0

I am configuring an nfs share and my /etc/exports looks something like this:

/nfs_anon       192.168.122.0/24(rw,all_squash,anonuid=1111,anongid=1111)

Is there a way to force clients to use default umask from the server, without setting umask for user with uid 1111 on each client ?

The goal is to have clients create files with a certain set of permissions by default, independent of client umask value

1 Answer 1

1

First, are you using NFS version 3 or 4? If version 3, will both the server and the clients support the NFSACL extension?

If you are using NFSv3 + NFSACL, or NFSv4, and the actual filesystem on the NFS server supports ACLs, it should be possible to do something like this on the NFS server (adjust permissions to suit your needs):

setfacl -m d:u::rwx,d:g::rwx,d:o::rwx /nfs_anon

If the share already has sub-directories in it, you'll probably want to apply the default ACL to the top directory of the share and all existing sub-directories:

find /nfs_anon -type d -exec setfacl -m d:u::rwx,d:g::rwx,d:o::rwx {} \+

After the default mask ACL has been applied to the share's top directory, any new sub-directories created within that directory should automatically get the same default mask ACL.


Second, note that even with ACLs, this just applies a new default mask. The resulting permissions will still be based on what the program creating the file requests (typically permissions 0666 for regular files, and 0777 for executables/directories).

As far as I've understood, even the ACL will not be able to set the x permission bits if the program did not request them in the first place - it can only subtract (mask) bits from the program's original request.

3
  • Apparently I'm using version 4. ACL did the trick, thanks for your help !
    – golder3
    Apr 22, 2021 at 21:48
  • 1
    access.redhat.com/solutions/3951111 explains the umask/ACL relation over NFS. As this site is only visible after login, unfortunately, I describe the issue in own words: Seeing the umask influencing the resulting permissions despite an ACL telling otherwise is due to nfsv3 (and nfs4 < 4.2) not offering a way for the client to pass the requested mode and umask separately to the server. So the NFS client applies the umask locally and passes the result to the server which in turn applies the acl - leading to undesired results. The only way around this is to switch to NFSv4.2.
    – uli42
    Sep 2, 2022 at 14:10
  • @uli42 Nice find!
    – telcoM
    Sep 2, 2022 at 15:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .