Controlling CIFS access to symbolic links

About disabling share boundary checking for symbolic links

How disabling share boundary checking affects symbolic links

When you disable share boundary checking for symbolic links, CIFS clients can follow symbolic links anywhere on the same filer. This behavior is set on a per-share basis and affects both relative and absolute symbolic links.

Requirements

Disabling share boundary checking for symbolic links has the following requirements:

The share in which the symbolic links are located must be set to nosymlink_strict_security.
In order to resolve an absolute symbolic link, there must be a Map entry in the /etc/symlink.translations file that determines the destination of the link.
The destinations for relative symbolic links and for mapped absolute symbolic links may be in any shared or non-shared area of the filer.

Limitations

Disabling share boundary checking for symbolic links has the following limitations:

Relative symbolic links cannot be used to span volumes; you must use absolute symbolic links.
Symbolic links cannot be followed off the filer to other systems.
NT share security is:
- Preserved for the symbolic link itself because the CIFS client has to authenticate to connect to the share in which the symbolic link is located.
- Preserved for the destination of the symbolic link only if the destination is in the same share.
- Not preserved for the destination of the symbolic link if the destination is outside the share because the CIFS client does not have to authenticate to the destination (which may or may not be a CIFS share).
  Note
  If you disable share boundary checking for symbolic links, be sure to secure any areas of the filer that you do not want users to access. This is necessary because there is nothing to restrict a user from creating a symbolic link to any path on the filer.

For more information

For more information about disabling share boundary checking for symbolic links, see Sharing directories on the filer.