1.\" Copyright (c) 1989, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)exports.5 8.3 (Berkeley) 3/29/95 33.\" $FreeBSD: src/sbin/mountd/exports.5,v 1.10.2.8 2002/09/28 16:31:45 markm Exp $ 34.\" 35.Dd March 29, 1995 36.Dt EXPORTS 5 37.Os 38.Sh NAME 39.Nm exports 40.Nd define remote mount points for 41.Tn NFS 42mount requests 43.Sh SYNOPSIS 44.Nm 45.Sh DESCRIPTION 46The 47.Nm 48file specifies remote mount points for the 49.Tn NFS 50mount protocol per the 51.Tn NFS 52server specification; see 53.%T "Network File System Protocol Specification" , 54RFC1094, Appendix A and 55.%T "NFS: Network File System Version 3 Specification" , 56Appendix I. 57.Pp 58Each line in the file 59(other than comment lines that begin with a #) 60specifies the mount point(s) and export flags within one local server 61filesystem for one or more hosts. 62A host may be specified only once for each local filesystem on the 63server and there may be only one default entry for each server 64filesystem that applies to all other hosts. 65The latter exports the filesystem to the ``world'' and should 66be used only when the filesystem contains public information. 67.Pp 68In a mount entry, 69the first field(s) specify the directory path(s) within a server filesystem 70that can be mounted on by the corresponding client(s). 71There are two forms of this specification. 72The first is to list all mount points as absolute 73directory paths separated by whitespace. 74The second is to specify the pathname of the root of the filesystem 75followed by the 76.Fl alldirs 77flag; 78this form allows the host(s) to mount at any point within the filesystem, 79including regular files if the 80.Fl r 81option is used on 82.Xr mountd 8 . 83The pathnames must not have any symbolic links in them and should not have 84any "." or ".." components. 85Mount points for a filesystem may appear on multiple lines each with 86different sets of hosts and export options. 87.Pp 88The second component of a line specifies how the filesystem is to be 89exported to the host set. 90The option flags specify whether the filesystem 91is exported read-only or read-write and how the client uid is mapped to 92user credentials on the server. 93.Pp 94Export options are specified as follows: 95.Pp 96.Sm off 97.Fl maproot No = Sy user 98.Sm on 99The credential of the specified user is used for remote access by root. 100The credential includes all the groups to which the user is a member 101on the local machine (see 102.Xr id 1 ) . 103The user may be specified by name or number. 104.Pp 105.Sm off 106.Fl maproot No = Sy user:group1:group2:... 107.Sm on 108The colon separated list is used to specify the precise credential 109to be used for remote access by root. 110The elements of the list may be either names or numbers. 111Note that user: should be used to distinguish a credential containing 112no groups from a complete credential for that user. 113.Pp 114.Sm off 115.Fl mapall No = Sy user 116.Sm on 117or 118.Sm off 119.Fl mapall No = Sy user:group1:group2:... 120.Sm on 121specifies a mapping for all client uids (including root) 122using the same semantics as 123.Fl maproot . 124.Pp 125The option 126.Fl r 127is a synonym for 128.Fl maproot 129in an effort to be backward compatible with older export file formats. 130.Pp 131In the absence of 132.Fl maproot 133and 134.Fl mapall 135options, remote accesses by root will result in using a credential of -2:-2. 136All other users will be mapped to their remote credential. 137If a 138.Fl maproot 139option is given, 140remote access by root will be mapped to that credential instead of -2:-2. 141If a 142.Fl mapall 143option is given, 144all users (including root) will be mapped to that credential in 145place of their own. 146.Pp 147The 148.Fl ro 149option specifies that the filesystem should be exported read-only 150(default read/write). 151The option 152.Fl o 153is a synonym for 154.Fl ro 155in an effort to be backward compatible with older export file formats. 156.Pp 157.Tn WebNFS 158exports strictly according to the spec (RFC 2054 and RFC 2055) can 159be done with the 160.Fl public 161flag. 162However, this flag in itself allows r/w access to all files in 163the filesystem, not requiring reserved ports and not remapping uids. 164It 165is only provided to conform to the spec, and should normally not be used. 166For a 167.Tn WebNFS 168export, 169use the 170.Fl webnfs 171flag, which implies 172.Fl public , 173.Sm off 174.Fl mapall No = Sy nobody 175.Sm on 176and 177.Fl ro . 178.Pp 179A 180.Sm off 181.Fl index No = Sy file 182.Sm on 183option can be used to specify a file whose handle will be returned if 184a directory is looked up using the public filehandle 185.Pq Tn WebNFS . 186This is to mimic the behavior of URLs. 187If no 188.Fl index 189option is specified, a directory filehandle will be returned as usual. 190The 191.Fl index 192option only makes sense in combination with the 193.Fl public 194or 195.Fl webnfs 196flags. 197.Pp 198Specifying the 199.Fl quiet 200option will inhibit some of the syslog diagnostics for bad lines in 201.Pa /etc/exports . 202This can be useful to avoid annoying error messages for known possible 203problems (see 204.Sx EXAMPLES 205below). 206.Pp 207The third component of a line specifies the host set to which the line applies. 208The set may be specified in three ways. 209The first way is to list the host name(s) separated by white space. 210(Standard Internet ``dot'' addresses may be used in place of names.) 211The second way is to specify a ``netgroup'' as defined in the netgroup file (see 212.Xr netgroup 5 ) . 213The third way is to specify an Internet subnetwork using a network and 214network mask that is defined as the set of all hosts with addresses within 215the subnetwork. 216This latter approach requires less overhead within the 217kernel and is recommended for cases where the export line refers to a 218large number of clients within an administrative subnet. 219.Pp 220The first two cases are specified by simply listing the name(s) separated 221by whitespace. 222All names are checked to see if they are ``netgroup'' names 223first and are assumed to be hostnames otherwise. 224Using the full domain specification for a hostname can normally 225circumvent the problem of a host that has the same name as a netgroup. 226The third case is specified by the flag 227.Sm off 228.Fl network No = Sy netname 229.Sm on 230and optionally 231.Sm off 232.Fl mask No = Sy netmask . 233.Sm on 234If the mask is not specified, it will default to the mask for that network 235class (A, B or C; see 236.Xr inet 4 ) . 237See the 238.Sx EXAMPLES 239section below. 240.Pp 241The 242.Xr mountd 8 243utility can be made to re-read the 244.Nm 245file by sending it a hangup signal as follows: 246.Bd -literal -offset indent 247kill -s HUP `cat /var/run/mountd.pid` 248.Ed 249.Pp 250After sending the 251.Dv SIGHUP , 252check the 253.Xr syslogd 8 254output to see whether 255.Xr mountd 8 256logged any parsing errors in the 257.Nm 258file. 259.Sh FILES 260.Bl -tag -width /etc/exports -compact 261.It Pa /etc/exports 262the default remote mount-point file 263.El 264.Sh EXAMPLES 265.Bd -literal -offset indent 266/usr /usr/local -maproot=0:10 friends 267/usr -maproot=daemon grumpy.cis.uoguelph.ca 131.104.48.16 268/usr -ro -mapall=nobody 269/u -maproot=bin: -network 131.104.48 -mask 255.255.255.0 270/u2 -maproot=root friends 271/u2 -alldirs -network cis-net -mask cis-mask 272/cdrom -alldirs,quiet,ro -network 192.168.33.0 -mask 255.255.255.0 273.Ed 274.Pp 275Given that 276.Sy /usr , 277.Sy /u 278and 279.Sy /u2 280are 281local filesystem mount points, the above example specifies the following: 282.Sy /usr 283is exported to hosts 284.Em friends 285where friends is specified in the netgroup file 286with users mapped to their remote credentials and 287root mapped to uid 0 and group 10. 288It is exported read-write and the hosts in ``friends'' can mount either /usr 289or /usr/local. 290It is exported to 291.Em 131.104.48.16 292and 293.Em grumpy.cis.uoguelph.ca 294with users mapped to their remote credentials and 295root mapped to the user and groups associated with ``daemon''; 296it is exported to the rest of the world as read-only with 297all users mapped to the user and groups associated with ``nobody''. 298.Pp 299.Sy /u 300is exported to all hosts on the subnetwork 301.Em 131.104.48 302with root mapped to the uid for ``bin'' and with no group access. 303.Pp 304.Sy /u2 305is exported to the hosts in ``friends'' with root mapped to uid and groups 306associated with ``root''; 307it is exported to all hosts on network ``cis-net'' allowing mounts at any 308directory within /u2. 309.Pp 310The filesystem rooted at 311.Sy /cdrom 312will exported read-only to the entire network 192.168.33.0/24, including 313all its subdirectories. 314Since 315.Sy /cdrom 316is the conventional mountpoint for a CD-ROM device, this export will 317fail if no CD-ROM medium is currently mounted there since that line 318would then attempt to export a subdirectory of the root filesystem 319with the 320.Fl alldirs 321option which is not allowed. 322The 323.Fl quiet 324option will then suppress the error message for this condition that 325would normally be syslogged. 326As soon as an actual CD-ROM is going to be mounted, 327.Xr mount 8 328will notify 329.Xr mountd 8 330about this situation, and the 331.Sy /cdrom 332filesystem will be exported as intented. 333Note that without using the 334.Fl alldirs 335option, the export would always succeed. 336While there is no CD-ROM medium mounted under 337.Sy /cdrom , 338it would export the (normally empty) directory 339.Sy /cdrom 340of the root filesystem instead. 341.Sh SEE ALSO 342.Xr netgroup 5 , 343.Xr mountd 8 , 344.Xr nfsd 8 , 345.Xr showmount 8 346.Sh BUGS 347The export options are tied to the local mount points in the kernel and 348must be non-contradictory for any exported subdirectory of the local 349server mount point. 350It is recommended that all exported directories within the same server 351filesystem be specified on adjacent lines going down the tree. 352You cannot specify a hostname that is also the name of a netgroup. 353Specifying the full domain specification for a hostname can normally 354circumvent the problem. 355