Managing file policies

Displaying file policy information

To display file policy information, complete the following step.

Step	Action
1	Enter the following command: `fpolicy show` PolicyName

Example of file screening policy information display

Following is an example of the information display for a file policy.

File policy default file screening is enabled.

File screen servers      Connect time   Reqs   Fails

-------------------------------------------------------

10.34.18.70 \\SCREEN1      00:00:05     1032     0

Operations monitored: File Open, File Create, File Rename.

List of extensions not to screen:

TXT, LOG

Number of files screened: 1032

Number of failures: 0

How the file screening policy specifies which files to screen

The file screening policy specifies which files to screen using a list of file extensions to include for screening or to exclude from screening. The default list of excluded file extensions is empty. This means that when the default is enabled, all files with any type of extension are screened by the file screening server before they can be opened, created, or renamed.

From the command line, you can display or change the list of included and excluded file extensions. When there is a contradiction for a specific file extension, either by two different policies or by addition to both the include and exclude list on the same policy, that file type will be screened.

You can use a question mark (?) to specify a wildcard character within any file extension you enter for file policy screening commands. For example, entering .jp? in a list of file extensions to include for file screening would include all file extensions that begin with ".jp" (such as .jpg and .jpe extensions).

Displaying the list of included or excluded file extensions for a policy

To display the list of excluded file extensions for a file policy, complete the following step.

Step	Action
1	Enter the following command: fpolicy ext[ensions] exc[lude] show PolicyName When you enter this command, Data ONTAP responds with a list of extensions from the exclude list for the file you specified. Note If you want to show file extensions from the list of files to be included for file screening, use the include (`inc`) option in place of the exclude (`exc`) option during this procedure.

Step

Action

Enter the following command:

fpolicy ext[ensions] exc[lude] show PolicyName

When you enter this command, Data ONTAP responds with a list of extensions from the exclude list for the file you specified.

Note
If you want to show file extensions from the list of files to be included for file screening, use the include (inc) option in place of the exclude (exc) option during this procedure.

Including file extensions for file screening

To add file extensions to the list of file extensions to be screened for a file policy, complete the following step.

Step	Action
1	Enter the following command: *fpolicy ext[ensions] inc[lude] add PolicyName* ext[,ext]... The file extensions you add to an include list will always be screened by the file screening server when that policy is enabled. Example fpolicy ext inc add imagescreen jpg,gif,bmp** Result Once enabled, the policy `imagescreen` now requires screening for any files with the extension `.jpg`, `.gif`, or `.bmp`.

Step

Action

Enter the following command:

fpolicy ext[ensions] inc[lude] add PolicyName 
ext[,ext]...

The file extensions you add to an include list will always be screened by the file screening server when that policy is enabled.

Example

fpolicy ext inc add imagescreen jpg,gif,bmp

Result

Once enabled, the policy imagescreen now requires screening for any files with the extension .jpg, .gif, or .bmp.

Excluding file extensions from file screening

To add file extensions to the list of file extensions to be excluded from file screening for a file policy, complete the following step.

Step	Action
1	Enter the following command: *fpolicy ext[ensions] exc[lude] add PolicyName* ext[,ext]... The file extensions you add to an exclude list will not be screened by the file screening server when that policy is enabled (unless contradicted by another enabled file screening policy). Example fpolicy ext exc add default txt,log,hlp** Result When enabled, the modified policy will no longer require `.txt`, `.log`, and `.hlp` files to be screened by the file screening server.

Step

Action

Enter the following command:

fpolicy ext[ensions] exc[lude] add PolicyName 
ext[,ext]...

The file extensions you add to an exclude list will not be screened by the file screening server when that policy is enabled (unless contradicted by another enabled file screening policy).

Example

fpolicy ext exc add default txt,log,hlp

Result

When enabled, the modified policy will no longer require .txt, .log, and .hlp files to be screened by the file screening server.

Removing specific extensions from a file policy include or exclude extension list

To remove file extensions from the exclude or include extensions list for a file screening policy, complete the following step.

Step	Action
1	Enter the following command: *fpolicy ext[ensions] exc[lude] remove PolicyName ext[,ext]...* Example fpolicy ext exc remove default wav Result Files with a .wav extension are screened. Note If you want to delete specific file extensions from the list of files to be included for file screening, use the include (`inc`) option in place of the exclude (`exc`) option during this procedure.

Step

Action

Enter the following command:

fpolicy ext[ensions] exc[lude] remove PolicyName 
ext[,ext]...

Example

fpolicy ext exc remove default wav

Result

Files with a .wav extension are screened.

Note
If you want to delete specific file extensions from the list of files to be included for file screening, use the include (inc) option in place of the exclude (exc) option during this procedure.

Removing all entries for a file policy include or exclude extension list

To delete all entries from the exclude or include list for a file policy, complete the following step.

Step	Action
1	Enter the following command: fpolicy ext[ensions] exc[lude] reset PolicyName Result The list of excluded file extensions is reset to the default (an empty list), so no file extensions are exempted by this policy; therefore, all files are screened when this policy is the only policy enabled. Note If you want to delete all file extensions from the list of files to be included for file screening, use the include (`inc`) option in place of the exclude (`exc`) option during this procedure.

Step

Action

Enter the following command:

fpolicy ext[ensions] exc[lude] reset PolicyName

Result

The list of excluded file extensions is reset to the default (an empty list), so no file extensions are exempted by this policy; therefore, all files are screened when this policy is the only policy enabled.

Note
If you want to delete all file extensions from the list of files to be included for file screening, use the include (inc) option in place of the exclude (exc) option during this procedure.

Replacing the list of excluded file extensions

To replace the entire exclude or include list for a file policy, complete the following step.

Step	Action
1	Enter the following command: *fpolicy ext[ensions] exc[lude] set PolicyName* ext[,ext...] Result The new list of extensions you enter with this command replaces the existing list of excluded extensions so that only the new extensions are excluded from screening. Note** If you want to replace the list of extensions to be included for file screening, use the include (`inc`) option in place of the exclude (`exc`) option during this procedure.

Step

Action

Enter the following command:

fpolicy ext[ensions] exc[lude] set PolicyName 
ext[,ext...]

Result

The new list of extensions you enter with this command replaces the existing list of excluded extensions so that only the new extensions are excluded from screening.

Note
If you want to replace the list of extensions to be included for file screening, use the include (inc) option in place of the exclude (exc) option during this procedure.

Requiring file screening for file access

To require files to be screened before they can be accessed, complete the following step.

Step	Action
1	Enter the following command: fpolicy options default required on Note If you turn on required file screening and no file screening servers are available, all file access will be denied. This command is set to Off by default; that is, the default file policy does not require file screening for file access.

Step

Action

Enter the following command:

fpolicy options default required on

Note
If you turn on required file screening and no file screening servers are available, all file access will be denied. This command is set to Off by default; that is, the default file policy does not require file screening for file access.