2

I'm trying to mount an NFS share from a Proxmox 5 host and having issues. I have the following two machines:

192.168.1.3    proxmox debian box (nfs-host)
192.168.1.31   ubuntu 16.04 (nfs-client)

Permissions of /mnt/storage (NFS client):

drwxrwxrwx 11 nobody nogroup 4096 Oct  7 10:28 storage

Content of /etc/exports (NFS host):

/mnt/storage 192.168.1.31(rw,sync,no_subtree_check)

Output of showmount -e 192.168.1.3 (NFS client):

Export list for 192.168.1.3:
/mnt/storage 192.168.1.31

Trying to mount from the client fails:

me@client:/mnt/storage$ sudo mount 192.168.1.3:/mnt/storage /mnt/storage
mount.nfs: access denied by server while mounting 192.168.1.3:/mnt/storage

I ran exportfs -ra and restarted the nfs kernel server but still no joy. I also tried all the suggestions in the question mount.nfs: access denied by server while mounting on Ubuntu machines?, but nothing has worked for me. There were only one or two answers at the bottom that had to do with docker and another one that had typo'd IPs, both didn't pertain to me.

I can ping both hosts and both hosts can access the internet and see each other so I don't think it's a network issue.

Now I am seeing these errors inside /var/log/messages on the host:

Oct  7 10:06:36 pve kernel: [44667.325940] audit: type=1400 audit(1507385196.790:23): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default-cgns" name="/mnt/storage/" pid=15053 comm="mount.nfs4" fstype="nfs4" srcname="192.168.1.3:/export/storage"
Oct  7 10:07:05 pve kernel: [44696.096558] audit: type=1400 audit(1507385225.559:24): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default-cgns" name="/mnt/storage/" pid=15112 comm="mount.nfs" fstype="nfs" srcname="192.168.1.3:/export/storage"

As requested, here are the contents of all files inside /etc/apparmor.d/lxc/ containing the word mount:

root@host:/etc/apparmor.d/lxc# ll
total 24
drwxr-xr-x 2 root root 4096 Oct  6 13:24 .
drwxr-xr-x 9 root root 4096 Oct  6 13:24 ..
-rw-r--r-- 1 root root  479 Jun 30 05:01 lxc-default
-rw-r--r-- 1 root root  528 Jun 30 05:01 lxc-default-cgns
-rw-r--r-- 1 root root  544 Jun 30 05:01 lxc-default-with-mounting
-rw-r--r-- 1 root root  527 Jun 30 05:01 lxc-default-with-nesting

root@host:/etc/apparmor.d/lxc# cat lxc-default
# Do not load this file.  Rather, load /etc/apparmor.d/lxc-containers, which
# will source all profiles under /etc/apparmor.d/lxc

profile lxc-container-default flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/lxc/container-base>

  # the container may never be allowed to mount devpts.  If it does, it
  # will remount the host's devpts.  We could allow it to do it with
  # the newinstance option (but, right now, we don't).
  deny mount fstype=devpts,
}



root@host:/etc/apparmor.d/lxc# cat lxc-default-cgns
# Do not load this file.  Rather, load /etc/apparmor.d/lxc-containers, which
# will source all profiles under /etc/apparmor.d/lxc

profile lxc-container-default-cgns flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/lxc/container-base>

  # the container may never be allowed to mount devpts.  If it does, it
  # will remount the host's devpts.  We could allow it to do it with
  # the newinstance option (but, right now, we don't).
  deny mount fstype=devpts,
  mount fstype=cgroup -> /sys/fs/cgroup/**,
}



root@host:/etc/apparmor.d/lxc# cat lxc-default-with-mounting
# Do not load this file.  Rather, load /etc/apparmor.d/lxc-containers, which
# will source all profiles under /etc/apparmor.d/lxc

profile lxc-container-default-with-mounting flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/lxc/container-base>

# allow standard blockdevtypes.
# The concern here is in-kernel superblock parsers bringing down the
# host with bad data.  However, we continue to disallow proc, sys, securityfs,
# etc to nonstandard locations.
  mount fstype=ext*,
  mount fstype=xfs,
  mount fstype=btrfs,
}



root@host:/etc/apparmor.d/lxc# cat lxc-default-with-nesting
# Do not load this file.  Rather, load /etc/apparmor.d/lxc-containers, which
# will source all profiles under /etc/apparmor.d/lxc

profile lxc-container-default-with-nesting flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/lxc/container-base>
  #include <abstractions/lxc/start-container>

  deny /dev/.lxc/proc/** rw,
  deny /dev/.lxc/sys/** rw,
  mount fstype=proc -> /var/cache/lxc/**,
  mount fstype=sysfs -> /var/cache/lxc/**,
  mount options=(rw,bind),
  mount fstype=cgroup -> /sys/fs/cgroup/**,
}
myrdd
  • 419
  • 2
  • 4
  • 15
ghostbroker
  • 31
  • 1
  • 1
  • 6
  • Please include the error messages written to the log file in `/var/log` on the _server_. – roaima Oct 07 '17 at 15:18
  • Please also clarify which suggestions from the [excellent thread you've cross referenced](https://unix.stackexchange.com/questions/106122/mount-nfs-access-denied-by-server-while-mounting-on-ubuntu-machines) didn't work for you, or that you just haven't tried. The phrase "_I also tried a few other options_" isn't specific enough. – roaima Oct 07 '17 at 15:22
  • 1
    @roaima I have updated my post with the error logs. I tried at least the top 3 answers from that thread. There were some near the bottom that didn't pertain to me and I did not try those. – ghostbroker Oct 07 '17 at 15:26
  • Can you show us any `mount` rules (and associated comment lines) in the files in your host's `/etc/apparmor.d/lxc` directory? – Mark Plotnick Oct 07 '17 at 15:35
  • @MarkPlotnick I have updated the question with the lxc config files in that directory. – ghostbroker Oct 07 '17 at 15:41

5 Answers5

1

It looks like AppArmour is kicking in on the server. See the log file messages, which include this phrase:

apparmor="DENIED"

Unfortunately I can only advise you how to switch it off, which I wouldn't recommend. I'll see if I can find some instructions for mediating it...

roaima
  • 107,089
  • 14
  • 139
  • 261
1

I made the following configuration changes to /etc/apparmor.d/lxc-default-cgns on the proxmox host and I was able to successfully mount the drive.

/etc/apparmor.d/lxc-default-cgns

  mount fstype=nfs*,
  mount options=(rw, bind, ro),
roaima
  • 107,089
  • 14
  • 139
  • 261
ghostbroker
  • 31
  • 1
  • 1
  • 6
1

If you dealing with Proxmox lxc Please try to consider ,there is an option in lxc Feature there is an NFS option enter image description here

Zaman Oof
  • 113
  • 4
  • Welcome to the site, and thank you for your contribution. Please note however that the log file extracts in the question point at `apparmor` being involved in the problem. Perhaps you could add some explanation on how your solution would address that point. – AdminBee Sep 30 '21 at 12:02
  • @AdminBee bcs i was facing permission issue when try to mount nfs, look like the log mentioned apparmor so i think the solution not need to be that complex "apparmor" bcs just host (proxmox) option change – Zaman Oof Sep 30 '21 at 15:48
0

In the /etc/export file on server

/Path/to/export 192.168.1.0/24(rw,sync,fsid=0,no_root_squash,crossmnt,no_subtree_check,no_acl)
AdminBee
  • 21,637
  • 21
  • 47
  • 71
Vinodkumar Mandalapu
  • 1
  • 1
  • 2
    Welcome to the site, and thank you for your contribution. Would you mind editing your post to include some information on _why_ your approach with the export options solves the OPs problem, and how you concluded from the OPs description what the underlying problem is? That way, it is usable to a wider range of audiences. – AdminBee May 07 '20 at 07:48
0

Is your container running in "unprivileged" mode? If it is, NFS and Samba functionality is disabled. To change the mode, you will need to stop the container, back it up, then restore it in "privileged" mode. Privileged mode enables the "Features" tab within the "Options" menu. In the "Features" menu, you can enable NFS (and/or Samba).

Alan
  • 1