Mount NFS directory as read-only for certain users

Question

I have a server fileserver. Fileserver has an NFS export active that is called share.

I have three users that need ssh/sftp access to share through a remote computer fileaccess: user1,user2, and user3.

How would I set it up such that by logging into fileaccess the following permissions would be active, without modifying the file permissions on fileserver?

user1: read, write, execute
user2: read, (execute?)
user3: read, (execute?)

I would like user2 and user3 to be able to browse the folder but not modify its contents at all, while user1 would be able to do whatever they wanted to it.

I have tried mounting share on fileaccess in /mnt/ and then symlinking to everyone's home directory but I can't seem to give user2 and user3 read-only access without also removing user1's permissions as well.

Answer 1

can you use acl? you can man setfacl for details. this allows you to specify what each user or group can access which directory/file with what permission.

if that command does not exist you can install it from repos. unless your file system is really old, acl should be supported. you might have to specify acl support in mounting however in some cases.

Answer 2

Assuming you can chroot the users then you could mount the share multiple times, once in each user's chroot. For the read-only users mount the share with -o ro. If it is impossible to mount the same share multiple times you should be able to use bind mounts but with the caveat discussed at http://lwn.net/Articles/281157/

Answer 3

I ended up making /mnt/read/ and /mnt/write/ and making multiple mounts to the folders I wanted under them, with read and write having appropriate permissions.

I'm not sure about how efficient it is but it is not a very high-load share so I think it works fairly well.