Controlling CIFS access to symbolic links

Understanding how CIFS clients interact with symbolic links

Enabling CIFS clients to follow symbolic links

To allow CIFS clients to follow symbolic links on the filer, you must turn on the cifs.symlinks.enable option. This option is enabled by default on the filer. If this option has been disabled, you may need to reenable it.

To enable CIFS access to symbolic links, complete the following step:

Step	Action
1	Enter the following command to enable CIFS access to symbolic links: options cifs.symlinks.enable on

When options cifs.symlinks.enable is turned on, CIFS clients will directly follow relative symbolic links to destinations in the same share.

You must complete additional steps if you want to allow CIFS clients to follow these symbolic links:

Absolute symbolic links
Since the destination of an absolute symbolic link depends on the way the UNIX mount is set up, CIFS clients need additional information to interpret absolute symbolic links.
Relative symbolic links to destinations on the same filer that are outside the share in which the relative symbolic link is located
By default, the filer will not allow a CIFS client to follow a symbolic link outside the share to which the CIFS client is authenticated.

The following section describes the options for setting up the way CIFS clients behave when they encounter relative and absolute symbolic links on the filer.

Ways CIFS clients can interact with symbolic links

You can specify how you want CIFS clients to interact with symbolic links by using one or more of the following options:

Create Map entries in the /etc/symlinks.translations file (absolute symbolic links only)
Create Widelink entries in the /etc/symlinks.translations file (absolute symbolic links only)
Disable NT share boundary checking for symbolic links (relative and absolute symbolic links)

Use the following table to help determine which options you want to implement. The table shows for each option the types of destinations that symbolic links will be able to point to.

Symbolic link destination can be...	Options for CIFS access to symbolic links
Symbolic link destination can be...	Map entries	Widelink entries	No share boundary check
The same share on the same filer	X	X	X
Another share on the same filer		X	X
A non-shared area of the same filer			X
A share on another filer		X
A share on another CIFS server or a desktop PC		X

For more information about each of these options, see the following sections:

Why you should avoid symbolic links to files

You should prevent CIFS clients from following symbolic links that point to files because Data ONTAP can update the wrong files. The wrong files may be updated because many CIFS client applications perform operations such as writing to a temporary file, renaming the original file to a backup name, then renaming the temporary file to the original name.

When client applications perform these operations, if the original file was targeted directly by a symbolic link, that file would be stored in the directory where the symbolic link was, and the renamed symbolic link would point to the original file rather than to the updated file.

Note
CIFS clients following symbolic links to directories, rather than to individual files, do not experience this problem.