1.\" $OpenBSD: exports.5,v 1.16 2010/03/26 19:30:40 jmc Exp $ 2.\" $NetBSD: exports.5,v 1.9 1996/02/18 11:57:50 fvdl Exp $ 3.\" 4.\" Copyright (c) 1989, 1991, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. Neither the name of the University nor the names of its contributors 16.\" may be used to endorse or promote products derived from this software 17.\" without specific prior written permission. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" @(#)exports.5 8.3 (Berkeley) 3/29/95 32.\" 33.Dd $Mdocdate: March 26 2010 $ 34.Dt EXPORTS 5 35.Os 36.Sh NAME 37.Nm exports 38.Nd define remote mount points for 39.Tn NFS 40mount requests 41.Sh SYNOPSIS 42.Nm exports 43.Sh DESCRIPTION 44The 45.Nm 46file specifies remote mount points for the 47.Tn NFS 48mount protocol per the 49.Tn NFS 50server specification; see 51.%T "Network File System Protocol Specification RFC 1094, Appendix A" 52and 53.%T "NFS: Network File System Version 3 Specification, Appendix I" . 54.Pp 55Each line in the file 56(other than comment lines that begin with a 57.Dq # ) 58specifies the mount point(s) and export flags within one local server 59filesystem for one or more hosts. 60A host may be specified only once for each local filesystem on the 61server and there may be only one default entry for each server 62filesystem that applies to all other hosts. 63The latter exports the filesystem to the 64.Dq world 65and should 66be used only when the filesystem contains public information. 67.Pp 68In a mount entry, 69the first field(s) specify the directory path(s) within a server filesystem 70that can be mounted on by the corresponding client(s). 71There are two forms of this specification. 72The first is to list all mount points as absolute 73directory paths separated by whitespace. 74The second is to specify the pathname of the root of the filesystem 75followed by the 76.Fl alldirs 77flag; 78this form allows the host(s) to mount at any point within the filesystem, 79including regular files. 80The pathnames must not have any symbolic links in them and should not have 81any 82.Dq \&. 83or 84.Dq \&.\&. 85components. 86Mount points for a filesystem may appear on multiple lines each with 87different sets of hosts and export options. 88.Pp 89The second component of a line specifies how the filesystem is to be 90exported to the host set. 91The option flags specify whether the filesystem 92is exported read-only or read-write and how the client UID is mapped to 93user credentials on the server. 94.Pp 95Export options are specified as follows: 96.Pp 97.Sm off 98.Fl maproot No = Sy user 99.Sm on 100The credential of the specified user is used for remote access by root. 101The credential includes all the groups to which the user is a member 102on the local machine (see 103.Xr id 1 ) . 104The user may be specified by name or number. 105.Pp 106.Sm off 107.Fl maproot No = Sy user:group1:group2:... 108.Sm on 109The colon separated list is used to specify the precise credential 110to be used for remote access by root. 111The elements of the list may be either names or numbers. 112Note that user: should be used to distinguish a credential containing 113no groups from a complete credential for that user. 114.Pp 115.Sm off 116.Fl mapall No = Sy user 117.Sm on 118or 119.Sm off 120.Fl mapall No = Sy user:group1:group2:... 121.Sm on 122Specifies a mapping for all client UIDs (including root) 123using the same semantics as 124.Fl maproot . 125.Pp 126The option 127.Fl r 128is a synonym for 129.Fl maproot 130in an effort to be backward compatible with older export file formats. 131.Pp 132In the absence of 133.Fl maproot 134and 135.Fl mapall 136options, remote accesses by root will result in using a credential of -2:-2. 137All other users will be mapped to their remote credential. 138If a 139.Fl maproot 140option is given, 141remote access by root will be mapped to that credential instead of -2:-2. 142If a 143.Fl mapall 144option is given, 145all users (including root) will be mapped to that credential in 146place of their own. 147.Pp 148The 149.Fl ro 150option specifies that the filesystem should be exported read-only 151(default read/write). 152The option 153.Fl o 154is a synonym for 155.Fl ro 156in an effort to be backward compatible with older export file formats. 157.Pp 158The third component of a line specifies the host set to which the line applies. 159The set may be specified in three ways. 160The first way is to list the host name(s) separated by whitespace. 161(Standard internet 162.Dq dot 163addresses may be used in place of names.) 164The second way is to specify a 165.Dq netgroup 166as defined in the netgroup file (see 167.Xr netgroup 5 ) . 168The third way is to specify an internet subnetwork using a network and 169network mask that is defined as the set of all hosts with addresses within 170the subnetwork. 171This latter approach requires less overhead within the 172kernel and is recommended for cases where the export line refers to a 173large number of clients within an administrative subnet. 174.Pp 175The first two cases are specified by simply listing the name(s) separated 176by whitespace. 177All names are checked to see if they are 178.Dq netgroup 179names 180first and are assumed to be hostnames otherwise. 181Using the full domain specification for a hostname can normally 182circumvent the problem of a host that has the same name as a netgroup. 183The third case is specified by the flag 184.Sm off 185.Fl network No = Sy netname 186.Sm on 187and optionally 188.Sm off 189.Fl mask No = Sy netmask . 190.Sm on 191If the mask is not specified, it will default to the mask for that network 192class (A, B or C; see 193.Xr inet 3 ) . 194.Pp 195For example: 196.Bd -literal -offset indent 197/usr /usr/local -maproot=0:10 friends 198/usr -maproot=daemon grumpy.cis.uoguelph.ca 131.104.48.16 199/usr -ro -mapall=nobody 200/u -maproot=bin: -network=131.104.48 -mask=255.255.255.0 201/u2 -maproot=root friends 202/u2 -alldirs -network=cis-net -mask=cis-mask 203.Ed 204.Pp 205Given that 206.Sy /usr , 207.Sy /u 208and 209.Sy /u2 210are 211local filesystem mount points, the above example specifies the following: 212.Sy /usr 213is exported to hosts 214.Em friends 215where 216.Em friends 217is specified in the netgroup file 218with users mapped to their remote credentials and 219root mapped to UID 0 and GID 10. 220It is exported read-write and the hosts in 221.Dq friends 222can mount either 223.Pa /usr 224or 225.Pa /usr/local . 226It is exported to 227.Em 131.104.48.16 228and 229.Em grumpy.cis.uoguelph.ca 230with users mapped to their remote credentials and 231root mapped to the user and groups associated with 232.Dq daemon ; 233it is exported to the rest of the world as read-only with 234all users mapped to the user and groups associated with 235.Dq nobody . 236.Pp 237.Sy /u 238is exported to all hosts on the subnetwork 239.Em 131.104.48 240with root mapped to the UID for 241.Dq bin 242and with no group access. 243.Pp 244.Sy /u2 245is exported to the hosts in 246.Dq friends 247with root mapped to UID and groups 248associated with 249.Dq root ; 250it is exported to all hosts on network 251.Dq cis-net 252allowing mounts at any 253directory within /u2. 254.Sh FILES 255.Bl -tag -width /etc/exports -compact 256.It Pa /etc/exports 257default remote mount-point file 258.El 259.Sh SEE ALSO 260.Xr netgroup 5 , 261.Xr mountd 8 , 262.Xr nfsd 8 , 263.Xr showmount 8 264.Sh BUGS 265The export options are tied to the local mount points in the kernel and 266must be non-contradictory for any exported subdirectory of the local 267server mount point. 268It is recommended that all exported directories within the same server 269filesystem be specified on adjacent lines going down the tree. 270You cannot specify a hostname that is also the name of a netgroup. 271Specifying the full domain specification for a hostname can normally 272circumvent the problem. 273.Pp 274Regarding 275.Fl alldirs , 276because NFS mount filehandles are filesystem wide the 277.Fl alldirs 278option applies to exports of the entire filesystem -- even mountpoints 279that are higher up elsewhere in the directory hierarchy. 280Hence if the server has a filesystem 281.Sy /export 282and you wished to export the sub-directory 283.Bd -literal -offset indent 284/export/root/client -alldirs client.foo.com 285.Ed 286.Pp 287you must realize that this also allows mounts to be requested 288against other locations in the 289.Sy /export 290filesystem; thus the host client.foo.com is also permitted to 291mount the directory 292.Sy /export/root/client2 293if it exists. 294