1.\" Copyright (c) 1989, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)exports.5 8.3 (Berkeley) 3/29/95 33.\" $FreeBSD: src/sbin/mountd/exports.5,v 1.10.2.8 2002/09/28 16:31:45 markm Exp $ 34.\" $DragonFly: src/sbin/mountd/exports.5,v 1.3 2007/05/17 08:19:01 swildner Exp $ 35.\" 36.Dd March 29, 1995 37.Dt EXPORTS 5 38.Os 39.Sh NAME 40.Nm exports 41.Nd define remote mount points for 42.Tn NFS 43mount requests 44.Sh SYNOPSIS 45.Nm 46.Sh DESCRIPTION 47The 48.Nm 49file specifies remote mount points for the 50.Tn NFS 51mount protocol per the 52.Tn NFS 53server specification; see 54.%T "Network File System Protocol Specification" , 55RFC1094, Appendix A and 56.%T "NFS: Network File System Version 3 Specification" , 57Appendix I. 58.Pp 59Each line in the file 60(other than comment lines that begin with a #) 61specifies the mount point(s) and export flags within one local server 62filesystem for one or more hosts. 63A host may be specified only once for each local filesystem on the 64server and there may be only one default entry for each server 65filesystem that applies to all other hosts. 66The latter exports the filesystem to the ``world'' and should 67be used only when the filesystem contains public information. 68.Pp 69In a mount entry, 70the first field(s) specify the directory path(s) within a server filesystem 71that can be mounted on by the corresponding client(s). 72There are two forms of this specification. 73The first is to list all mount points as absolute 74directory paths separated by whitespace. 75The second is to specify the pathname of the root of the filesystem 76followed by the 77.Fl alldirs 78flag; 79this form allows the host(s) to mount at any point within the filesystem, 80including regular files if the 81.Fl r 82option is used on 83.Xr mountd 8 . 84The pathnames must not have any symbolic links in them and should not have 85any "." or ".." components. 86Mount points for a filesystem may appear on multiple lines each with 87different sets of hosts and export options. 88.Pp 89The second component of a line specifies how the filesystem is to be 90exported to the host set. 91The option flags specify whether the filesystem 92is exported read-only or read-write and how the client uid is mapped to 93user credentials on the server. 94.Pp 95Export options are specified as follows: 96.Pp 97.Sm off 98.Fl maproot No = Sy user 99.Sm on 100The credential of the specified user is used for remote access by root. 101The credential includes all the groups to which the user is a member 102on the local machine (see 103.Xr id 1 ) . 104The user may be specified by name or number. 105.Pp 106.Sm off 107.Fl maproot No = Sy user:group1:group2:... 108.Sm on 109The colon separated list is used to specify the precise credential 110to be used for remote access by root. 111The elements of the list may be either names or numbers. 112Note that user: should be used to distinguish a credential containing 113no groups from a complete credential for that user. 114.Pp 115.Sm off 116.Fl mapall No = Sy user 117.Sm on 118or 119.Sm off 120.Fl mapall No = Sy user:group1:group2:... 121.Sm on 122specifies a mapping for all client uids (including root) 123using the same semantics as 124.Fl maproot . 125.Pp 126The option 127.Fl r 128is a synonym for 129.Fl maproot 130in an effort to be backward compatible with older export file formats. 131.Pp 132In the absence of 133.Fl maproot 134and 135.Fl mapall 136options, remote accesses by root will result in using a credential of -2:-2. 137All other users will be mapped to their remote credential. 138If a 139.Fl maproot 140option is given, 141remote access by root will be mapped to that credential instead of -2:-2. 142If a 143.Fl mapall 144option is given, 145all users (including root) will be mapped to that credential in 146place of their own. 147.Pp 148The 149.Fl ro 150option specifies that the filesystem should be exported read-only 151(default read/write). 152The option 153.Fl o 154is a synonym for 155.Fl ro 156in an effort to be backward compatible with older export file formats. 157.Pp 158.Tn WebNFS 159exports strictly according to the spec (RFC 2054 and RFC 2055) can 160be done with the 161.Fl public 162flag. 163However, this flag in itself allows r/w access to all files in 164the filesystem, not requiring reserved ports and not remapping uids. 165It 166is only provided to conform to the spec, and should normally not be used. 167For a 168.Tn WebNFS 169export, 170use the 171.Fl webnfs 172flag, which implies 173.Fl public , 174.Sm off 175.Fl mapall No = Sy nobody 176.Sm on 177and 178.Fl ro . 179.Pp 180A 181.Sm off 182.Fl index No = Sy file 183.Sm on 184option can be used to specify a file whose handle will be returned if 185a directory is looked up using the public filehandle 186.Pq Tn WebNFS . 187This is to mimic the behavior of URLs. 188If no 189.Fl index 190option is specified, a directory filehandle will be returned as usual. 191The 192.Fl index 193option only makes sense in combination with the 194.Fl public 195or 196.Fl webnfs 197flags. 198.Pp 199Specifying the 200.Fl quiet 201option will inhibit some of the syslog diagnostics for bad lines in 202.Pa /etc/exports . 203This can be useful to avoid annoying error messages for known possible 204problems (see 205.Sx EXAMPLES 206below). 207.Pp 208The third component of a line specifies the host set to which the line applies. 209The set may be specified in three ways. 210The first way is to list the host name(s) separated by white space. 211(Standard Internet ``dot'' addresses may be used in place of names.) 212The second way is to specify a ``netgroup'' as defined in the netgroup file (see 213.Xr netgroup 5 ) . 214The third way is to specify an Internet subnetwork using a network and 215network mask that is defined as the set of all hosts with addresses within 216the subnetwork. 217This latter approach requires less overhead within the 218kernel and is recommended for cases where the export line refers to a 219large number of clients within an administrative subnet. 220.Pp 221The first two cases are specified by simply listing the name(s) separated 222by whitespace. 223All names are checked to see if they are ``netgroup'' names 224first and are assumed to be hostnames otherwise. 225Using the full domain specification for a hostname can normally 226circumvent the problem of a host that has the same name as a netgroup. 227The third case is specified by the flag 228.Sm off 229.Fl network No = Sy netname 230.Sm on 231and optionally 232.Sm off 233.Fl mask No = Sy netmask . 234.Sm on 235If the mask is not specified, it will default to the mask for that network 236class (A, B or C; see 237.Xr inet 4 ) . 238See the 239.Sx EXAMPLES 240section below. 241.Pp 242The 243.Xr mountd 8 244utility can be made to re-read the 245.Nm 246file by sending it a hangup signal as follows: 247.Bd -literal -offset indent 248kill -s HUP `cat /var/run/mountd.pid` 249.Ed 250.Pp 251After sending the 252.Dv SIGHUP , 253check the 254.Xr syslogd 8 255output to see whether 256.Xr mountd 8 257logged any parsing errors in the 258.Nm 259file. 260.Sh FILES 261.Bl -tag -width /etc/exports -compact 262.It Pa /etc/exports 263the default remote mount-point file 264.El 265.Sh EXAMPLES 266.Bd -literal -offset indent 267/usr /usr/local -maproot=0:10 friends 268/usr -maproot=daemon grumpy.cis.uoguelph.ca 131.104.48.16 269/usr -ro -mapall=nobody 270/u -maproot=bin: -network 131.104.48 -mask 255.255.255.0 271/u2 -maproot=root friends 272/u2 -alldirs -network cis-net -mask cis-mask 273/cdrom -alldirs,quiet,ro -network 192.168.33.0 -mask 255.255.255.0 274.Ed 275.Pp 276Given that 277.Sy /usr , 278.Sy /u 279and 280.Sy /u2 281are 282local filesystem mount points, the above example specifies the following: 283.Sy /usr 284is exported to hosts 285.Em friends 286where friends is specified in the netgroup file 287with users mapped to their remote credentials and 288root mapped to uid 0 and group 10. 289It is exported read-write and the hosts in ``friends'' can mount either /usr 290or /usr/local. 291It is exported to 292.Em 131.104.48.16 293and 294.Em grumpy.cis.uoguelph.ca 295with users mapped to their remote credentials and 296root mapped to the user and groups associated with ``daemon''; 297it is exported to the rest of the world as read-only with 298all users mapped to the user and groups associated with ``nobody''. 299.Pp 300.Sy /u 301is exported to all hosts on the subnetwork 302.Em 131.104.48 303with root mapped to the uid for ``bin'' and with no group access. 304.Pp 305.Sy /u2 306is exported to the hosts in ``friends'' with root mapped to uid and groups 307associated with ``root''; 308it is exported to all hosts on network ``cis-net'' allowing mounts at any 309directory within /u2. 310.Pp 311The filesystem rooted at 312.Sy /cdrom 313will exported read-only to the entire network 192.168.33.0/24, including 314all its subdirectories. 315Since 316.Sy /cdrom 317is the conventional mountpoint for a CD-ROM device, this export will 318fail if no CD-ROM medium is currently mounted there since that line 319would then attempt to export a subdirectory of the root filesystem 320with the 321.Fl alldirs 322option which is not allowed. 323The 324.Fl quiet 325option will then suppress the error message for this condition that 326would normally be syslogged. 327As soon as an actual CD-ROM is going to be mounted, 328.Xr mount 8 329will notify 330.Xr mountd 8 331about this situation, and the 332.Sy /cdrom 333filesystem will be exported as intended. 334Note that without using the 335.Fl alldirs 336option, the export would always succeed. 337While there is no CD-ROM medium mounted under 338.Sy /cdrom , 339it would export the (normally empty) directory 340.Sy /cdrom 341of the root filesystem instead. 342.Sh SEE ALSO 343.Xr netgroup 5 , 344.Xr mountd 8 , 345.Xr nfsd 8 , 346.Xr showmount 8 347.Sh BUGS 348The export options are tied to the local mount points in the kernel and 349must be non-contradictory for any exported subdirectory of the local 350server mount point. 351It is recommended that all exported directories within the same server 352filesystem be specified on adjacent lines going down the tree. 353You cannot specify a hostname that is also the name of a netgroup. 354Specifying the full domain specification for a hostname can normally 355circumvent the problem. 356