mfsexports.cfg
The file that says which clients may mount which directory, and on what terms. One line is one entry. Lines starting with # are comments.
[ip range] [path] [options]
Entries the file ships with
| Entry | Meaning |
|---|---|
* / rw,alldirs,admin,maproot=0:0 | Allow everything but "meta". |
* . rw | Allow "meta". |
Address
| Address | Meaning |
|---|---|
* | Any ip (same as 0.0.0.0/0). |
A.B.C.D | Single ip address. |
A.B.C.D-E.F.G.H | Range of ip addresses. |
A.B.C.D/XX | A.B.C.D network with XX bits netmask. |
A.B.C.D/E.F.G.H | A.B.C.D network with E.F.G.H netmask. |
Path
| Path | Meaning |
|---|---|
. | Special 'path' that means 'meta'. |
/... | Path in mfs structure. |
Options
| Option | Meaning |
|---|---|
ro | Export tree in read-only mode; this is default. |
rw | Export tree in read-write mode. |
readonly | Export tree in read-only mode; this is default. |
readwrite | Export tree in read-write mode. |
alldirs | Allows to mount any subdirectory of specified directory (similarly to NFS). |
dynamicip | Allows reconnecting of already authenticated client from any IP address (the default is to check IP address on reconnect). |
ignoregid | This option is deprecated and will be removed in a future release; disable testing of group access at mfsmaster level (it's still done at mfsmount level) - in this case "group" and "other" permissions are logically added. |
admin | Administrative privileges: changing quota values; storage classes management - adding, deleting, modifying; patterns management - adding, deleting; using storage classes with admin flag (setting, overwriting); manipulating UNDELETABLE, APPENDONLY and IMMUTABLE flags in filesystem objects. |
maproot=UID[:GID] | Treat all root (uid zero) operations as operations done by user with uid equal to UID and gid equal to GID (or default gid of this user if GID not specified); default is 999:999. |
mapall=UID[:GID] | Like above but for all operations (for both options UID and/or GID can be specified as username or groupname existing on master machine); if maproot is also defined, it takes priority for uid 0 operations. |
umask=0### | This umask is added (OR) to user's umask and the resulting umask is used in this mount point. |
sclassgroups=-|N[:N[:...]] | If this option is not defined, any storage class can be set by user in this mount point, if it is defined, only storage classes belonging to listed groups can be set; to define no groups (user cannot set any storage class) use '-' (minus) sign; for explanation on how to add a storage class to a group see manual page for mfsscadmin(1). |
password=TEXT | Force authentication using given password. |
md5pass=MD5 | Like above, but with password defined as it's MD5 hash (MD5 specified as 128-bit hexadecimal number). |
minversion=VER | Allow only clients with version number equal or greater than VER (VER can be specified as X or X.Y or X.Y.Z). |
mintrashretention=TIMEDURATION | Do not allow to set trashretention below TIMEDURATION (TIMEDURATION can be specified as number of seconds or combination of elements #W,#D,#H in set order). |
maxtrashretention=TIMEDURATION | Do not allow to set trashretention above TIMEDURATION (TIMEDURATION can be specified as above). |
disable=OPERATION[:OPERATION[:...]] | Do not allow the client to perform certain operations, operations can be specified as one parameter delimited with colon (:) or as single operations with disable option repeated many times. |
opslimit=OPS | Limit the number of i/o operations on client(mount) using this export to OPS per second; NOTE: there is no exception for root (uid 0) operations. |
opsperuidlimit=OPS | Limit the number of i/o operations per uid on client(mount) using this export to OPS per second; NOTE: root (uid 0) will not have any limit if this option is used. |
Operations that disable accepts
| Operation | Meaning |
|---|---|
chown | Don't allow the client to perform the chown operation. |
chmod | Don't allow the client to perform the chmod operation. |
symlink | Don't allow the client to create symbolic links. |
mkfifo | Don't allow the client to create FIFOs. |
mkdev | Don't allow the client to create devices. |
mksock | Don't allow the client to create sockets. |
mkdir | Don't allow the client to create directories. |
unlink | Don't allow the client to remove non directory objects (will also deny move/rename operation if target inode already exists!). |
rmdir | Don't allow the client to remove directories (will also deny move/rename operation if target inode already exists!). |
rename | Don't allow the client to change inodes (files, directories) names. |
move | Don't allow the client to move inodes (files, directories) to another path. |
link | Don't allow the client to create hard links. |
create | Don't allow the client to create new files. |
readdir | Don't allow the client to list directories ('ls' command will not work). |
read | Don't allow the client to read from files. |
write | Don't allow the client to write to files. |
truncate | Don't allow the client to shorten the length of a file with truncate command. |
setlength | Don't allow the client to increase the length of a file with truncate command. |
appendchunks | Don't allow the client to add chunks from one file to another (mfsappendchunks). |
snapshot | Don't allow the client to create snapshots. |
settrash | Don't allow the client to change trash retention time. |
setsclass | Don't allow the client to set storage classes. |
seteattr | Don't allow the client to set mfs extra attributes. |
setxattr | Don't allow the client to set XATTRs. |
setfacl | Don't allow the client to set ACLs. |
Time durations
| Value | Meaning |
|---|---|
2H | 2 hours. |
1d12h | 36 hours. |
48H | 48 hours = 2 days. |
12w | 12 weeks. |
2w6d | 20 days. |
Defaults
An export that names no option is exported with:
readonly,maproot=999:999,umask=0000,mintrashretention=0,maxtrashretention=4294967295
Note! Default value for maxtrashretention is impossible to be set by user, so if the value is not set, then it can be considered close to infinity, but if it is set, then the maximum is 65535 hours (~390 weeks).
Default value for sclassgroups is to allow all.
Examples
| Entry | Meaning |
|---|---|
* / ro | Users from any IP can mount root directory as a read-only file system. Local roots are mapped as users with uid:gid = 999:999. |
192.168.1.0/24 / rw | Users from IP 192.168.1.0-192.168.1.255 can mount root directory as a standard read/write file system. Local roots are mapped as users with uid:gid = 999:999. |
192.168.1.0/24 / rw,alldirs,maproot=0,password=passcode | Users from IP 192.168.1.0-192.168.1.255 when give password 'passcode' can mount any subdirectory as a standard read/write file system. Local roots are left unmapped. |
10.0.0.0-10.0.0.5 /test rw,maproot=nobody,password=test | Users from IP 10.0.0.0-10.0.0.5 when give password 'test' can mount 'test' subdirectory as a standard read/write file system. Local roots are mapped as 'nobody' users (usually uid=65534). |
10.1.0.0/255.255.0.0 /public rw,mapall=1000:1000 | Users from IP 10.1.0.0-10.1.255.255 can mount 'public' subdirectory as a standard read/write file system. All users are mapped as users with uid:gid = 1000:1000. |
10.2.0.0/16 / rw,alldirs,maproot=0,mintrashretention=1d12h,maxtrashretention=2w | Users from IP 10.2.0.0-10.2.255.255 can mount everything, but can't decrease trash retention below 36 hours nor increase it above 2 weeks. |
192.168.1.0/24 / rw,disable=unlink:rmdir:truncate | Users from IP 192.168.1.0-192.168.1.255 can mount root directory as a read/write file system, but with no possibility of removing any data. Local roots are mapped as users with uid:gid = 999:999. |
192.168.1.0/24 / rw,disable=unlink,disable=rmdir,disable=truncate | Same as above, just in different format. |
192.168.1.0/24 / rw,opslimit=5000 | Limit the total number of i/o operations to 5000 per second for users connecting from IP 192.168.1.0-192.168.1.255. |
192.168.1.0/24 / rw,opsperuidlimit=50 | Limit the number of i/o operations to 50 per second per uid for users connecting from IP 192.168.1.0-192.168.1.255; root (uid 0) will not be limited. |
192.168.1.0/24 / rw,opslimit=5000,opsperuidlimit=50 | Limit the total number of i/o operations to 5000 per second and the number of i/o operations per uid to 50 per second; root (uid 0) will not be limited by the per uid limit, but will be by the global one. |