Man Pages (1M): Maintenance and Administration Commands

share_nfs(1M)

NAME

share_nfs- Make local NFS file systems available for mounting by remote systems

SYNOPSIS

share

-d

description

-F

-o

specific_options

pathname

DESCRIPTION

The share utility makes local file systems available for mounting by remote systems.

If no argument is specified, then share displays all file systems currently shared, including NFS file systems and file systems shared through other distributed file system packages.

OPTIONS

The following options are supported:

-d description

Provide a comment that describes the file system to be shared.

-F nfs

Share NFS file system type.

-o specific_options

Specify specific_options in a comma-separated list of keywords and attribute-value-assertions for interpretation by the file-system-type-specific command. If specific_options is not specified, then by default sharing will be read-write to all clients.

specific_options can be any combination of the following:

aclok

Allows the NFS server to do access control for NFS Version 2 clients (running SunOS 2.4 or earlier). When aclok is set on the server, maximal access is given to all clients. For example, with aclok set, if anyone has read permissions, then everyone does. If aclok is not set, minimal access is given to all clients.

anon=uid

Set uid to be the effective user ID of unknown users. By default, unknown users are given the effective user ID UID_NOBODY. If uid is set to -1, access is denied.

index=file

Load file rather than a listing of the directory containing this file when the directory is referenced by an NFS URL.

kerberos

This option has been deprecated in favor of the sec=krb4 option.

nosub

Prevents clients from mounting subdirectories of shared directories. For example, if /exportF is shared with the nosub option on server fooey then a NFS client will not be able to do:

mount -F nfs fooey:/export/home/mnt

nosuid

By default, clients are allowed to create files on the shared file system with the setuid or setgid mode enabled. Specifying nosuid causes the server file system to silently ignore any attempt to enable the setuid or setgid mode bits.

nodevices

By default, clients are allowed to create block and character special devices on the shared file system. Specifying nodevices causes the server file system to prevent the creation of such devices.

nopriv

By default, clients are allowed to set forced privileges on files on the shared file system. Specifying nopriv causes the server file system to prevent the setting of forced privileges.

public

Enables NFS browsing of the file system by a Web NFS-enabled browser. Only one file system per server many use this option. The -ro=list and -rw=list options can be included with this option.

ro

Sharing will be read-only to all clients.

ro=access_list

Sharing will be read-only to the clients listed in access_list; overrides the rw suboption for the clients specified. See access_list below.

root=access_list

Only root users from the hosts specified in access_list will have root access. See access_list below. By default, no host has root access, so root users are mapped to an anonymous user ID (see the anon=uid option described above). Netgroups can be used if the file system shared is using UNIX authentication (AUTH_SYS).

rw

Sharing will be read-write to all clients.

rw=access_list

Sharing will be read-write to the clients listed in access_list; overrides the ro suboption for the clients specified. See access_list below.

sec=mode[:mode]...

Sharing will use one or more of the specified security modes. The mode in the sec=mode option must be a node name supported on the client. If the sec= option is not specified, the default security mode used is AUTH_SYS. Multiple sec= options can be specified on the command line, although each mode can appear only once. The security modes are defined in nfssec(5).

Each sec= option specifies modes that apply to any subsequent window=, rw, ro, rw=, ro= and root= options that are provided before another sec=option. Each additional sec= resets the security mode context, so that more window=, rw, ro, rw=, ro= and root= options can be supplied for additional modes.

sec=none

If the option sec=none is specified when the client uses AUTH_NONE, or if the client uses a security mode that is not one that the file system is shared with, then the credential of each NFS request is treated as unauthenticated. See the anon=uid option for a description of how unauthenticated requests are handled.

secure

This option has been deprecated in favor of the sec=dh option.

window=value

When sharing with sec=dh or sec=krb4 set the maximum life time (in seconds) of the RPC request's credential (in the authentication header) that the NFS server will allow. If a credential arrives with a life time larger than what is allowed, the NFS server will reject the request. The default value is 30000 seconds (8.3 hours).

`access_list`

The access_list argument is a colon-separated list whose components may be any number of the following:

hostname

The name of a host. With a server configured for DNS naming in the nsswitch "hosts" entry, any hostname must be represented as a fully qualified DNS name.

netgroup

A netgroup contains a number of hostnames. With a server configured for DNS naming in the nsswitch "hosts" entry, any hostname in a netgroup must be represented as a fully qualified DNS name.

DNS suffix

To use domain membership the server must use DNS to resolve hostnames to IP addresses; that is, the "hosts" entry in the /etc/nsswitch.conf specify "dns" ahead of "nis" or "nisplus", since only DNS returns the full domain name of the host. Other name services like NIS or NIS+ cannot be used to resolve hostnames on the server because when mapping an IP address to a hostname they do not return domain information. For example,

NIS or NIS+: 129.144.45.9 --> "myhost
DNS: 129.144.45.9 --> "myhost.mydomain.mycompany.com"

The DNS suffix is distinguished from hostnames and netgroups by a prefixed dot. For example,

rw=.mydomain.mycompany.com

A single dot can be used to match a hostname with no suffix. For example,

rw=.

will match "mydomain" but not "mydomain.mycompany.com". This feature can be used to match hosts resolved through NIS and NIS+ rather than DNS.

network

The network or subnet component is preceded by an at-sign (@). It can be either a name or a dotted address. If a name, it will be converted to a dotted address by getnetbyname(3N). For example,

=@mynet

would be equivalent to:

=@129.144 or =@129.144.0.0

The network prefix assumes an octet aligned netmask determined from the zero octets in the low-order part of the address. In the case where network prefixes are not byte-aligned, the syntax will allow a mask length to be specified explicitly following a slash (/) delimiter. For example,

=@mynet/17 or rw=@129.144.132/17

where the mask is the number of leftmost contiguous significant bits in the corresponding IP address.

A prefixed minus sign (-) denies access to that component of access_list. The list is searched sequentially until a match is found that either grants or denies access, or until the end of the list is reached. For example, if host "terra" is in the "engineering" netgroup, then

rw=-terra:engineering

will deny access to terra but

rw=engineering:-terra

will grant access to terra.

OPERANDS

The following operands are supported:

pathname: The pathname of the file system to be shared.

EXIT STATUS

The following exit values are returned:

0: Successful completion.
>0: An error occurred.

SUMMARY OF TRUSTED SOLARIS CHANGES

The nodevices and nopriv options have been added.

When invoked with no option or with only the option -F FSType, the share_nfs command displays shared file systems. For all other cases, the command must be run with an effective UID of 0. If the shared file is of the type NFS, then the sys_nfs privilege is also required. If the file /etc/dfs/sharetab does not exist, this command will create it; therefore this command must be run at the sensitivity label ADMIN_LOW. If the file /etc/dfs/sharetab exists, this command can be run at any other sensitivity label if it has the file_mac_write privilege. To succeed in all cases, this command needs the file_mac_read and file_mac_search privileges.

FILES

/etc/dfs/dfstab: List of share commands to be executed at boot time.
/etc/dfs/fstypes: List of system types, NFS by default.
/etc/dfs/sharetab: System record of shared file systems.

ATTRIBUTES

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWcsu

Trusted Solaris 7 Reference Manual

mount(1M), mountd(1M), nfsd(1M), share(1M), unshare(1M)

SunOS 5.7 Reference Manual

getnetbyname(3N), netgroup(4), attributes(5), nfssec(5)

NOTES

If the sec= option is presented at least once, all uses of the window=, rw, ro, rw=, ro=, and root= options must come after the first sec= option. If the sec= option is not presented, then sec=sys is implied.

If one or more explicit sec= options are presented, sys must appear in one of the options mode lists for accessing using the AUTH_SYS security mode to be allowed. For example:

share -F nfs /var
share -F nfs -o sec=sys /var

AUTH_SYS

share -F nfs -o sec=dh /var

AUTH_SYS

Unlike previous implementations of share_nfs(1M), access checking for the window=, rw, ro, rw=, and ro= options is done per NFS request, instead of per mount request.

Combining multiple security modes can be a security hole is situations where the ro= and rw= options are used to control access to weaker security modes. In this example,

share -F nfs -o sec=dh,rw,sec=sys,rw=hosta /var

hosta

AUTH_DES

share -F nfs -o sec=dh,rw,sec=sys,ro /var

AUTH_DES

share

If rw= and ro= options are specified in the same sec= clause, and a client is in both lists, the order of the two options determines the access the client gets. If client hosta is in two netgroups - group1 and group2 - in this example, the client would get read-only access:

share -F nfs -o ro=group1,rw=group2 /var

In this example hosta would get read-write access:

share -F nfs -o rw=group2,ro=group1 /var

If within a sec= clause, both the ro and rw= options are specified, for compatibility, the order of the options rule is not enforced. All hosts would get read-only access, with the exception to those in the read-write list. Likewise, if the ro= and rw options are specified, all hosts get read-write access with the exceptions of those in the read-only list.

The ro= and rw= options are guaranteed to work over UDP and TCP but may not work over other transport providers.

The root= option with AUTH_SYS is guaranteed to work over UDP and TCP but may not work over other transport providers.

The root= option with AUTH_DES and AUTH_KERB is guaranteed to work over any transport provider.

There are no interactions between the root= option and the rw, ro, rw=, and ro= options. Putting a host in the root list does not override the semantics of the other options. The access the host gets is the same as when the root= options is absent. For example, the following share command will deny access to hostb:

share -F nfs -o ro=hosta,root=hostb /var

The following will give read-only permissions to hostb:

share -F nfs -o ro=hostb,root=hostb /var

hostb

share -F nfs -o ro=hosta,rw=hostb,root=hostb /var

If the file system being shared is a symbolic link to a valid pathname, the canonical path (the path which the symbolic link follows) will be shared. For example, if /export/foo is a symbolic link to /export/bar (/export/foo -> /export/bar), the following share command will result in /export/bar as the shared pathname (and not /export/foo).

example# share -F nfs /export/foo

server:/export/foo

server:/export/bar

This line in the /etc/dfs/dfstab file will share the /disk file system read-only at boot time:

share -F nfs -o ro /disk

/disk

/etc/dfs/dfstab

mountd(1M)

nfsd(1M)