It is not possible to mount NFS mounts secured with Kerberos, failing command is:
$ mount -t nfs -o sec=krb5,ro,nfsvers=3,nolock 192.168.1.18:/export/test /tmp/mnt
mount.nfs: an incorrect mount option was specified
When sec=krb5 is replaced by sec=sys (or when sec=krb5 option is omitted) the NFS mount is successful.
The NFS server itself has no problem, the same directory can be mounted from other (linux) machines (for the testing directory it is exported with both sys and krb5 options). Also Kerberos client is set up fine and credentials are retrieved before trying the mount attempt, so Kerberos is not problem, I am pretty sure it is in NFS.
It seems that the reason is missing kernel module rpcsec_gss_krb5 in Turris OS, so the Kerberos credentials cannot be retrieved by mount. I also reproduced the same mount.nfs error message on other linux machine (when module rpcsec_gss_krb5 is unloaded and blacklisted, the mount attempt fails with exactly same error message “an incorrect mount option was specified”, when the module rpcsec_gss_krb5 is not blacklisted, the mount is successful), so it really seems that missing rpcsec_gss_krb5 causes this.
In fact, I need to mount it inside LXC container (not inside Turris OS itself). But since LXC container uses kernel modules from Turris OS, it will not work inside container either. Not until Turris OS loads module rpcsec_gss_krb5.
Would it be possible to add the kernel module rpcsec_gss_krb5 into some package, maybe kmod-fs-nfs-common-v4 (it probably belongs together with module auth_rpcgss which is already there)?
EDIT:
I dug into this a bit more and I can see that in (old OpenWrt) Chaos Calmer the rpcsec_gss_krb5 is also missing: chaos_calmer/package/kernel/linux/modules/fs.mk at chaos_calmer · openwrt/chaos_calmer · GitHub
But in newest OpenWrt/LEDE it is present (it has been re-wrapped into package fs-nfs-common-rpcsec, both auth_rpcgss and rpcsec_gss_krb5 are present in the package, and the package dependencies make more sense there as well): openwrt/package/kernel/linux/modules/fs.mk at master · openwrt/openwrt · GitHub
So missing rpcsec_gss_krb5 might be bug of previous version of OpenWrt, I hope this still can be fixed in Turris OS…