Access restrictions for exported resources

About access restrictions

When you export a resource, you can specify the access restrictions that govern how the resource can be mounted. If you export a resource without specifying access restrictions, it can be mounted read-write by all hosts.

You specify access restrictions using export options in the /etc/exports file or with command line options for the exportfs command. (These options are identical using either method.) Access restriction options determine

Which hosts can mount the resource
Whether the resource can be mounted read-write or read-only
Whether the root user on the client can access the resource
Whether files can be created with the SETUID bit
The user ID (UID) of the user accessing the resource

When multiple restrictions are applied to the same resource, the most restrictive option always takes precedence.

Meanings of access restriction options

The root option

This option determines the user ID for the root user on the client who sends the NFS requests after mounting the resource. The following list describes the effect of including or excluding a host from the root option:

If you specify a host with the root option, the root user on that host keeps the root UID (0) when accessing the resource.
Note
Having a root UID does not guarantee read-write access. If an ro option is specified for a resource, the ro option overrides the root option, making the resource a read-only resource.
If no root option is specified for the resource, or if the host trying to access the resource is not specified with the root option, access by root on the client is either denied or subject to modification by the anon option.

The rw option

It gives read-write access to the specified hosts. If no hosts are specified, all hosts have read-write access.

The ro option

It gives read-only access to the specified hosts. If no hosts are specified, all hosts have read-only access.

The anon option

It determines the UID for the root user on the client. The following table describes the effects of the anon option.

If...	Then...
The client is not specified by the `root` option for the resource	The UID specified by the `anon` option is the effective UID.
The client is specified by the `root` option for the resource	The UID specified by the `anon` option is not used. The effective UID is 0.

The following list describes the default UID specified by the anon option and the meanings of some special UIDs:

By default, the anon option specifies a UID of 65534. That is, if you do not use the root and anon options for a resource, root users on all hosts access the resource using the UID 65534.
If the anon option specifies a UID of 65535, root access is disabled.
If the anon option specifies a UID of 0, root access is granted to all hosts.
If a name is provided instead of a UID, that name is looked up according to the order specified in the /etc/nsswitch.conf file to determine the corresponding UID to be assigned by the anon option.

Interactions among options

When Data ONTAP receives a mount request for a resource, it takes into consideration all options pertaining to the resource to determine applicable access restrictions.

Example

The /etc/exports file contains the following entry for the /vol/vol0 volume:

/vol/vol0 -ro=host1,root=host1,rw=host2

The ro and root options allow host1 to mount the /vol/vol0 volume with root access. The rw option, however, specifies that hosts other than host2 have only read access. Because the most restrictive option takes precedence, host1 can only mount the /vol/vol0 volume as a read-only resource.

Example

The /etc/exports file contains the following entry for the /vol/vol0 volume:

/vol/vol0 -ro=host1:host2,root=host1

The ro and root options allow host1 to mount the /vol/vol0 volume with root access. The ro option, however, makes the /vol/vol0 volume a read-only resource to all hosts. As a result, host1 can only mount the /vol/vol0 volume as a read-only resource.