Re: FreeBSD NFS client sends only 15 supplemental groups

On Fri, Jan 23, 2026 at 6:11 PM <[email protected]> wrote:
>
> While looking into another issue related to users with more than 16
> groups and AUTH_SYS, I noticed that my FreeBSD client was denied access
> whereas linux and illumos clients with the same user worked fine.
You didn't mention what version of FreeBSD you are using.
Recent work that went into FreeBSD 15 does support the whole 16
groups + gid, I think?

The problem for a long time was that FreeBSD supports 16 groups,
but group[0] was also gid, so the total, including gid was 16.
There were also old server bugs, where the gid was overwritten
by group[0] in the RPC header. To work around this, the gid and
group[0] were both set to the same gid value.
(So, if you can try FreeBSD 15, you might find this works.)

>
> There is a fix in illumos named "Support for more than 16 groups with
> AUTH_SYS" (https://www.illumos.org/issues/5296) where if incoming
> request has NGRPS (16) groups, mountd would lookup all additional groups
> for uid and pass it back to kernel.
FreeBSD has an option for nfsuserd(8) "-manage-gids", which makes the
server use the list of groups that the "uid" is assigned on the server and
ignores the gid list in the RPC header. (I believe Linux systems have
the same capability, although I do not know how it is set up.)

This is slightly different than what you describe, but may solve the
problem for you.
Look at "man nfsuserd" for more info on it.
(Normally nfsuserd(8) is only needed for NFSv4 and only for
certain cases, but the "-manage-gids" option works for NFSv3 too.)

rick

>
> The user in question (it's just a test scenario so pretty generic):
>
> $ id someuser
> uid=30001(someuser) gid=30001(somegroup)
> groups=30001(somegroup),20001(group01),20002(group02),20003(group03),
> 20004(group04),20005(group05),20006(group06),20007(group07),20008(group08),
> 20009(group09),20010(group10),20011(group11),20012(group12),20013(group13),
> 20014(group14),20015(group15),20016(group16),20017(group17),20018(group18),
> 20019(group19),20020(group20),20021(group21),20022(group22),20023(group23),
> 20024(group24),20025(group25),20026(group26),20027(group27),20028(group28),
> 20029(group29),20030(group30),20031(group31)
>
> This works for illumos (solaris) and linux clients:
>
> RPC:  ----- SUN RPC Header -----
> RPC:
> RPC:  Record Mark: last fragment, length = 168
> RPC:  Transaction id = 2395676659
> RPC:  Type = 0 (Call)
> RPC:  RPC version = 2
> RPC:  Program = 100003 (NFS), version = 3, procedure = 1
> RPC:  Credentials: Flavor = 1 (Unix), len = 92 bytes
> RPC:     Time = 0
> RPC:     Hostname = xxx
> RPC:     Uid = 30001, Gid = 30001
> RPC:     Groups = 20001 20002 20003 20004 20005 20006 20007 20008 20009
> 20010 20011 20012 20013 20014 20015 20016
> RPC:  Verifier   : Flavor = 0 (None), len = 0 bytes
> RPC:
>
> And does not work for FreeBSD client:
>
> RPC:  ----- SUN RPC Header -----
> RPC:
> RPC:  Record Mark: last fragment, length = 176
> RPC:  Transaction id = 3289650253
> RPC:  Type = 0 (Call)
> RPC:  RPC version = 2
> RPC:  Program = 100003 (NFS), version = 3, procedure = 4
> RPC:  Credentials: Flavor = 1 (Unix), len = 96 bytes
> RPC:     Time = 23-Jan-26 09:55:43
> RPC:     Hostname = xxx
> RPC:     Uid = 30001, Gid = 30001
> RPC:     Groups = 20001 20002 20003 20004 20005 20006 20007 20008 20009
> 20010 20011 20012 20013 20014 20015
> RPC:  Verifier   : Flavor = 0 (None), len = 0 bytes
> RPC:
>
> Note the number of groups - it's 16 (20001 through 20016) for the former
> and 15 (20001 through 20015) for the latter.  Now the code in illumos's
> mountd does the "ngids == NGRPS" check and obviously this fails for
> FreeBSD client.
>
> I am not really familiar with NFS protocol so my question is if this is
> a bug in FreeBSD client or just something undocumented in protocol so
> I'll have to fix it in illumos' mountd to have both 15 and 16
> supplemental groups cases?
>