Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've just reinstalled my iMac on my home network, and have mounted the user home directories via a NFS share (hosted on an Ubuntu server).

The problem I have is that when I use sudo, I get permission denied to my own home directory.

My UID is 501 and I'm allowed to use sudo by virtue of me being a member of the Admin group (GID 80).

On the Ubuntu server, I've configured my home directory as follows:

Ubuntu# ls -ln | grep bryan
drwxrwx--- 35 501 80 4096 2012-01-27 14:09 bryan

Which translates correctly on the mac:

iMac$ ls -l | grep bryan
drwxrwx---  35 bryan    admin   4.0K 27 Jan 14:09 bryan/

As root is also a member of admin (GID 80), I'd have expected sudo to have allowed access to my home directory, but as you can see below, this isn't the case.

iMac$ whoami
bryan
iMac$ sudo bash
bash: /Volumes/home/bryan/.bashrc: Permission denied
iMac# whoami
root
iMac# cd /Volumes/home/bryan/
bash: cd: /Volumes/home/bryan/: Permission denied

Just to confirm, the following is the relevant part of output from dscacheutil -q group on my iMac:

name: admin
password: *
gid: 80
users: root bryan 

What can I do to enable access to my home directory on the iMac when using sudo?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

When you use sudo, you are switching to the root user (uid 0) – you lose your brian UID and the admin group. (sudo id will show you the exact values.)

Since previous NFS versions (v3 and older) performed all security checks on the client side only, there is a safeguard built in to protect against dishonest clients – when the client says your UID is 0, you do not receive root permissions – instead, the NFS server sees you as the user nobody.

To disable this safeguard, edit the server's /etc/exports to have the no_root_squash option, then rerun exportfs -ra and remount the share on all clients.


When testing NFS permissions, it is useful to have a world-writable directory on your share. For example, on Ubuntu, sudo mkdir /home/temp; sudo chmod a+rwx /home/temp. Then on OS X you could run sudo touch /Volumes/home/temp/testfile and instantly see what owner the newly created file has.

share|improve this answer
    
but doesn't the fact that root belongs in the group admin (GID 80) not grant permission, or does NFS not not take group permissions into account? –  Bryan Jan 28 '12 at 14:45
    
@Bryan: I'm not sure the groups on client host matter, in the case of root_squash. –  grawity Jan 28 '12 at 14:47
    
Ah okay, thanks. Security isn't really an issue on my home network, so I'll add the no_root_squash option. –  Bryan Jan 28 '12 at 14:52
    
Works perfectly. Thanks again. –  Bryan Jan 28 '12 at 14:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.