Access restrictions for exported resources

About access restrictions

When you export a resource, you can specify the access restrictions that govern how the resource can be mounted. If you export a resource without specifying access restrictions, it can be mounted read-write by all hosts.

You specify access restrictions with options in the /etc/exports file or in the exportfs command. These access restrictions options determine

Which hosts can mount the resource
Whether the resource can be mounted read-write or read-only
Whether the root user on the client can access the resource
The user ID (UID) of the user accessing the resource

Meanings of access restriction options

The access option

It lists individual hosts, netgroups, or subnets that can mount the resource. Hosts not included in the access list are denied access to the resource. By default, the listed hosts can mount the resource read-write.

There is no limit to the number of targets you can list with the access option in the /etc/exports file. However, if you want to avoid exceeding the maximum length of an /etc/exports file entry, use netgroups or subnet addresses instead of individual host names in the list.

The root option

It determines the user ID for the root user on the client who sends the NFS requests after mounting the resource. The following list describes the effect of including or excluding a host from the root option:

If you specify a host with the root option, the root user on that host keeps the root UID (0) when accessing the resource.
Note
Having a root UID does not guarantee read-write access. If an ro option is specified for a resource, the ro option overrides the root option, making the resource a read-only resource.
If no root option is specified for the resource, or if the host trying to access the resource is not specified with the root option, access by root on the client is either denied or subject to modification by the anon option.

You can specify up to 255 names with the root option. You can specify host names and subnets; you cannot specify netgroups.

The rw option

It gives read-write access to the specified hosts. The rw option is useful if you want to make a resource readable by most hosts.

You can specify up to 255 names with the rw option. The names can be host names or subnets; you cannot specify netgroups.

The ro option

It exports the resource read-only.

This option is not followed by a list of targets because it applies to all hosts that have permission to mount the resource.

The anon option

It determines the UID for the root user on the client. The following table describes the effects of the anon option.

If...	Then...
The client is not specified by the `root` option for the resource	The UID specified by the `anon` option is the effective UID.
The client is specified by the `root` option for the resource	The UID specified by the `anon` option is not used. The effective UID is 0.

The following list describes the default UID specified by the anon option and the meanings of some special UIDs:

By default, the anon option specifies a UID of 65534. That is, if you do not use the root and anon options for a resource, root users on all hosts access the resource using the UID 65534.
If the anon option specifies a UID of 65535, root access is disabled.
If the anon option specifies a UID of 0, root access is granted to all hosts.

Interactions among options

When Data ONTAP receives a mount request for a resource, it takes into consideration all options pertaining to the resource to determine access restrictions.

Example

The /etc/exports file contains the following entry for the /vol/vol0 volume:

/vol/vol0 -access=host1:host2,root=host1,rw=host2

The access and root options allow host1 to mount the /vol/vol0 volume with root access. The rw option, however, specifies that hosts other than host2 have only read access. As a result, host1 can only mount the /vol/vol0 volume as a read-only resource.

Example

The /etc/exports file contains the following entry for the /vol/vol0 volume:

/vol/vol0 -access=host1:host2,root=host1,ro

The access and root options allow host1 to mount the /vol/vol0 volume with root access. The ro option, however, makes the /vol/vol0 volume a read-only resource to all hosts. As a result, host1 can only mount the /vol/vol0 volume as a read-only resource.