Consider the following setup:

An NFS server exports the directory /srv/nfsv4 to one client. It is exported with the option "fsid=0" for use with NFSv4.

/srv/nfsv4              192.168.0.10/24(ro,sync,secure,root_squash,subtree_check,fsid=0)

The bind-mounted directory within it, foo, is exported as well. Client 192.168.0.10 can successfully mount and write to it.

/srv/nfsv4/foo          192.168.0.10/24(rw,sync,secure,root_squash,subtree_check)

"foo" has multiple subdirectories. While client 192.168.0.10 should have full read-write access to all of them, another client, 192.168.0.20, should only see a specific subset of these directories. Everything else should not only be read-only, but not mountable at all.

At first, I did it like this:

/srv/nfsv4              192.168.0.10/24(ro,sync,secure,root_squash,subtree_check,fsid=0) \
                        192.168.0.20/24(ro,sync,secure,root_squash,subtree_check,fsid=0)

/srv/nfsv4/foo          192.168.0.10/24(rw,sync,secure,root_squash,subtree_check) \
                        192.168.0.20/24(ro,sync,secure,root_squash,subtree_check)

/srv/nfsv4/foo/dir1     192.168.0.20/24(rw,sync,secure,root_squash,subtree_check)

/srv/nfsv4/foo/dir2     192.168.0.20/24(rw,sync,secure,root_squash,subtree_check)

With the effect that client 192.168.0.20 could still mount all other subdirectories of foo (even though read-only).

So, in an attempt to achieve the desired behavior, I created a second parent directory /srv/nfsv4/bar/ that has only the intended set of subdirectories bind-mounted to it:

srv/
└── nfsv4/
    ├── foo/
    │   ├── dir1
    │   ├── dir2
    │   ├── dir3
    │   └── dir4
    └── bar/
        ├── dir1
        └── dir2

And changed /etc/exports to look like this:

/srv/nfsv4              192.168.0.10/24(ro,sync,secure,root_squash,subtree_check,fsid=0) \
                        192.168.0.20/24(ro,sync,secure,root_squash,subtree_check,fsid=0)

/srv/nfsv4/foo          192.168.0.10/24(rw,sync,secure,root_squash,subtree_check)

/srv/nfsv4/bar          192.168.0.20/24(rw,sync,secure,root_squash,subtree_check)

Now, when I mount nfs-server:/bar on client 192.168.0.20, everything seems as expected. Except that I could still mount nfs-server:/ (the exported root) and have read access to foo. My understanding was that, unless I explicitly exported foo to 192.168.0.20, it should not be visible to it.

What did I do wrong?