NFS Relative Mounts

Help with this article: http://www.bermweb.net/?p=41
And also: http://lukas.zapletalovi.com/2011/05/export-for-both-nfs-v4-and-v3-clients.html

NFSv3 and NFSv4 have a difference between them that NFSv4 supports exports that are virtualized and therefore can be relativized.

NFSv3 – Absolute mounts

Imagine you have the following shares that you want shared (on the server 10.10.10.10, so 10.10.10.10 is the NFS server)

/DATA/share1
/DATA/share2
/DATA/share3

Note we want to share, share1 and share2 but not share3.

And imagine you have the following NFS exports for them

NOTE: the exports file is not what NFS actually shares, the final exports file is actually “/var/lib/nfs/etab“. exportfs takes stuff from “/etc/exports” and puts its in in “/var/lib/nfs/etab“. Also if you look into “/var/lib/nfs/etab” you will notice that in all actuality the system adds on extra mount options – similarly to doing a simple mount, then looking at the output of “mount” or “cat /proc/self/mountinfo” and seeing alot of extra options that werent assigned

Just typical export for the shares.
You would then do this to activate those “exports” (Exports, nfs shares, whatever same term in my book right now)

or

or

Now to mount them you would do something like this:

Or you can do a loopback NFS mount from the same machine (from 10.10.10.10)

Just make sure /mnt has nothing in it

NFSv4 – Relative Mounts the Recommended way

With NFSv4 we can make the mount command relative, so like this:

Notice no need to mention the /DATA/ part… Its relative…

Here is how you do that.. You need to create a bind mount first, to create your virtual tree.

So on the 10.10.10.10 server

NOTE: now of course in a production environment you would have these bind mounts setup in /etc/fstab. Look up” bind mounts /etc/fstab” in google if unsure how to do that (its super simple)

Now we need to use the option fsid=0 on the primary export directory (its the root of share1, and share2, where all relativity will start from, in this case thats /theroot)

NOTE: notice theroot is made ro so that it cant be messed with

Now run one of the exportfs commands again to take on effect (probably want to run exportfs -rv, so as to clear the old exports from /var/lib/nfs/etab)

Now the relative mount should work

As a remote mount from an NFS client:

As a loopback mount from the server machine (10.10.10.10):

NFSv4 – Relative Mounts without Bind mounts

If you dont do bind mounts like above, and did the exports like this instead

Well now we can still do the following mounts

But we could also infiltrate DATA folder with the following mount

The “dot” mount will mount fsid=0, now in this case its not a bind mount and DATA will have access (read only as it may) to share1, and share2 and share3 as well (but we dont share3 shared out)

With relative mounts from above, recall look like this:

When we do a “dot” mount:

We will only see share1, and share2 (And we will not see share3, because we dont want to see share3 🙂 )

Leave a Reply

Your email address will not be published. Required fields are marked *