Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two Linux systems, both running Debian Squeeze. Versions of (I think) the stuff involved are:

  kernel: 2.6.32-5-xen-amd64
  ii  nfs-kernel-server                   1:1.2.2-4squeeze2            support for NFS kernel server
  ii  libnfsidmap2                        0.23-2                       An nfs idmapping library
  ii  nfs-common                          1:1.2.2-4squeeze2            NFS support files common to client and server
  ii  portmap                             6.0.0-2                      RPC port mapper

(The client doesn't have nfs-kernel-server involved.)

I have a directory with ACLs:

# file: dirname
# owner: jon
# group: foogroup
# flags: -s-
user::rwx
user:www-data:rwx
group::r-x
group:foogroup:rwx
mask::rwx
other::r-x
default:...

There are two users, neither one of which owns the directory:

uid=3001(jake) gid=3001(jake) groups=3001(jake),104(wheel),3999(foogroup)
uid=3005(nic) gid=3005(nic) groups=3005(nic),3999(foogroup)

The jake user can create files in the directory without issues. The nic user can't. All UIDs/GIDs are the same on the client and server. I've verified (packet sniffing) that the right uids/gids get sent via AUTH_UNIX are correct-- uid=gid=3005, auxiliary gids=3005,3999-- and that the server replies with NFS3ERR_ACCESS, which the kernel on the client maps to EACCES (Permission denied).

Can anyone help me here?

share|improve this question
    
Utterly gratuitous packet trace: gist.github.com/2728469 –  jon May 19 '12 at 1:17
    
nfs-kernel-server is not a client service, but a server service. There's no reason to run that service unless a client is in turn sharing out some of its local data. –  Magellan May 21 '12 at 18:12
    
@Adrian it's not. See above. –  jon May 24 '12 at 22:58
    
Can you share your /etc/exports? –  Alastair McCormack Oct 14 '12 at 8:13

1 Answer 1

I can't say if this could cause the problem you're having, but I noticed some oddity:

Your directory is group owned by foogroup. foogroups permission therefore is group::r-x. But you set an additional ACL entry group:foogroup:rwx. Why don't you just set group:rwx instead?

Even a default ACL for group:foogroup is unecessary as you have setgid on your directory. Every new directory below will therefore automatically inherit the owning group and the setgid of your directory.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.