kerberized NFSv4 client reporting operation not permitted when mounting with sec=sys

[Felix Rubio <felix@xxxxxxxxx>]

Hi everybody,

I have a kerberized NFSv4 server that is exporting a mountpoint:

    /home 10.0.0.0/8(rw,no_subtree_check,sec=krb5:krb5i:krb5p)

if I mount that export with this command on the client, it works as 
expected:

    /sbin/mount.nfs4 NFS.domain:/home /network/home -o 
_netdev,noatime,hard,sec=krb5

However, if I modify the export to be

    /home 10.0.0.0/8(rw,no_subtree_check,sec=sys:krb5:krb5i:krb5p)

and I mount that export with sec=sys, as

    /sbin/mount.nfs4 NFS.domain:/home /network/home -o 
_netdev,noatime,hard,sec=sys

I get the following error:

    mount.nfs4: timeout set for Fri Jan 17 14:11:32 2020
    mount.nfs4: trying text-based options 
'hard,sec=sys,vers=4.1,addr=10.2.2.9,clientaddr=10.2.0.12'
    mount.nfs4: mount(2): Operation not permitted
    mount.nfs4: Operation not permitted

What might be the reason for this behavior?

--
Felix Rubio
"Don't believe what you're told. Double check."