NFS shares a remote directory over the network

Wed, 23 Jun 2027 00:00:00 +0000

An NFS export combines a server-side filesystem path with client and access policy. On Linux, exportfs maintains /var/lib/nfs/etab from /etc/exports, eligible files under /etc/exports.d, or command-line updates. rpc.mountd is a daemon, not a third configuration file. Its MOUNT service matters to older protocol workflows; NFSv4 does not require that separate service for mounting.

Configuration text can differ from effective exports, but that is one possible cause of refusal, not a diagnosis from appearance alone. Check the intended server, protocol, export policy, identity and filesystem permissions. Also separate server durability from client caching: seeing a write succeed in an application is not by itself proof that the server has committed it to stable storage.

The file and the table

An /etc/exports entry associates a directory with clients and options. /srv/data 10.0.0.0/24(rw,sync,no_subtree_check,root_squash) illustrates one network; further client groups can have their own options. Hostnames, network ranges and netgroups have documented matching rules. exportfs -ra reconciles configured exports, but other exportfs actions or service management can also apply changes; it is not the sole activation mechanism.

showmount -e asks the server’s MNT service for advertised exports. Completeness depends on the implementation, and NFSv4-only servers may not expose that service. It is neither a complete effective-policy dump nor a proof that a client can access a share. The old four-versus-three-entry and NOENT story has no recovered raw test here; a missing export does not promise one universal error code.

What the options actually decide

The default export is read-only unless rw enables writes; filesystem permissions and other controls still apply. sync constrains server replies according to stable-storage requirements, while async permits replies before changes are committed and risks acknowledged data after a crash. Neither option removes client caching or makes every application write a synchronous durable commit. nfs-utils changed its default from async to sync after release 1.0.0.

root_squash maps request uid/gid zero to anonymous IDs; no_root_squash disables that protection. all_squash maps all IDs, and anonuid/anongid select the anonymous values. These do not authenticate a client or make an arbitrary public share safe. subtree_check has security as well as rename-reliability consequences; its default changed to no_subtree_check in nfs-utils 1.1.0. Evaluate the actual exported hierarchy and trust boundary.

Mounting, and the id mapping trap

The illustrative mount -t nfs -o vers=4.2 server:/srv/data /mnt/data requires a server supporting that protocol and an applicable export path. NFSv4 paths are relative to its exported namespace; fsid=0 identifies the export root, not a requirement to expose the host’s entire root filesystem. Hard mounts retry timed-out requests indefinitely; soft mounts can return EIO and risk data corruption. Neither choice proves a particular process state.

With AUTH_SYS, numeric request IDs participate in permission checks; lacking a server-side account name does not automatically squash a nonzero ID. NFSv4 owner-name mapping and stronger authentication introduce additional identity boundaries. Compare id, ls -ln, squash policy and mapping configuration. An owner displayed as 65534 or nobody can reflect deliberate squashing or mapping failure, so it is a symptom rather than a unique diagnosis.

When it breaks

If exports are stale, reconcile the intended configuration including /etc/exports.d and command-line overrides, then inspect the result. exportfs -ra changes server policy and may affect existing access; review it before use. A configuration mismatch is distinct from name resolution, reachability, protocol support or permission failures. Do not apply a policy refresh simply because one client operation failed.

An unavailable server can leave operations waiting and cause serious application disruption. It does not follow that every process touching a hard mount is permanently unkillable. The old thirty-five-second showmount failure is uncorroborated here and does not establish the mounted kernel client’s timeout. intr is ignored after Linux 2.6.25; changing to soft requires weighing data-integrity risk, not merely shortening a wait.

NFS access crosses policy — mechanism diagram.

Check it quickly

The original commands remain held. They mix server checks, a localhost MNT query, a policy mutation and client observations without identifying separate hosts. No NFS service, RPC request, export refresh or mount was exercised:

exportfs -v
showmount -e localhost
exportfs -ra && exportfs -v
mount | grep 'type nfs'
id; ls -ln /mnt/data | head

Compare policy, not printed option order. This offline proposal supports one /srv/data IPv4-network export, using nfs-utils defaults since 1.1.0. It expands omitted defaults, rejects conflicting/unknown options and compares exact paths plus canonical networks. Hostnames, netgroups, wildcards, multiple security flavors and additional records are unsupported, never silently equivalent.

import ipaddress
import re

# A single-export, numeric IPv4-network fixture; not a general exports parser.
def export_policy(text):
 match = re.fullmatch(
 r"(/srv/data)[ \t\n]+([0-9./]+)\(([^()\s]+)\)\n", text)
 if match is None or "/" not in match[2]:
 raise ValueError("incomplete or unsupported export record")
 client = ipaddress.IPv4Network(match[2], strict=True)
 mask = match[2].split("/")[1]
 if mask not in (str(client.prefixlen), str(client.netmask)):
 raise ValueError("noncanonical prefix or unsupported hostmask")
 groups = [
 ("ro", "rw"), ("sync", "async"), ("wdelay", "no_wdelay"),
 ("hide", "nohide"), ("no_subtree_check", "subtree_check"),
 ("secure", "insecure"), ("root_squash", "no_root_squash"),
 ("no_all_squash", "all_squash")]
 defaults = {group[0]: group[0] for group in groups}
 defaults.update(sec="sys", anonuid=65534, anongid=65534)
 owner = {token: group[0] for group in groups for token in group}
 seen = set()
 for token in match[3].split(","):
 if token in owner:
 name, value = owner[token], token
 elif token == "sec=sys":
 name, value = "sec", "sys"
 elif re.fullmatch(r"anon(?:uid|gid)=[0-9]+", token):
 name, raw = token.split("=")
 value = int(raw)
 if not 0 <= value < 2**32 - 1:
 raise ValueError("unsupported anonymous ID")
 else:
 raise ValueError(f"unsupported option: {token}")
 if name in seen:
 raise ValueError(f"duplicate or conflicting option: {name}")
 seen.add(name)
 defaults[name] = value
 return match[1], str(client), defaults

def compare_exports(configured, effective, *, complete, returncode, stderr):
 if (complete is not True or type(returncode) is not int or returncode != 0
 or type(stderr) is not str or stderr != ""):
 raise ValueError("failed, partial or unverified capture")
 if export_policy(configured) != export_policy(effective):
 raise ValueError("export path, client network or policy differs")

# Fabricated complete inputs exercise comparison only; no NFS command runs.
configured = "/srv/data 10.0.0.0/24(rw,sync,no_subtree_check,root_squash)\n"
effective = ("/srv/data\n\t10.0.0.0/255.255.255.0"
 "(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,"
 "root_squash,no_all_squash)\n")
compare_exports(configured, effective, complete=True, returncode=0, stderr="")
print("synthetic policy comparison passed; live NFS remains untested")

Expect only a synthetic comparison message. For live evidence, require complete successful captures from the same identified server, including all configuration inputs and intended overrides; never manufacture completeness from filtered output. Unsupported configurations require separate review. No capture, RPC, mount or access test ran. Localhost discovery and ownership listings prove no access; the complete authorized server/client exercise and any policy change remain held.

Sources

exports(5), export syntax, squash options, sync/async and the subtree_check defaults, checked 2026-09-16.
exportfs(8), the master export table in /var/lib/nfs/etab and how exportfs maintains it, checked 2026-09-16.
nfs(5), mount options including hard/soft, timeo and the obsolescence of intr, checked 2026-09-16.
showmount(8), querying the server’s export list from a client, checked 2026-09-16.