Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 4 down vote favorite
1

On my NFS server, I have the following export defined:

#NFS exports Database
/shared -alldirs -network=192.168.1 -mask=255.255.255.0

On my NFS client:

192.168.1.7:/shared /shared nfs rw 0 0

Obviously, as root on the server, I can do whatever I want. On the client however, my regular user 'gabe' can make changes to the nfs mount (assuming I have permissions to), but root cannot.

As my regular user: 

gabe@client$ cd /shared
gabe@client$ ls -l
total 8
drwxrwxrwx  4 gabe  wheel   512 Mar 20 19:20 tmp
gabe@client$ cd tmp
gabe@client$ touch test.txt
gabe@client$ rm test.txt

As root:

# cd /shared/tmp
# touch test.txt
touch: test.txt: Permission denied

Again, this is all on the NFS client side of things, and I suspect perhaps it has something to do with the -maproot option, but I'm too much of an NFS noob to understand exactly what. This is the first time I'm setting up NFS and I just noticed this peculiarity. I'm going to do some reading now, to see if I can figure this out, but if anyone has any insight, I would appreciate it.

share|improve this question

2 Answers

up vote 8 down vote accepted

NFS was designed with the idea that user and group ids would be the same on all machines across the network. For ordinary users, that works ok. But root's UID is always 0, and just because you have root on one box, it doesn't mean that you should have root access to every machine on the network.

Therefore, NFS treats root specially. By default, root is mapped to the nobody user, which normally has no write access. The -maproot option allows you to change how root is handled. BSD's -maproot=root corresponds to Linux's no_root_squash option.

share|improve this answer
Yes, indeed. This fixed my problem. The man page I was reading was a little cryptic (or my understanding was) with regards to what exactly maproot did. Thanks! – gabe. Mar 22 '11 at 0:47
Another noob here. I was wondering if you guys might know a way to tell if a NFS drive has been configured to use the -maproot option without having access to the NFS Server. – John Jul 29 '11 at 20:31
@John, that's different enough that you should ask a new question instead of adding a comment. – cjm Jul 30 '11 at 10:11
up vote 1 down vote

That's common behavior with traditional NFS implementations. NFS user mappings are performed irrespective of context, so all accesses by the client root have to be mapped to a particular user (usually nobody by default). Hence this weird behavior, where the client root can't access your files directly, but can su gabe to access them.

(“Recent” versions of NFS, i.e. NFSv4 and perhaps NFSv3, allow saner behavior if supported on both sides, but I don't know the details.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.