OS: Linux CentOS 7, NFSv4On one machine I exported an NFS share group-owned by the nfsgroup with 2770 privileges for group collaboration:groupadd -g 5000 nfsgroupchown nobody:nfsgroup /home/groupsharechmod 2770 /home/groupshareThen, on the other machine I add the same group and assign it to the root user. I then try to access the mounted NFS share and get a 'Permission denied' error:groupadd -g 5000 nfsgroupusermod -a -G nfsgroup rootls -l /mnt/groupshare       # Permission denied!Note: For this I tried to re-login as root and even reboot the machine, the result is the same: Permission denied.I then do the same thing for the regular account (named user) and have no access problemsusermod -a -G nfsgroup usersu - userls -l /mnt/groupshare      # Works as expected, no permission errorsThe only way I can access the share under the root is by changing the effective group (despite supplementary nfsgroup is there):su - rootnewgrp nfsgroupls -l /mnt/groupshare     # No permission errorsI find this behavior inconsistent and weird. Can someone please shed a light on why it behaves this way?One piece of information, that maybe somehow relevant is as follows. Both the id (under user account) and id user return the same output, in particular groups=1000(user),5000(nfsgroup), while the id (under root account) produces groups=0(root) and id root outputs, as expected, groups=0(root),5000(nfsgroup).
Do root's supplementary groups behave differently than regular account ones for NFS shares?
linux;permissions;nfs;group;access control
I think I found what caused the problem. When NFS client accesses an NFS share, the server checks UID and GID of the accessing user. And by default NFS server comes with root_squash option enabled, that assigns NFS client accessing the share as root the UID/GID of nfsnobody.After I had added the no_root_squash option to the export in /etc/exports file the problem disappeared.Apparently when NFS server 'squashes' root's UID/GID it disregards the supplementary groups altogether (seems wrong to me, but probably the NFSv4 standard thinks differently).