Does NFSv4 serve only files which are at least readable? (was: NFSv4 and SUID mount)

Reuti · 08-04-2011, 04:08 PM

Hi,

I was used to mount with NFSv3 on clients in a private part of a cluster one mount point with honoring the suid bit of files on the NFSv3 server by specifying it as option in /etc/fstab. This is no longer in NFSv4 and I get "Permission denied" for such files when I try to execute them on the client. When I mount on the client the same mount point by specifying nfsvers=3 it’s working again (without changing anything on the server).

Is this a feature of NFSv4, or does it need a special setup?

As I couldn’t find anything related to this in any logfile, the only hint I got was when mounting in verbose mount that the specified option is just ignored.

Reuti · 08-05-2011, 04:13 PM

While playing around with the issue of the remote execution of a suid file, it turned out that the set permissions:

Code:

-r-s--x--x 1 root root 51K Jan 13  2010 rsh

avoid the file to be served at all to the client. Changing the permissions to:

Code:

-r-sr-xr-x 1 root root 51K Jan 13  2010 rsh

gave the expected behavior again.

So it boils down to the question why in NFSv3 it’s possible to have access to --x files, while in NFSv4 it must be r-x for group/other?

NB: For the ones wondering about the purpose of a suid rsh: it’s from the GridEngine queuing system to allow a tight integration of slaves tasks in former times as it was replaced by a built-in method. Nevertheless some touchy applications need the older startup of their slave tasks.