From d3b79d924564b5186eed044a1b08d41a839197ba Mon Sep 17 00:00:00 2001 From: spektr Date: Fri, 30 Oct 2026 15:33:32 +0100 Subject: [PATCH] =?UTF-8?q?CT-101=20Samba:=20ganesha.conf=20f=C3=BCr=20Gan?= =?UTF-8?q?esha=206.5=20im=20unprivileged=20LXC=20korrigieren?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Allow_Set_IO_Flusher_Fail = true: PR_SET_IO_FLUSHER braucht CAP_SYS_ADMIN in der init-userns (im Guest nicht vorhanden) und war FATAL - NFSv4 RecoveryRoot = /var/lib/nfs-ganesha (rw-State-Volume des Quadlets); der Default /var/lib/nfs/ganesha ist im ReadOnly-Container nicht schreibbar - AccessType -> Access_Type (Ganesha 6.5, sonst "Unknown parameter") - per-export Client-Liste entfernt: Clients/clients/CLIENT-Block werden vom 6.5-Parser abgelehnt; die Client-Beschränkung (nur 10.0.0.90) wird durch die nftables-Policy durchgesetzt (2049 nur von 10.0.0.90, default drop) - im Image verifiziert: strict parse (-x) clean, Listener auf *:2049 OK Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .../roles/samba_nfs/templates/ganesha.conf.j2 | 21 ++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/templates/ganesha.conf.j2 b/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/templates/ganesha.conf.j2 index 07c3dc7..ac0ff4b 100644 --- a/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/templates/ganesha.conf.j2 +++ b/proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/templates/ganesha.conf.j2 @@ -6,22 +6,37 @@ NFS_CORE_PARAM { Protocols = 4; Enable_NLM = false; Enable_RQUOTA = false; + # Unprivileged LXC: PR_SET_IO_FLUSHER needs CAP_SYS_ADMIN in the init user + # namespace, which a guest root does not have; allow the failure (verified + # with ganesha.nfsd in the image on 2026-10-30). + Allow_Set_IO_Flusher_Fail = true; +} + +NFSv4 { + # The recovery dir must live on the rw state volume (the Quadlet mounts + # /var/lib/ghostnet/samba/ganesha at /var/lib/nfs-ganesha); the compiled-in + # default /var/lib/nfs/ganesha is read-only inside the container. + RecoveryRoot = /var/lib/nfs-ganesha; } EXPORT_DEFAULTS { - AccessType = None; + Access_Type = None; } EXPORT { Export_Id = {{ samba_nfs_export_id }}; Path = {{ samba_nfs_export_path }}; Pseudo = {{ samba_nfs_export_path }}; - AccessType = RW; + Access_Type = RW; Squash = rootid; SecType = sys; Protocols = 4; Transports = TCP,UDP; - Clients = {{ samba_nfs_client_ipv4 }}; + # Client restriction ("only ghostnet-ki 10.0.0.90", GNAI-017 section 4.1) is + # enforced by the nftables policy (port 2049 only from 10.0.0.90, default + # drop; samba_firewall, asserted by verify-production.yml). Ganesha 6.5 has + # no valid per-export client-list parameter (Clients/clients/CLIENT block + # are all rejected by the parser, verified 2026-10-30). FSAL { Name = VFS; }