misc/163501: NFS exporting a dir and a subdir in that dir to the same host; mountd error message needs improvement

[Peter Maloney]

>Number:         163501
>Category:       misc
>Synopsis:       NFS exporting a dir and a subdir in that dir to the same host; mountd error message needs improvement
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Dec 21 10:00:26 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Peter Maloney
>Release:        8-STABLE Sept 29 2011
>Organization:
Brockmann Consult
>Environment:
FreeBSD bcnas1.bc.local 8.2-STABLE FreeBSD 8.2-STABLE #0: Thu Sep 29 15:06:03 CEST 2011     root at bcnas1.bc.local:/usr/obj/usr/src/sys/GENERIC  amd64

>Description:
/etc/exports
--------------------------
#works fine
/tank/somedataset1 -maproot=root -network somenetwork/16
/tank/somedataset1 -maproot=root someipaddress1
/tank/somedataset1 -maproot=root someipaddress2
/tank/somedataset1/somesubdir/somesubdir -maproot=root someipaddress4 #even this works
/tank/somedataset2 -maproot=root someipaddress3

#does not work
/tank/somedataset2/somesubdir -maproot=root someipaddress3
--------------------------

/var/log/messages
--------------------------
Dec 21 09:29:02 bcnas1 mountd[47163]: can't change attributes for /tank/somedataset/somesubdir
Dec 21 09:29:02 bcnas1 mountd[47163]: bad exports list line /tank/somedataset/somesubdir -maproot
--------------------------

The problem is a very bad error message. It should clearly say what rule was being violated. No rules seems to have been broken based on my analysis, so this is a problem.

The handbook, etc. tells me that the option "-alldirs" exists; it is not exactly what I want, but is just as secure in my case, since both the working dataset dir and the subdir use the same ip address, so it is acceptable in this case. And also it would not be acceptable for the other which already works, because the ip is not the same. But it seems to work without that option for that case.

But I don't see something saying that I am not allowed to share the directories separately. So I would say the error message should say what is wrong, ie. "You cannot export a directory that is already exported as a subdirectory to the same host/network. Consider using -alldirs instead. Offending line: ...... previous overlapping line: .....".

I call this a "serious" issue because it is a common thing to do, and works perfectly fine on Linux. If every "common thing" I do today takes as long as this single exports line changed, then I would never get any work done.

Possibly related, but he is only sharing 2 subdirectories, not the parent directory, and this PR is very old and still open:
http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/109911

Here is the forum thread about it (OP using 7.1 - Stable, and I am using 8-STABLE from Sept. 29 2011):
http://forums.freebsd.org/showthread.php?p=158451#post158451
>How-To-Repeat:
Edit /etc/exports adding 2 lines with the same share and host, except one is a subdirectory of the same share already shared in the first. (-maproot=root might be needed also). And then reload mountd.

eg.

/tank/somedataset1 -maproot=root 10.3.0.123
/tank/somedataset1/subdir -maproot=root 10.3.0.123


kill -HUP `cat /var/run/mountd.pid` 

>Fix:
I suggest a better error message in this case, such as:
----------------------
directory is already exported as a subdirectory to the same host/network; consider using -alldirs
Offending line: /tank/somedataset1/subdir -maproot=root 10.3.0.123
Previous overlapping line: /tank/somedataset1 -maproot=root 10.3.0.123
----------------------


But as fix to the exports file, use -alldirs
----------------------
/tank/somedataset1 -alldirs -maproot=root 10.3.0.123
----------------------


But neither fix would help the guy in the other PR 109911, because then he would be exporting /tmp  and all directories under it, instead of just the few he wants.

>Release-Note:
>Audit-Trail:
>Unformatted: