An NFS export combines a server-side filesystem path with client and access policy. On Linux, exportfs maintains /var/lib/nfs/etab from /etc/exports, eligible files under /etc/exports.d, or command-line updates. rpc.mountd is a daemon, not a third configuration file. Its MOUNT service matters to older protocol workflows; NFSv4 does not require that separate service for mounting.
Configuration text can differ from effective exports, but that is one possible cause of refusal, not a diagnosis from appearance alone. Check the intended server, protocol, export policy, identity and filesystem permissions. Also separate server durability from client caching: seeing a write succeed in an application is not by itself proof that the server has committed it to stable storage.
The file and the table
An /etc/exports entry associates a directory with clients and options. /srv/data 10.0.0.0/24(rw,sync,no_subtree_check,root_squash) illustrates one network; further client groups can have their own options. Hostnames, network ranges and netgroups have documented matching rules. exportfs -ra reconciles configured exports, but other exportfs actions or service management can also apply changes; it is not the sole activation mechanism.
showmount -e asks the server’s MNT service for advertised exports. Completeness depends on the implementation, and NFSv4-only servers may not expose that service. It is neither a complete effective-policy dump nor a proof that a client can access a share. The old four-versus-three-entry and NOENT story has no recovered raw test here; a missing export does not promise one universal error code.
What the options actually decide
The default export is read-only unless rw enables writes; filesystem permissions and other controls still apply. sync constrains server replies according to stable-storage requirements, while async permits replies before changes are committed and risks acknowledged data after a crash. Neither option removes client caching or makes every application write a synchronous durable commit. nfs-utils changed its default from async to sync after release 1.0.0.
root_squash maps request uid/gid zero to anonymous IDs; no_root_squash disables that protection. all_squash maps all IDs, and anonuid/anongid select the anonymous values. These do not authenticate a client or make an arbitrary public share safe. subtree_check has security as well as rename-reliability consequences; its default changed to no_subtree_check in nfs-utils 1.1.0. Evaluate the actual exported hierarchy and trust boundary.
Mounting, and the id mapping trap
The illustrative mount -t nfs -o vers=4.2 server:/srv/data /mnt/data requires a server supporting that protocol and an applicable export path. NFSv4 paths are relative to its exported namespace; fsid=0 identifies the export root, not a requirement to expose the host’s entire root filesystem. Hard mounts retry timed-out requests indefinitely; soft mounts can return EIO and risk data corruption. Neither choice proves a particular process state.
With AUTH_SYS, numeric request IDs participate in permission checks; lacking a server-side account name does not automatically squash a nonzero ID. NFSv4 owner-name mapping and stronger authentication introduce additional identity boundaries. Compare id, ls -ln, squash policy and mapping configuration. An owner displayed as 65534 or nobody can reflect deliberate squashing or mapping failure, so it is a symptom rather than a unique diagnosis.
When it breaks
If exports are stale, reconcile the intended configuration including /etc/exports.d and command-line overrides, then inspect the result. exportfs -ra changes server policy and may affect existing access; review it before use. A configuration mismatch is distinct from name resolution, reachability, protocol support or permission failures. Do not apply a policy refresh simply because one client operation failed.
An unavailable server can leave operations waiting and cause serious application disruption. It does not follow that every process touching a hard mount is permanently unkillable. The old thirty-five-second showmount failure is uncorroborated here and does not establish the mounted kernel client’s timeout. intr is ignored after Linux 2.6.25; changing to soft requires weighing data-integrity risk, not merely shortening a wait.
Check it quickly
The original commands remain held. They mix server checks, a localhost MNT query, a policy mutation and client observations without identifying separate hosts. No NFS service, RPC request, export refresh or mount was exercised:
exportfs -v
showmount -e localhost
exportfs -ra && exportfs -v
mount | grep 'type nfs'
id; ls -ln /mnt/data | head
Compare policy, not printed option order. This offline proposal supports one /srv/data IPv4-network export, using nfs-utils defaults since 1.1.0. It expands omitted defaults, rejects conflicting/unknown options and compares exact paths plus canonical networks. Hostnames, netgroups, wildcards, multiple security flavors and additional records are unsupported, never silently equivalent.
import ipaddress
import re
# A single-export, numeric IPv4-network fixture; not a general exports parser.
def export_policy(text):
match = re.fullmatch(
r"(/srv/data)[ \t\n]+([0-9./]+)\(([^()\s]+)\)\n", text)
if match is None or "/" not in match[2]:
raise ValueError("incomplete or unsupported export record")
client = ipaddress.IPv4Network(match[2], strict=True)
mask = match[2].split("/")[1]
if mask not in (str(client.prefixlen), str(client.netmask)):
raise ValueError("noncanonical prefix or unsupported hostmask")
groups = [
("ro", "rw"), ("sync", "async"), ("wdelay", "no_wdelay"),
("hide", "nohide"), ("no_subtree_check", "subtree_check"),
("secure", "insecure"), ("root_squash", "no_root_squash"),
("no_all_squash", "all_squash")]
defaults = {group[0]: group[0] for group in groups}
defaults.update(sec="sys", anonuid=65534, anongid=65534)
owner = {token: group[0] for group in groups for token in group}
seen = set()
for token in match[3].split(","):
if token in owner:
name, value = owner[token], token
elif token == "sec=sys":
name, value = "sec", "sys"
elif re.fullmatch(r"anon(?:uid|gid)=[0-9]+", token):
name, raw = token.split("=")
value = int(raw)
if not 0 <= value < 2**32 - 1:
raise ValueError("unsupported anonymous ID")
else:
raise ValueError(f"unsupported option: {token}")
if name in seen:
raise ValueError(f"duplicate or conflicting option: {name}")
seen.add(name)
defaults[name] = value
return match[1], str(client), defaults
def compare_exports(configured, effective, *, complete, returncode, stderr):
if (complete is not True or type(returncode) is not int or returncode != 0
or type(stderr) is not str or stderr != ""):
raise ValueError("failed, partial or unverified capture")
if export_policy(configured) != export_policy(effective):
raise ValueError("export path, client network or policy differs")
# Fabricated complete inputs exercise comparison only; no NFS command runs.
configured = "/srv/data 10.0.0.0/24(rw,sync,no_subtree_check,root_squash)\n"
effective = ("/srv/data\n\t10.0.0.0/255.255.255.0"
"(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,"
"root_squash,no_all_squash)\n")
compare_exports(configured, effective, complete=True, returncode=0, stderr="")
print("synthetic policy comparison passed; live NFS remains untested")
Expect only a synthetic comparison message. For live evidence, require complete successful captures from the same identified server, including all configuration inputs and intended overrides; never manufacture completeness from filtered output. Unsupported configurations require separate review. No capture, RPC, mount or access test ran. Localhost discovery and ownership listings prove no access; the complete authorized server/client exercise and any policy change remain held.
Sources
- exports(5), export syntax, squash options, sync/async and the subtree_check defaults, checked 2026-09-16.
- exportfs(8), the master export table in /var/lib/nfs/etab and how exportfs maintains it, checked 2026-09-16.
- nfs(5), mount options including hard/soft, timeo and the obsolescence of intr, checked 2026-09-16.
- showmount(8), querying the server’s export list from a client, checked 2026-09-16.
