Re: FreeBSD NFS client sends only 15 supplemental groups

On Fri, Jan 23, 2026 at 7:20 PM <[email protected]> wrote:
>
> Rick Macklem wrote:
> > On Fri, Jan 23, 2026 at 6:11 PM <[email protected]> wrote:
> >>
> >> While looking into another issue related to users with more than 16
> >> groups and AUTH_SYS, I noticed that my FreeBSD client was denied access
> >> whereas linux and illumos clients with the same user worked fine.
> > You didn't mention what version of FreeBSD you are using.
> > Recent work that went into FreeBSD 15 does support the whole 16
> > groups + gid, I think?
>
> Right, sorry.
>
> $ freebsd-version -kru
> 15.0-RELEASE-p1
> 15.0-RELEASE-p1
> 15.0-RELEASE-p1
Oh well. I guess it is still limited to 15 additional groups.
(I didn't do the recent changes, so I'm not familiar with what
the outcome is, although I thought they had changed this?)

>
> > The problem for a long time was that FreeBSD supports 16 groups,
> > but group[0] was also gid, so the total, including gid was 16.
> > There were also old server bugs, where the gid was overwritten
> > by group[0] in the RPC header. To work around this, the gid and
> > group[0] were both set to the same gid value.
> > (So, if you can try FreeBSD 15, you might find this works.)
>
> Interesting, I'm on 15, but the first group in the Groups list is not
> the gid:
>
> RPC:     Uid = 30001, Gid = 30001
> RPC:     Groups = 20001 20002 20003 ...
>
> It's the output from snoop(8) on illumos host with verbose protocol
> decoding.
>
> The passwd/group lookup are done via nss_ldap in case that matters.
>
> >>
> >> There is a fix in illumos named "Support for more than 16 groups with
> >> AUTH_SYS" (https://www.illumos.org/issues/5296) where if incoming
> >> request has NGRPS (16) groups, mountd would lookup all additional groups
> >> for uid and pass it back to kernel.
> > FreeBSD has an option for nfsuserd(8) "-manage-gids", which makes the
> > server use the list of groups that the "uid" is assigned on the server and
> > ignores the gid list in the RPC header. (I believe Linux systems have
> > the same capability, although I do not know how it is set up.)
> >
> > This is slightly different than what you describe, but may solve the
> > problem for you.
> > Look at "man nfsuserd" for more info on it.
> > (Normally nfsuserd(8) is only needed for NFSv4 and only for
> > certain cases, but the "-manage-gids" option works for NFSv3 too.)
>
> Tried enabling it with -manage-gids option, but it didn't make any
> difference, it's still 15 groups in Groups in the RPC header coming from
> FreeBSD NFS client (I am only interested in FreeBSD NFS client <->
> illumos NFS server at the moment).
Yes, "-manage-gids" is server side. There is nothing in the FreeBSD
client that can exceed the 16 GID limit although it could/should be able
to present a gid + 16 additional gids.

This might get fixed someday, rick

>
> >>
> >> The user in question (it's just a test scenario so pretty generic):
> >>
> >> $ id someuser
> >> uid=30001(someuser) gid=30001(somegroup)
> >> groups=30001(somegroup),20001(group01),20002(group02),20003(group03),
> >> 20004(group04),20005(group05),20006(group06),20007(group07),20008(group08),
> >> 20009(group09),20010(group10),20011(group11),20012(group12),20013(group13),
> >> 20014(group14),20015(group15),20016(group16),20017(group17),20018(group18),
> >> 20019(group19),20020(group20),20021(group21),20022(group22),20023(group23),
> >> 20024(group24),20025(group25),20026(group26),20027(group27),20028(group28),
> >> 20029(group29),20030(group30),20031(group31)
> >>
> >> This works for illumos (solaris) and linux clients:
> >>
> >> RPC:  ----- SUN RPC Header -----
> >> RPC:
> >> RPC:  Record Mark: last fragment, length = 168
> >> RPC:  Transaction id = 2395676659
> >> RPC:  Type = 0 (Call)
> >> RPC:  RPC version = 2
> >> RPC:  Program = 100003 (NFS), version = 3, procedure = 1
> >> RPC:  Credentials: Flavor = 1 (Unix), len = 92 bytes
> >> RPC:     Time = 0
> >> RPC:     Hostname = xxx
> >> RPC:     Uid = 30001, Gid = 30001
> >> RPC:     Groups = 20001 20002 20003 20004 20005 20006 20007 20008 20009
> >> 20010 20011 20012 20013 20014 20015 20016
> >> RPC:  Verifier   : Flavor = 0 (None), len = 0 bytes
> >> RPC:
> >>
> >> And does not work for FreeBSD client:
> >>
> >> RPC:  ----- SUN RPC Header -----
> >> RPC:
> >> RPC:  Record Mark: last fragment, length = 176
> >> RPC:  Transaction id = 3289650253
> >> RPC:  Type = 0 (Call)
> >> RPC:  RPC version = 2
> >> RPC:  Program = 100003 (NFS), version = 3, procedure = 4
> >> RPC:  Credentials: Flavor = 1 (Unix), len = 96 bytes
> >> RPC:     Time = 23-Jan-26 09:55:43
> >> RPC:     Hostname = xxx
> >> RPC:     Uid = 30001, Gid = 30001
> >> RPC:     Groups = 20001 20002 20003 20004 20005 20006 20007 20008 20009
> >> 20010 20011 20012 20013 20014 20015
> >> RPC:  Verifier   : Flavor = 0 (None), len = 0 bytes
> >> RPC:
> >>
> >> Note the number of groups - it's 16 (20001 through 20016) for the former
> >> and 15 (20001 through 20015) for the latter.  Now the code in illumos's
> >> mountd does the "ngids == NGRPS" check and obviously this fails for
> >> FreeBSD client.
> >>
> >> I am not really familiar with NFS protocol so my question is if this is
> >> a bug in FreeBSD client or just something undocumented in protocol so
> >> I'll have to fix it in illumos' mountd to have both 15 and 16
> >> supplemental groups cases?
> >>
> >
>
>