Re: FreeBSD 15.0 nfsd makes all write accesses EPERM

On Tue, Jan 6, 2026 at 12:08 PM Aurélien Couderc
<aurelien.couderc2002@gmail.com> wrote:
>
> Our CI uses this script to quickly setup a FreeBSD NFSv4.1 server for
> testing. The script worked with FreeBSD 14.2, but with FreeBSD 15.0
> all files are suddenly read-only (write access gets EPERM):
>
> sysrc rpcbind_enable="YES"
> sysrc mountd_enable="YES"
> sysrc nfs_server_enable=YES
> sysrc nfsv4_server_enable=YES
> sysrc nfsuserd_flags="-domain GLOBAL.LOC"
> sysrc nfsuserd_enable=YES
> sysrc nfscbd_enable=YES
> printf 'vfs.nfs.enable_uidtostring=0\n' >>'/etc/sysctl.conf'
> printf 'vfs.nfsd.enable_stringtouid=0\n' >>'/etc/sysctl.conf'
> printf 'vfs.nfsd.issue_delegations=1\n' >>'/etc/sysctl.conf'
> mkdir /nfsdata
> chmod a+rwxt /nfsdata
> printf 'V4: /\n' >'/etc/exports'
> printf '/nfsdata -network=80.247.17.0 -mask=255.255.255.0  -sec=sys\n'
If you add "-maproot=root" to this line and test where the client is root,
I think this will work, if the ZFS bug is what I think it is.

rick

> >>'/etc/exports'
> service nfsd start
>
>
> The failed NFS4.2 op looks like this in wireshark:
>
> Network File System, Ops(8): SEQUENCE, PUTFH, SAVEFH, OPEN, GETFH,
> GETATTR, RESTOREFH, GETATTR
>     [Program Version: 4]
>     [V4 Procedure: COMPOUND (1)]
>     Tag: open
>     minorversion: 2
>     Operations (count: 8): SEQUENCE, PUTFH, SAVEFH, OPEN, GETFH,
> GETATTR, RESTOREFH, GETATTR
>         Opcode: SEQUENCE (53)
>         Opcode: PUTFH (22)
>         Opcode: SAVEFH (32)
>         Opcode: OPEN (18)
>             seqid: 0x00000000
>             share_access: OPEN4_SHARE_ACCESS_WRITE (2)
>             share_deny: OPEN4_SHARE_DENY_NONE (0)
>             clientid: 0x0000000000000000
>             owner: <DATA>
>             Open Type: OPEN4_CREATE (1)
>                 Create Mode: UNCHECKED4 (0)
>                 Attr mask[0]: 0x02000010 (Size, Hidden)
>                     reqd_attr: Size (4)
>                         size: 0
>                     reco_attr: Hidden (25)
>                         fattr4_hidden: No
>                 Attr mask[1]: 0x00004002 (Mode, System)
>                     reco_attr: Mode (33)
>                         mode: 0644, Name: Unknown, Read permission for
> owner, Write permission for owner, Read permission for group, Read
> permission for others
>                     reco_attr: System (46)
>                         fattr4_system: No
>             Claim Type: CLAIM_NULL (0)
>                 Name: u
>                     length: 1
>                     contents: u
>                     fill bytes: opaque data
>         Opcode: GETFH (10)
>         Opcode: GETATTR (9)
>         Opcode: RESTOREFH (31)
>         Opcode: GETATTR (9)
>     [Main Opcode: OPEN (18)]
>
> Suggestions, please!
> (we're aware that this setup is stupid and insecure, it is only
> intended for a CI behind a firewall)
>
> Aurélien
> --
> Aurélien Couderc <aurelien.couderc2002@gmail.com>
> Big Data/Data mining expert, chess enthusiast
>