Rules for exporting volumes and directories

Export each volume separately

If the filer has multiple volumes, you must export each volume separately; you cannot export all volumes by specifying /vol as the exported directory.

Example

The following lines show how to export the volumes on a filer that has three volumes:

/vol/vol0 -root=toaster, -access=mixer:blender

/vol/users -root=toaster, -access=mixer:blender

/vol/builds -root=toaster, -access=mixer:blender

Nonexample

The following line shows an invalid entry for the /etc/exports directory for a filer that has three volumes; /vol cannot be used by itself as a path:

/vol -root=toaster, -access=blender:mixer

Filer must resolve host names

To export directories to hosts, the filer must be able to resolve host names into IP addresses. Host name resolution can take place

through DNS name resolution
by using the /etc/hosts file on the filer root volume

Refer to "Host name resolution" for more information about host-name-to-IP-address resolution.

Cannot restrict access by host

Neither the filer nor NFS provide a way to specify hosts that cannot mount the filer. To restrict access to exports, you must export volumes and directories in a manner that specifically includes those hosts that should be allowed to mount them. Exclusion occurs when a host is not specifically included in the list of hosts authorized to mount exported volumes and directories.

You can export ancestors and descendants

The filer permits directories that have exported ancestors to be exported. In many implementations of the UNIX operating system, you cannot export a directory that has an exported ancestor in the same file system.

Example

The following lines show exports that the filer allows:

/vol/vol0 -access=adminhost,-root=adminhost

/vol/vol0/home -access=blender:mixer

Nonexample

The following lines show exports that are not allowed on some UNIX systems:

/home -root=adminhost,-access=blender:mixer

/home/local -root=adminhost,-access=blender:mixer

Filer determines permissions by matching longest prefix

The filer uses the longest matching prefix in determining permissions.

In the preceding example

A client mounting /vol/vol0/home/user1 gets permissions for /vol/vol0/home because /vol/vol0/home is the longest matching prefix.
A client mounting /vol/vol0 gets -access=adminhost, -root=adminhost permissions.

Note: Because of the way the filer determines permissions, it makes little sense to give a client greater permissions at a higher level in the file system.

Example

The following lines show an /etc/exports file that creates a security breech by enabling any host to mount the /vol/vol0 directory while restricting specific hosts to mounting the /vol/vol0/home directory. In this example, any host can gain access to the /vol/vol0/home directory by mounting the /vol/vol0 directory:

/vol/vol0

/vol/vol0/home -access=bashful:dopey:sleepy

Edit /etc/exports after changing volume names

If you rename a volume using the vol rename command

Entries in the /etc/exports file that refer to the volume become incorrect.
The in-memory information about active exports gets updated automatically, and clients continue to access the exports without problems.
The filer displays an error message when the exportfs -a command is entered, or when the filer is rebooted.
Clients display the error message, "Stale NFS file handle," after the filer is rebooted.

Caution: To ensure that the entries in the /etc/exports file remain valid, always edit the entries in the file to reflect volume name changes immediately after renaming volumes.

Part No. 210-02334
File: nfs3.htm
Last updated: 02/24/99 12:16:26