Consider the following setup:
An NFS server exports the directory /srv/nfsv4 to one client. It is exported with the option "fsid=0" for use with NFSv4.
/srv/nfsv4 192.168.0.10/24(ro,sync,secure,root_squash,subtree_check,fsid=0)
The bind-mounted directory within it, foo, is exported as well. Client 192.168.0.10 can successfully mount and write to it.
/srv/nfsv4/foo 192.168.0.10/24(rw,sync,secure,root_squash,subtree_check)
"foo" has multiple subdirectories. While client 192.168.0.10 should have full read-write access to all of them, another client, 192.168.0.20, should only see a specific subset of these directories. Everything else should not only be read-only, but not mountable at all.
At first, I did it like this:
/srv/nfsv4 192.168.0.10/24(ro,sync,secure,root_squash,subtree_check,fsid=0) \
192.168.0.20/24(ro,sync,secure,root_squash,subtree_check,fsid=0)
/srv/nfsv4/foo 192.168.0.10/24(rw,sync,secure,root_squash,subtree_check) \
192.168.0.20/24(ro,sync,secure,root_squash,subtree_check)
/srv/nfsv4/foo/dir1 192.168.0.20/24(rw,sync,secure,root_squash,subtree_check)
/srv/nfsv4/foo/dir2 192.168.0.20/24(rw,sync,secure,root_squash,subtree_check)
With the effect that client 192.168.0.20 could still mount all other subdirectories of foo (even though read-only).
So, in an attempt to achieve the desired behavior, I created a second parent directory /srv/nfsv4/bar/ that has only the intended set of subdirectories bind-mounted to it:
srv/
└── nfsv4/
├── foo/
│ ├── dir1
│ ├── dir2
│ ├── dir3
│ └── dir4
└── bar/
├── dir1
└── dir2
And changed /etc/exports to look like this:
/srv/nfsv4 192.168.0.10/24(ro,sync,secure,root_squash,subtree_check,fsid=0) \
192.168.0.20/24(ro,sync,secure,root_squash,subtree_check,fsid=0)
/srv/nfsv4/foo 192.168.0.10/24(rw,sync,secure,root_squash,subtree_check)
/srv/nfsv4/bar 192.168.0.20/24(rw,sync,secure,root_squash,subtree_check)
Now, when I mount nfs-server:/bar on client 192.168.0.20, everything seems as expected. Except that I could still mount nfs-server:/ (the exported root) and have read access to foo. My understanding was that, unless I explicitly exported foo to 192.168.0.20, it should not be visible to it.
What did I do wrong?