give additional user(s) write access - see man setfacl / man getfacl for more info. If you decide to go this way, using the default ACLs might be a good idea - this would ensure, that the ACLs set for directories get propagated on file/directory creation. Yet there is a catch: the newly created files will be owned by the user creating them. Hence you might want to run chown root: periodically on your NFS export or hook something to FAM (File Alteration Monitor, e.g. gamin).

As a side note: exporting writable things world-wide (/srv/nfs *(rw,...) is almost never a good idea, no matter how much one thinks his/her environment is isolated from the rest of the universe.