Scope preserved NFS no_root_squash warning to image staging export

[sgennadi]

Summary
When STORAGE_rebuild_nfs_exports != yes, configureNFS() currently warns if no_root_squash appears anywhere in /etc/exports.

That produces a false warning when /images/dev is already configured correctly with all_squash,anonuid=…,anongid=…, but an unrelated read-only export (for example a mounted Linux ISO tree) intentionally uses no_root_squash.
Change
Add nfsDevExportHasNoRootSquash() and scope the check to exactly:

${STORAGE_image_share_path}/dev

The warning still appears when the image staging export itself uses no_root_squash, but unrelated exports no longer trigger it.
Regression coverage
tests/nfs-preserved-exports-warning.test.sh covers:

• safe /images/dev plus an ISO export using no_root_squash -> no warning condition
• /images/dev using no_root_squash -> warning condition
• similarly named paths and commented lines -> ignored
• configureNFS() actually uses the scoped helper
  Reproduction
  Example preserved exports:

/images *(ro,sync,no_wdelay,subtree_check,insecure_locks,all_squash,anonuid=1002,anongid=1002,fsid=0)
/images/dev *(rw,async,no_wdelay,subtree_check,all_squash,anonuid=1002,anongid=1002,fsid=1)
/var/www/html/ISO/Ubuntu/26.04X64/ *(ro,sync,no_wdelay,insecure_locks,no_root_squash,insecure)

The existing global grep -q “no_root_squash” “$nfsconfig” reports that captures land as root even though the /images/dev export is already ownership-safe.

diff --git a/lib/common/functions.sh b/lib/common/functions.sh
— a/lib/common/functions.sh
+++ b/lib/common/functions.sh
@@ -1,3 +1,14 @@
+nfsDevExportHasNoRootSquash() {

• local config=“$1”
• local devpath=“${STORAGE_image_share_path%/}/dev”
• [[ -f “$config” ]] || return 1
• awk -v path=“$devpath” ’

•    $1 == path && /(^|[,(])no_root_squash([,)]|$)/ {
  

•        found=1
  

•    }
  

•    END { exit !found }
  

• ’ “$config”
  +}
  configureNFS() {
  dots “Setting up NFS configuration file”
  if [[ -f “/etc/nfs.conf” ]]; then
  @@ -25,7 +36,7 @@
  dots “Setting up exports file”
  if [[ ${STORAGE_rebuild_nfs_exports} != yes ]]; then
  echo “Skipped”

•    if [[ -f "$nfsconfig" ]] && grep -q "no_root_squash" "$nfsconfig"; then
  

•    if nfsDevExportHasNoRootSquash "$nfsconfig"; then
         echo
         echo "  ** WARNING: ${nfsconfig} still exports with no_root_squash."
         echo "  ** Captures land as root, so moving the image out of"
  

diff --git a/tests/nfs-preserved-exports-warning.test.sh b/tests/nfs-preserved-exports-warning.test.sh
new file mode 100755
— /dev/null
+++ b/tests/nfs-preserved-exports-warning.test.sh
@@ -0,0 +1,89 @@
+#!/bin/bash
+#
+# The preserved-exports warning must only inspect the image staging export.
+# An unrelated read-only ISO export may intentionally use no_root_squash and
+# must not make FOG claim that /images/dev will capture files as root.
+#
+# Usage: bash tests/nfs-preserved-exports-warning.test.sh
+
+root=$(cd – “$(dirname – “${BASH_SOURCE[0]}”)/…” && pwd)
+functions=“$root/lib/common/functions.sh”
+
+pass=0
+fail=0
+
+pass_case() {

• pass=$((pass + 1))
  +}

+fail_case() {

• fail=$((fail + 1))
• printf ’ FAIL %s\n’ “$1”
  +}

+if [[ ! -r $functions ]]; then

• echo “FAIL: cannot read $functions” >&2
• exit 1
  +fi

+# Load only the helper under test. Sourcing all of functions.sh would make
+# this small unit test depend on the installer’s global setup.
+helper=$(

• awk ’

•    /^nfsDevExportHasNoRootSquash\(\) \{/ { emit=1 }
  

•    emit { print }
  

•    emit && /^}/ { exit }
  

• ’ “$functions”
  +)
  +if [[ -z $helper ]]; then
• echo “FAIL: nfsDevExportHasNoRootSquash() not found” >&2
• exit 1
  +fi
  +eval “$helper”

+tmp=$(mktemp)
+trap ‘rm -f “$tmp”’ EXIT
+STORAGE_image_share_path=/images
+
+cat > “$tmp” <<‘EOF_CASE’
+/images *(ro,sync,all_squash,anonuid=1002,anongid=1002,fsid=0)
+/images/dev *(rw,async,all_squash,anonuid=1002,anongid=1002,fsid=1)
+/var/www/html/ISO/Ubuntu/26.04X64/ *(ro,sync,no_root_squash,insecure)
+EOF_CASE
+if nfsDevExportHasNoRootSquash “$tmp”; then

• fail_case “unrelated ISO no_root_squash does not trigger warning”
  +else
• pass_case
  +fi

+cat > “$tmp” <<‘EOF_CASE’
+/images *(ro,sync,all_squash,anonuid=1002,anongid=1002,fsid=0)
+/images/dev *(rw,async,no_root_squash,fsid=1)
+EOF_CASE
+if nfsDevExportHasNoRootSquash “$tmp”; then

• pass_case
  +else
• fail_case “/images/dev no_root_squash triggers warning”
  +fi

+cat > “$tmp” <<‘EOF_CASE’
+/images/dev *(rw,async,all_squash,anonuid=1002,anongid=1002,fsid=1)
+/images-old/dev *(rw,async,no_root_squash,fsid=2)
+# /images/dev *(rw,no_root_squash)
+EOF_CASE
+if nfsDevExportHasNoRootSquash “$tmp”; then

• fail_case “prefix paths and comments do not trigger warning”
  +else
• pass_case
  +fi

+if ! grep -q ‘if nfsDevExportHasNoRootSquash “$nfsconfig”; then’ “$functions”; then

• echo " FAIL configureNFS does not use nfsDevExportHasNoRootSquash" >&2
• fail=$((fail + 1))
  +else
• pass=$((pass + 1))
  +fi

+echo “ok $pass”
+[[ $fail -eq 0 ]] || { echo “FAIL ($fail of $((pass + fail)))” >&2; exit 1; }
+exit 0

[Tom Elliott]

@sgennadi Thanks for this, and for the detail. You were right: the check matched no_root_squash anywhere in /etc/exports, not just on the /images/dev export.

It is fixed now, much the way you proposed. The new nfsDevExportHasNoRootSquash() checks only the <share>/dev export. It ignores comments, other exports, and look-alike paths such as /images/dev2. Your ISO export with no_root_squash no longer triggers the warning.

• Issue: https://github.com/FOGProject/fogproject/issues/1988
• 1.6 (working-1.6): https://github.com/FOGProject/fogproject/pull/1989 (merged)
• 1.6 RC: https://github.com/FOGProject/fogproject/pull/1990 (merged)
• 1.5 dev-branch: https://github.com/FOGProject/fogproject/pull/1991 (merged)

To get it now, pull dev-branch (1.5) or rc-1.6.0 (1.6) and re-run the installer. It reaches the 1.5 stable branch with the monthly roll-up on November 11th.

The warning was only a message, so your exports were never changed. If /images/dev is already all_squash, you can ignore it until then.