OS: Linux CentOS 7, NFSv4
On one machine I exported an NFS share group-owned by the nfsgroup with 2770 privileges for group collaboration:
groupadd -g 5000 nfsgroup
chown nobody:nfsgroup /home/groupshare
chmod 2770 /home/groupshare
Then, on the other machine I add the same group and assign it to the root user. I then try to access the mounted NFS share and get a 'Permission denied' error:
groupadd -g 5000 nfsgroup
usermod -a -G nfsgroup root
ls -l /mnt/groupshare # Permission denied!
Note: For this I tried to re-login as root and even reboot the machine, the result is the same: Permission denied.
I then do the same thing for the regular account (named user) and have no access problems
usermod -a -G nfsgroup user
su - user
ls -l /mnt/groupshare # Works as expected, no permission errors
The only way I can access the share under the root is by changing the effective group (despite supplementary nfsgroup is there):
su - root
newgrp nfsgroup
ls -l /mnt/groupshare # No permission errors
I find this behavior inconsistent and weird. Can someone please shed a light on why it behaves this way?
One piece of information, that maybe somehow relevant is as follows. Both the id
(under user account) and id user
return the same output, in particular groups=1000(user),5000(nfsgroup), while the id
(under root account) produces groups=0(root) and id root
outputs, as expected, groups=0(root),5000(nfsgroup).
chown nobody
, but with that\ command... NFS has a security option wherebyroot
on a client is treated asnobody
.