OS: Linux CentOS 7, NFSv4
On one machine I exported an NFS share group-owned by the nfsgroup with 2770 privileges for group collaboration:
groupadd -g 5000 nfsgroup chown nobody:nfsgroup /home/groupshare chmod 2770 /home/groupshare
Then, on the other machine I add the same group and assign it to the root user. I then try to access the mounted NFS share and get a 'Permission denied' error:
groupadd -g 5000 nfsgroup usermod -a -G nfsgroup root ls -l /mnt/groupshare # Permission denied!
Note: For this I tried to re-login as root and even reboot the machine, the result is the same: Permission denied.
I then do the same thing for the regular account (named user) and have no access problems
usermod -a -G nfsgroup user su - user ls -l /mnt/groupshare # Works as expected, no permission errors
The only way I can access the share under the root is by changing the effective group (despite supplementary nfsgroup is there):
su - root newgrp nfsgroup ls -l /mnt/groupshare # No permission errors
I find this behavior inconsistent and weird. Can someone please shed a light on why it behaves this way?
One piece of information, that maybe somehow relevant is as follows. Both the
id (under user account) and
id user return the same output, in particular groups=1000(user),5000(nfsgroup), while the
id (under root account) produces groups=0(root) and
id root outputs, as expected, groups=0(root),5000(nfsgroup).