iMac user can't access NFS mounted home directories with sudo

Question

I've just reinstalled my iMac on my home network, and have mounted the user home directories via a NFS share (hosted on an Ubuntu server).

The problem I have is that when I use sudo, I get permission denied to my own home directory.

My UID is 501 and I'm allowed to use sudo by virtue of me being a member of the Admin group (GID 80).

On the Ubuntu server, I've configured my home directory as follows:

Ubuntu# ls -ln | grep bryan
drwxrwx--- 35 501 80 4096 2012-01-27 14:09 bryan

Which translates correctly on the mac:

iMac$ ls -l | grep bryan
drwxrwx---  35 bryan    admin   4.0K 27 Jan 14:09 bryan/

As root is also a member of admin (GID 80), I'd have expected sudo to have allowed access to my home directory, but as you can see below, this isn't the case.

iMac$ whoami
bryan
iMac$ sudo bash
bash: /Volumes/home/bryan/.bashrc: Permission denied
iMac# whoami
root
iMac# cd /Volumes/home/bryan/
bash: cd: /Volumes/home/bryan/: Permission denied

Just to confirm, the following is the relevant part of output from dscacheutil -q group on my iMac:

name: admin
password: *
gid: 80
users: root bryan 

What can I do to enable access to my home directory on the iMac when using sudo?

Answer 1

When you use sudo, you are switching to the root user (uid 0) – you lose your brian UID and the admin group. (sudo id will show you the exact values.)

Since previous NFS versions (v3 and older) performed all security checks on the client side only, there is a safeguard built in to protect against dishonest clients – when the client says your UID is 0, you do not receive root permissions – instead, the NFS server sees you as the user nobody.

To disable this safeguard, edit the server's /etc/exports to have the no_root_squash option, then rerun exportfs -ra and remount the share on all clients.

---

When testing NFS permissions, it is useful to have a world-writable directory on your share. For example, on Ubuntu, sudo mkdir /home/temp; sudo chmod a+rwx /home/temp. Then on OS X you could run sudo touch /Volumes/home/temp/testfile and instantly see what owner the newly created file has.