The file can contain up to 10,240 entries, with there being no limit on the size of each entry. An entry can span multiple lines with use of the continuation character `\'. The entries are read in sequential order and each time a duplicate pathname is encountered, it overwrites any previous export of that pathname.
Each export entry is a line in the following format:
pathname -option[,option ] ...
The following list describes the fields in an export entry:
rw | rw=hostname[:hostname]...
A pathname can be either exported rw to all
hosts or to a set of specified hosts. If
no access modifiers are provided, then the
default is rw.
root=hostname[:hostname]...
Give root access only to the specified
hosts. Note that there is no -root option,
i.e., this option always takes at least one
hostname as a parameter.
sec=secflavor[:secflavor]...
Allow access to the mounted directory only
using the listed security flavors. The supported
security flavors are:
A hostname is described as:
[-][machine name|netgroup|machine IP|subnet|DNS domain]
Where, `-' indicates that the host is to be denied access.
A machine name is an alphanumeric string.
A netgroup is also an alphanumeric string and describes a group of machine names. If NIS is not enabled, then each netgroup must be defined in the /etc/netgroup file. If NIS is enabled, then each netgroup may either be in a NIS mapping or defined in the /etc/netgroup file.
If a netgroup occurs in both NIS and /etc/netgroup, then the ordering given in /etc/nsswitch.conf determines which definition is used.
A machine IP is in dotted decimal format: AAA.BBB.CCC.DDD
A subnet is in the forms:
dotted_IP/num_bits
The dotted_IP field is a subnet number.
The num_bits field specifies
the size of the subnet by the number
of leading bits of the netmask.
"[network] subnet [netmask] netmask" The subnet field is the subnet number. The netmask field is the netmask. Note that the keywords network and netmask are optional.
A DNS domain starts with a `.' and is alphanumeric.
If there is a machine name and a netgroup with the same name, then the hostname is assumed to be the name of a machine.
In UNIX, it is illegal to export a directory that has an exported ancestor in the same file system. Data ONTAP does not have this restriction. For example, you can export both the /vol/vol0 directory and the /vol/vol0/home directory. In determining permissions, the filer uses the longest matching prefix.
As the /etc/exports file is parsed and the same path is determined to be used for exporting, then the last instance of the export rule is stored in memory. Note that different path names may evaluate to the same advertised path:
/home
/vol/vol0/home
/vol/vol0/home/ontap/..
The addition of actual complicates the rules for determining what gets exported. If an export uses -actual, then neither the advertised path nor the actual storage path may be duplicated in memory.
1) -rw is the default if -ro, -ro=, -rw, and -rw= are all not present.
2) If only -rw= is present, ro is not the default for all other hosts. This rule is a departure from pre-6.5 semantics.
3) -ro,ro= and -rw,rw= are errors.
4) -ro=A,rw=A is an error
5) -ro=A,rw=-A is an error
6) -ro=-A,rw=A is an error
7) The position of -rw, -rw= -ro, and -ro= in the options does not have any significance
8) -ro trumps -rw
9) -ro= trumps -rw
10) -rw= trumps -ro
11) -ro= trumps -rw=
12) Left to right precedence, which determines `-' and the order we go across the wire.
Note, "A trumps B" means that option A overrules option B.
farm pets (alligator,,) livestock workers
pets (dog,,) (cat,,) (skunk,,) (pig,,) (crow,,)
livestock
(cow,,) (pig,,) (chicken,,) (ostrich,,)
workers
(dog,,) (horse,,) (ox,,) (mule,,)
predators
(coyote,,) (puma,,) (fox,,) (crow,,)
We can illustrate the access rules thusly:
/vol/vol0 -anon=0
All hosts have rw access, and root at that.
/vol/vol0 -root=horse,rw
All hosts have rw access, but only horse has root
access.
/vol/vol0 -anon=0,rw=horse
Only horse has access and it is rw. Note the
departure from the prior rule format, in which all
other hosts would by default have ro access.
/vol/vol0 -anon=0,ro,rw=horse
All hosts have ro access, except horse, which has
rw access.
/vol/vol1 -ro=workers,rw=farm:canary
/vol/vol1 -rw=farm:canary,ro=workers All hosts in
the netgroup farm have rw access, except dog,
horse, ox, and mule. All of which have ro access.
In addition, canary has rw access to the export.
Note that both lines are identical with respect to
determining access rights.
/vol/vol2 -ro=pets,rw
All hosts have rw access, except for dog, cat,
skunk, pig, and crow, all of which have ro access.
/vol/vol2 -ro=-pets,rw
All hosts have rw access, except for dog, cat, skunk, pig, and crow, all of which have no access at all.
By rule #9, all members of the netgroup pets are denied rw access. By negation, all members of the netgroup pets are denied ro access.
/vol/vol2 -ro,rw=pets:canary
All hosts have ro access, except for canary, dog,
cat, skunk, pig, and crow, all of which have rw
access.
/vol/vol2 -ro,rw=-pets:canary
All hosts have ro access, except for canary which
has rw access.
/vol/vol2 -ro,rw=pets:farm:canary
All hosts have ro access, except for canary and all
hosts in the netgroups pets and farm, which all
have rw access.
/vol/vol2 -ro,rw=-pets:farm:canary
All hosts have ro access, except for all hosts in the netgroup farm, excluding all hosts in the netgroup pets, which have rw access. The host canary also has rw access.
If the host cat wants to write to /vol/vol2, by rule #10, we first check the -rw= access list. By rule #12, we check for access in order of -pets, farm, and finally canary. We match cat in the netgroup pets and therefore cat is denied rw access. It will however be granted ro access.
/vol/vol2 -ro,rw=farm:-pets:canary
Effectively, all hosts have ro access, except for canary and all hosts in the netgroup farm, which all have rw access.
If the host cat wants to write to /vol/vol2, by rule #10, we first check the -rw= access list. By rule #12, we check for access in order of farm, -pets, and finally canary. We match cat in the netgroup farm, by expansion, and therefore cat is granted rw access.
/vol/vol2a -rw=pets:-workers,ro=livestock
By rule #11, cow, pig, chicken, and ostrich all have ro access.
By rule #12, dog, cat, and skunk all have rw access.
By negation, horse, ox, and mule have no rw access and by rule #2, they have no access at all.
/vol/vol2a -rw=-workers:pets,ro=livestock
By rule #11, cow, pig, chicken, and ostrich all have ro access.
By rule #12, negation, and rule #2, dog, horse, ox, and mule have no access.
cat and skunk have rw access.
/vol/vol3 -ro=pets,rw=farm:lion
All hosts in the netgroup farm have rw access, except for all hosts in the netgroup pets, which all have ro access. In addition, the host lion has rw access.
If the host cat wants to write to /vol/vol3, by rule #11, we first check the -ro= access list. We match cat in the netgroup pets and therefore we deny rw access.
/vol/vol4 -ro=10.56.17/24,rw=10.56/16
All hosts in the subnet 10.56/16 have rw access,
except those in the subnet 10.56.17/24, which have
ro access.
Another significant change is that -ro is no longer the default if -rw= is present as an option.
During the upgrade process, the /etc/exports file is converted to the newer format.
The rules for upgrading to the new format are:
1) -root= options stay the same
2) No access list => -rw
3) -access=X => -rw=X
4) -ro => -ro
5) -access=X,ro => -ro=X
6) -rw=X => -rw=X
This is more secure than the change -rw=X,ro.
Remember from Access Rule #2, -ro is never a default.
If the less restrictive form is desired, then the option needs to be manually changed. Note that if an export file has a mix of old and new style options, the more secure new style option of -rw=X can not be differentiated from the less secure option of -rw=X(,ro) with the implicit ro modifier. To solve this problem, we always interpret -rw=X in the most secure format.
7) -access=Y,rw=X => -rw=X,ro=(Y-X)
There is a potential to remove write access here,
but we keep the most secure translation.
In all cases, we preserve ordering inside an option.
/vol/vol0 -rw,anon=0
/vol/vol3 -ro
By rule #4, this becomes:
/vol/vol3 -ro
/vol/vol0/home -rw=dog:cat:skunk:pig:mule
By rule #6, this becomes:
/vol/vol0/home -rw=dog:cat:skunk:pig:mule
Note that by the access rules given above, all other hosts are denied ro access.
Since the upgrade code does not know about netgroups and netgroups used to not be allowed inside the -rw host list, this could be rewritten as:
/vol/vol0/home -rw=pets
Also, if the security style is desired to be the older style, this could be further rewritten as:
/vol/vol0/home -ro,rw=pets
/vol/vol1 -access=pets:workers:alligator:mule,\ rw=dog:cat:skunk:pig:horse:ox:mule
By rule #7, this becomes:
/vol/vol1 -ro=pets:workers:alligator,\ rw=dog:cat:skunk:pig:horse:ox:mule
This can be rewritten as:
/vol/vol1 -ro=pets:workers:alligator,\ rw=pets:workers
And should be:
/vol/vol1 -ro=alligator,rw=pets:workers
1) Translate -anon=name to -anon=uid
2) Drop all -nosuid
3) We drop all domain names (all start with a `.')
4) We drop all entries which start with a `-'
5) no access list => no access list
6) -rw => no access list
7) -ro => -ro
8) -rw=X,ro => -rw=X
9) -rw=X,ro=Y => -access=X+Y,rw=X
10) -ro=X,rw => no access list
Can't express this one in the old rules
11) -ro=X => -access=X,ro
12) -rw=X => -access=X,rw=X
After the exports have been reverted, all netgroups in -rw=X and root= options must be expanded to the set of hosts that are to have access.
Note, in ONTAP 6.5, an export can have more than 255 entries in rw= and root=. In order to revert to prior to ONTAP 6.5, these host lists must be reduced to less than 255 entries. When the /etc/exports file is reverted by exportfs -d, warnings for entries which violate these limits will be sent to the console. The file will need to be hand edited to fix these problems.
vol create
A default entry is added for the new volume. If an
admin host had been defined during the setup process,
access is restricted to that host, otherwise
all hosts have access to the new volume.
vol rename
All entries which have either a pathname or an
-actual pathname which matches the old volume name
are changed to be that of the new volume name.
vol destroy
All entries which have either a pathname or an
-actual pathname which matches the old volume name
are removed from the file.
upgrade
During every invocation of exportfs -a, the exports
file is checked for old style formatting. If this
style is found, the exports file is upgraded to
follow the current formatting.
Please note that when we upgrade exports which contain subnets, we always rewrite the subnets in the compact format of dotted_IP/num_bits.
The time that a entry lives in the cache is determined by the two options:
nfs.export.neg.timeout
dictates how long an entry which has been
denied access lives
nfs.export.pos.timeout
dictates how long an entry which has been
granted access lives
There are several ways that the cache can be flushed:
exportfs -f
Flushes the entire access cache.
exportfs -f pathname
Flushes the cache for the longest leading
prefix match for the path.
Also, any command which alters an export entry will result in the access cache for that export being flushed. E.g., exportfs -au, exportfs -a, exportfs -io -rw /vol/vol1, etc.
A common problem with reverse DNS lookups is the existence of a mapping from name to IP, but not IP to name.
The option nfs.mountd.trace can be turned on to help debug access requests. Note that as this option can be very verbose and it writes to the syslog, care should be taken to only enable it while trying to resolve an access problem.
Another useful tool is to use exportfs -c to check for access permissions.
When /etc/exports is reverted to a version of ONTAP prior to 6.5, netgroup entries can remain inside -rw= and -root= options. These entries will need to be fixed. Also, an entry can exceed 4,096 characters in ONTAP 6.5, which can be another reason that there will be a need to edit the file after reverting.
/etc/nsswitch.conf determines name resolution search order