From owner-freebsd-stable@FreeBSD.ORG  Thu Apr 15 14:28:14 2010
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 9C262106564A;
	Thu, 15 Apr 2010 14:28:14 +0000 (UTC)
	(envelope-from auryn@zirakzigil.org)
Received: from mail.zirakzigil.org (mail.zirakzigil.org [82.63.178.63])
	by mx1.freebsd.org (Postfix) with ESMTP id 4359B8FC17;
	Thu, 15 Apr 2010 14:28:14 +0000 (UTC)
Received: from localhost (unknown [192.168.1.2])
	by mail.zirakzigil.org (Postfix) with ESMTP id 5A93F9629F;
	Thu, 15 Apr 2010 16:28:12 +0200 (CEST)
X-Virus-Scanned: amavisd-new at zirakzigil.org
Received: from mail.zirakzigil.org ([192.168.1.2])
	by localhost (ext.zirakzigil.org [192.168.1.2]) (amavisd-new,
	port 10024)
	with ESMTP id 5f2EfKmIA5V1; Thu, 15 Apr 2010 16:28:09 +0200 (CEST)
Received: from aurynmob2.giulioferro.it (unknown [192.168.1.2])
	(Authenticated sender: auryn@zirakzigil.org)
	by mail.zirakzigil.org (Postfix) with ESMTPA id B721396295;
	Thu, 15 Apr 2010 16:28:09 +0200 (CEST)
Message-ID: <4BC72276.6080003@zirakzigil.org>
Date: Thu, 15 Apr 2010 16:28:06 +0200
From: Giulio Ferro <auryn@zirakzigil.org>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD amd64; en-US;
	rv:1.9.1.7) Gecko/20100223 Thunderbird/3.0.1
MIME-Version: 1.0
To: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org>, 
	freebsd-stable@freebsd.org
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: 
Subject: NFS permission strangeness
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 15 Apr 2010 14:28:14 -0000

Here's the setup:
server : NFS server machine (fb 8 stable amd64 )
client : NFS client machine (as above)

server and client are both sharing the same permission database through 
ldap:

Both have in /etc/nsswitch.conf
...
group: files ldap
...
passwd: files ldap

This issue isn't related to ldap, however. I get the same result if I 
manually add
groups to /etc/group file (read on)

Let's suppose I have user "giulio" configured in my system.
giulio is also part (-G) of groups:
group1, group2, group3, ... , group10

server is exporting the directory
/path/to/root (on zfs)

the directory
/path/to/root/dir/etc/subdir1
has permission 770 and group ownership "group3"

I login as user "giulio" on server I can enter "subdir1" directory, 
since I'm
member of group "group3"

I then login as user "giulio" on client, and I can do the same (as 
expected).


When groups are more than a few, however, I get this strange behavior:

let's suppose the directory:
/path/to/root/dir/etc/subdir2
has permission 770 and group ownership "group10"

What happens is that I can access "subdir2" on the server machine when I
login as "giulio", but when I try to access that same dir on the client 
machine
I get:
$ cd /path/to/root/dir/etc
(ok)
$ cd subdir2
subdir2/: Permission denied.

if I issue this command on the client:
$ id
I get :
uid=1000 (giulio), gid=1000 (giuliogroup), groups=group1(1001), 
group2(1002),
group3(1003),...,group10(1010)

So there shouldn't really be any reason for me not to be able to access 
that dir...

Any idea?