Managing file policies

Displaying all policies and FPolicy status

To display a list of all policies and FPolicy status, complete the following step.

Step	Action
1	Enter the following command: `fpolicy`

Displaying information for a file policy

To display information about a specific file policy, complete the following step.

Step	Action
1	Enter the following command: `fpolicy show` PolicyName

Example of file screening policy information display

Following is an example of the information display for a file policy.

fpolicy show FPOLICY1

CIFS file policy is enabled.

File policy FPOLICY1 (file screening) is enabled.

File screen servers    P/S   Connect 
time (dd:hh:mm)  Reqs    Fails

------------------------------------------------------------------

172.24.1.120 \\SCREEN1  Pri      00:00:01                0       0

Operations monitored:

File open,File create,File rename,File close,File delete Directory 
delete  Above operations are monitored for NFS and CIFS

Symlink

 Above operations are monitored for NFS only

List of extensions to screen:

 JPG, MPG

List of extensions not to screen:

 Extensions-not-to-screen list is empty.

Number of files screened:   1032

Number of screen failures:  0

How the file policy specifies which files to screen

The file policy specifies which files to screen using a list of file extensions to include for screening or to exclude from screening. From the command line, you can display or change the list of included and excluded file extensions. When there is a contradiction for a specific file extension, either by two different policies or by addition to both the include and exclude list on the same policy, that file type will be screened.

You can use a question mark (?) to specify a wildcard character within any file extension you enter for file policy screening commands. For example, entering .jp? in a list of file extensions to include for file screening would include all file extensions that begin with ".jp" (such as .jpg and .jpe extensions).

Displaying the list of included or excluded file extensions for a policy

To display the list of excluded file extensions for a file policy, complete the following step.

Step	Action
1	Enter the following command: fpolicy ext[ensions] exc[lude] show PolicyName When you enter this command, Data ONTAP responds with a list of extensions from the exclude list for the file you specified. Note If you want to show file extensions from the list of files to be included for file screening, use the include (`inc`) option in place of the exclude (`exc`) option during this procedure.

Step

Action

Enter the following command:

fpolicy ext[ensions] exc[lude] show PolicyName

When you enter this command, Data ONTAP responds with a list of extensions from the exclude list for the file you specified.

Note
If you want to show file extensions from the list of files to be included for file screening, use the include (inc) option in place of the exclude (exc) option during this procedure.

Including file extensions for file screening

To add file extensions to the list of file extensions to be screened for a file policy, complete the following step.

Step	Action
1	Enter the following command: *fpolicy ext[ensions] inc[lude] add PolicyName* ext[,ext]... The file extensions you add to an include list will always be screened by the file screening server when that policy is enabled. Example fpolicy ext inc add imagescreen jpg,gif,bmp** Result Once enabled, the policy `imagescreen` now requires screening for any files with the extension `.jpg`, `.gif`, or `.bmp`.

Step

Action

Enter the following command:

fpolicy ext[ensions] inc[lude] add PolicyName 
ext[,ext]...

The file extensions you add to an include list will always be screened by the file screening server when that policy is enabled.

Example

fpolicy ext inc add imagescreen jpg,gif,bmp

Result

Once enabled, the policy imagescreen now requires screening for any files with the extension .jpg, .gif, or .bmp.

Excluding file extensions from file screening

To add file extensions to the list of file extensions to be excluded from file screening for a file policy, complete the following step.

Step	Action
1	Enter the following command: *fpolicy ext[ensions] exc[lude] add PolicyName* ext[,ext]... The file extensions you add to an exclude list will not be screened by the file screening server when that policy is enabled (unless contradicted by another enabled file screening policy). Example fpolicy ext exc add default txt,log,hlp** Result When enabled, the modified policy will no longer require `.txt`, `.log`, and `.hlp` files to be screened by the file screening server.

Step

Action

Enter the following command:

fpolicy ext[ensions] exc[lude] add PolicyName 
ext[,ext]...

The file extensions you add to an exclude list will not be screened by the file screening server when that policy is enabled (unless contradicted by another enabled file screening policy).

Example

fpolicy ext exc add default txt,log,hlp

Result

When enabled, the modified policy will no longer require .txt, .log, and .hlp files to be screened by the file screening server.

Removing specific extensions from a file policy include or exclude extension list

To remove file extensions from the exclude or include extensions list for a file screening policy, complete the following step.

Step	Action
1	Enter the following command: *fpolicy ext[ensions] exc[lude] remove PolicyName ext[,ext]...* Example fpolicy ext exc remove default wav Result Files with a .wav extension are screened. Note If you want to delete specific file extensions from the list of files to be included for file screening, use the include (`inc`) option in place of the exclude (`exc`) option during this procedure.

Step

Action

Enter the following command:

fpolicy ext[ensions] exc[lude] remove PolicyName 
ext[,ext]...

Example

fpolicy ext exc remove default wav

Result

Files with a .wav extension are screened.

Note
If you want to delete specific file extensions from the list of files to be included for file screening, use the include (inc) option in place of the exclude (exc) option during this procedure.

Resetting all entries for a file policy include or exclude extension list

The default settings for a file policy are a file policy are as follows:

All file extensions are listed in the include list.
No file extensions are listed in the exclude list.

To reset all entries from the exclude or include list for a file policy to the default values, complete the following step.

Step	Action
1	Enter one or both of the following commands: fpolicy ext[ensions] inc[lude] reset PolicyName fpolicy ext[ensions] exc[lude] reset PolicyName

Note
You can set the include list to no file extensions by using the set option; for example, fpolicy ext inc set PolicyName "". However, this has the same effect as disabling the policy.

Replacing the list of excluded file extensions

To replace the entire exclude or include list for a file policy, complete the following step.

Step	Action
1	Enter the following command: *fpolicy ext[ensions] exc[lude] set PolicyName* ext[,ext...] Result The new list of extensions you enter with this command replaces the existing list of excluded extensions so that only the new extensions are excluded from screening. Note** If you want to replace the list of extensions to be included for file screening, use the include (`inc`) option in place of the exclude (`exc`) option during this procedure.

Step

Action

Enter the following command:

fpolicy ext[ensions] exc[lude] set PolicyName 
ext[,ext...]

Result

The new list of extensions you enter with this command replaces the existing list of excluded extensions so that only the new extensions are excluded from screening.

Note
If you want to replace the list of extensions to be included for file screening, use the include (inc) option in place of the exclude (exc) option during this procedure.

Requiring file screening for file access

To require files to be screened before they can be accessed, complete the following step.

Step	Action
1	Enter the following command: *fpolicy options PolicyName* required on Note** This option is set to `off` by default. If you turn on required file screening for a policy when no file screening servers are available, access to files specified in that policy will be denied using native file blocking.

Step

Action

Enter the following command:

fpolicy options PolicyName required on

Note
This option is set to off by default.

If you turn on required file screening for a policy when no file screening servers are available, access to files specified in that policy will be denied using native file blocking.