Received-SPF: pass (google.com: best guess record for domain of linux-nfs-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8;
 format=flowed
Content-Transfer-Encoding: 7bit
Date:   Wed, 22 Jan 2020 10:22:16 +0100
From:   Felix Rubio <felix@kngnt.org>
To:     linux-nfs@vger.kernel.org
Subject: kerberized NFSv4 client reporting operation not permitted when
 mounting with sec=sys
Message-ID: <0593b4af8ca3fafbec59655bbb39d2b4@kngnt.org>
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk

Hi everybody,

I have a kerberized NFSv4 server that is exporting a mountpoint:

     /home 10.0.0.0/8(rw,no_subtree_check,sec=krb5:krb5i:krb5p)

if I mount that export with this command on the client, it works as 
expected:

     /sbin/mount.nfs4 NFS.domain:/home /network/home -o 
_netdev,noatime,hard,sec=krb5

However, if I modify the export to be

     /home 10.0.0.0/8(rw,no_subtree_check,sec=sys:krb5:krb5i:krb5p)

and I mount that export with sec=sys, as

     /sbin/mount.nfs4 NFS.domain:/home /network/home -o 
_netdev,noatime,hard,sec=sys

I get the following error:

     mount.nfs4: timeout set for Fri Jan 17 14:11:32 2020
     mount.nfs4: trying text-based options 
'hard,sec=sys,vers=4.1,addr=10.2.2.9,clientaddr=10.2.0.12'
     mount.nfs4: mount(2): Operation not permitted
     mount.nfs4: Operation not permitted

What might be the reason for this behavior?

-- 
Felix Rubio
"Don't believe what you're told. Double check."