I have a computer on my network which I want to run multiple NFS servers on.
Let's say I have a directory /export, and inside I have dir1, dir2, etc, and I want to export the directories under /export to other nodes in my network.

It is essential that the NFS server exporting dir1 won't have access to dir2.
I tried to use Ganesha NFS Server that runs in user mode and put it inside a cage (chrooted, with its own namespaces), but the fact it uses open_by_handle_at system call allows it to escape and access files outside (like it's done in Shocker).

I want the each NFS server instance will export a different directory under /export and will have access only to this directory.

How can I limit an NFS server that uses open_by_handle_at system call to have access to just a specific directory?

  • what's the problem exporting /export/dir1 to host1 and /export/dir2 to host2 ? – Archemar Feb 16 at 9:07
  • @Archemar I don't want the NFS server in dir1 to have access to dir2. – Harry Froster Feb 16 at 9:11
  • if dir2 is a subdir of dir1 NFS might not be your solution. If you do as I say, host1 won't have access to dir2, however exporting host have access to all directories. – Archemar Feb 16 at 9:39
  • @Archemar dir1 and dir2 are 2 directories inside /export: /export/dir1, /export/dir2. I want that the NFS server exporting dir1 won't have access to dir2 - not only the clients. @A.B You're right, I fixed my question. – Harry Froster Feb 16 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.