NFS Mount Permission Denied With SELinux Enforcing

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

NFS share mounts fail or mounted paths are inaccessible despite correct network reachability.

Environment & Reproduction

Use `showmount -e ` and `mount -t nfs4` tests to validate basic export visibility.

Root Cause Analysis

Ensure `nfs-utils` is installed on both server and client from RHEL 9 repositories.

Quick Triage

Check `systemctl status nfs-server` and rpcbind-related units on the server.

Step-by-Step Diagnosis

Inspect `journalctl -u nfs-server` plus client-side kernel and mount error messages.

Solution – Primary Fix

Backup `/etc/exports`, mount options, and current SELinux booleans before modification.

Solution – Alternative Approaches

Open required NFS services in `firewalld` and verify zone bindings on both endpoints.

Verification & Acceptance Criteria

Enable appropriate booleans and ensure exported paths use compatible labels for NFS access.

Rollback Plan

Correct exports, reload with `exportfs -rav`, and remount client shares with validated options.

Prevention & Hardening

Confirm read and write operations from client and no new AVC denials in audit logs.

Related Errors & Cross-Refs

Standardize NFS export templates and SELinux policies across server fleets.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Share exports file, mount commands, and full server/client journal excerpts.