Subject: Re: [vserver] vdir @ NFS? Permission errors.
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Sat, 15 Mar 2014 21:02:08 +0100

On Sat, Mar 15, 2014 at 07:35:03PM +0100, Christian Schrötter wrote:
> Hi all,

> first of all let me explain my current Linux-VServer setup:

> * Raspberry Pi with Raspbian Wheezy.
> * Custom 3.2.51 kernel with 2.3.2.16 VS patches.
> * Everything stored on a single SDHC-card.

> Maybe it's a little bit strange but it's running smoothly 
> since 2012 :-)

Sounds normal to me :)

> Today I tried to move a VServer directory to a NFS share. 
> The NFS server is located on a Debian/armel machine with 
> ext4 fs. 

> I created /vservers.nfs for this purpose and mounted the 
> NFS share. 

What NFS version and how was it mounted?

> I selected a ClamAV/ClamSMTP guest for this test case.

>> vserver example stop
>> mv /vservers/example /vservers/example.bkp
>> cp -av /vservers/example.bkp /vservers.nfs/example
>> ln -s /vservers.nfs/example /vservers/example
>> vserver example start

> Nothing special here, everything is starting – looks fine! However:

>> clamav error: /var/spool/clamsmtp/clamsmtpd.xxx: Access denied. ERROR
>> clamav error: /var/spool/clamsmtp/clamsmtpd.xxx: lstat() failed: 
>> Permission denied. ERROR

> The directory [/vservers.nfs/example]/var/spool/clamsmtp is    
> owned by clamsmtp:clamsmtp (102:104) on the guest and only     
> readable by user/group (0750). 

> The user "clamav" is a member of the "clamsmtp" group. I've    
> double-checked the permissions but the user "clamav" can't     
> access the directory. 

> The only solution is a chmod(755). Maybe I missed something or 
> misconfigured one part. When moving back to the local stored   
> vdir everything works as expected.

Can you create a world writeable directory, and from
within the guest, create a file inside this directory
and list ownership for that on the server and from
inside the guest?

> * Is it even possible to use a NFS share?

Yes, has been working for quite some time here and
for other folks out there.

> * Any ideas how I could fix it?

Let's see what we have first ...

Thanks,
Herbert

> -- 
> With kind regards,
> Christian Schrötter