While looking into another issue related to users with more than 16
groups and AUTH_SYS, I noticed that my FreeBSD client was denied access
whereas linux and illumos clients with the same user worked fine.
There is a fix in illumos named "Support for more than 16 groups with
AUTH_SYS" (https://www.illumos.org/issues/5296) where if incoming
request has NGRPS (16) groups, mountd would lookup all additional groups
for uid and pass it back to kernel.
The user in question (it's just a test scenario so pretty generic):
$ id someuser
uid=30001(someuser) gid=30001(somegroup)
groups=30001(somegroup),20001(group01),20002(group02),20003(group03),
20004(group04),20005(group05),20006(group06),20007(group07),20008(group08),
20009(group09),20010(group10),20011(group11),20012(group12),20013(group13),
20014(group14),20015(group15),20016(group16),20017(group17),20018(group18),
20019(group19),20020(group20),20021(group21),20022(group22),20023(group23),
20024(group24),20025(group25),20026(group26),20027(group27),20028(group28),
20029(group29),20030(group30),20031(group31)
This works for illumos (solaris) and linux clients:
RPC: ----- SUN RPC Header -----
RPC:
RPC: Record Mark: last fragment, length = 168
RPC: Transaction id = 2395676659
RPC: Type = 0 (Call)
RPC: RPC version = 2
RPC: Program = 100003 (NFS), version = 3, procedure = 1
RPC: Credentials: Flavor = 1 (Unix), len = 92 bytes
RPC: Time = 0
RPC: Hostname = xxx
RPC: Uid = 30001, Gid = 30001
RPC: Groups = 20001 20002 20003 20004 20005 20006 20007 20008 20009
20010 20011 20012 20013 20014 20015 20016
RPC: Verifier : Flavor = 0 (None), len = 0 bytes
RPC:
And does not work for FreeBSD client:
RPC: ----- SUN RPC Header -----
RPC:
RPC: Record Mark: last fragment, length = 176
RPC: Transaction id = 3289650253
RPC: Type = 0 (Call)
RPC: RPC version = 2
RPC: Program = 100003 (NFS), version = 3, procedure = 4
RPC: Credentials: Flavor = 1 (Unix), len = 96 bytes
RPC: Time = 23-Jan-26 09:55:43
RPC: Hostname = xxx
RPC: Uid = 30001, Gid = 30001
RPC: Groups = 20001 20002 20003 20004 20005 20006 20007 20008 20009
20010 20011 20012 20013 20014 20015
RPC: Verifier : Flavor = 0 (None), len = 0 bytes
RPC:
Note the number of groups - it's 16 (20001 through 20016) for the former
and 15 (20001 through 20015) for the latter. Now the code in illumos's
mountd does the "ngids == NGRPS" check and obviously this fails for
FreeBSD client.
I am not really familiar with NFS protocol so my question is if this is
a bug in FreeBSD client or just something undocumented in protocol so
I'll have to fix it in illumos' mountd to have both 15 and 16
supplemental groups cases?
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.