| blob | 5b736de81cd74346b6b93e28d3ce09849980c9b8 |
1 '\" te
2 .\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
4 .\" See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with
5 .\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH SHAREMGR 1M "Sep 21, 2009"
7 .SH NAME
8 sharemgr \- configure and manage file sharing
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fBsharemgr\fR \fIsubcommand\fR [\fIoptions\fR]
13 .fi
15 .LP
16 .nf
17 \fBadd-share\fR [\fB-nth\fR] [\fB-r\fR \fIresource-name\fR] [\fB-d\fR "\fIdescription text\fR"]
18 \fB-s\fR \fIsharepath\fR \fIgroup\fR
19 .fi
21 .LP
22 .nf
23 \fBcreate\fR [\fB-nvh\fR] [\fB-P\fR \fIproto\fR [\fB-p\fR \fIproperty\fR=\fIvalue\fR]] \fIgroup\fR
24 .fi
26 .LP
27 .nf
28 \fBdelete\fR [\fB-nvh\fR] [\fB-P\fR \fIproto\fR] [\fB-f\fR] \fIgroup\fR
29 .fi
31 .LP
32 .nf
33 \fBdisable\fR [\fB-nvh\fR] [\fB-a\fR | \fIgroup\fR...]
34 .fi
36 .LP
37 .nf
38 \fBenable\fR [\fB-nvh\fR] [\fB-a\fR | \fIgroup\fR...]
39 .fi
41 .LP
42 .nf
43 \fBlist\fR [\fB-vh\fR] [\fB-P\fR \fIproto\fR]
44 .fi
46 .LP
47 .nf
48 \fBmove-share\fR [\fB-nv\fR] \fB-s\fR \fIsharepath\fR \fIdestination-group\fR
49 .fi
51 .LP
52 .nf
53 \fBremove-share\fR [\fB-fnvh\fR] \fB-s\fR \fIsharepath\fR \fIgroup\fR
54 .fi
56 .LP
57 .nf
58 \fBset\fR [\fB-nvh\fR] \fB-P\fR \fIproto\fR [\fB-p\fR \fIproperty\fR=\fIvalue\fR]... [\fB-S\fR \fIoptionset\fR]
59 [\fB-s\fR \fIsharepath\fR] \fIgroup\fR
60 .fi
62 .LP
63 .nf
64 \fBset-share\fR [\fB-nh\fR] [\fB-r\fR \fIresource\fR] [\fB-d\fR "\fIdescription text\fR"]
65 \fB-s\fR \fIsharepath\fR \fIgroup\fR
66 .fi
68 .LP
69 .nf
70 \fBshow\fR [\fB-pvxh\fR] [\fB-P\fR \fIproto\fR] [\fIgroup\fR]...
71 .fi
73 .LP
74 .nf
75 \fBunset\fR [\fB-nvh\fR] \fB-P\fR \fIproto\fR [\fB-S\fR \fIoptionset\fR] [\fB-p\fR \fIproperty\fR]...
76 \fIgroup\fR
77 .fi
79 .LP
80 .nf
81 \fBshare\fR [\fB-F\fR \fIfstype\fR] [\fB-p\fR] [\fB-o\fR \fIoptionlist\fR] [\fB-d\fR \fIdescription\fR]
82 [\fIpathname\fR [\fIresourcename\fR]]
83 .fi
85 .LP
86 .nf
87 \fBunshare\fR [\fB-F\fR \fIfstype\fR] [\fB-p\fR] [\fB-o\fR \fIoptionlist\fR] \fIsharepath\fR
88 .fi
90 .SH DESCRIPTION
91 .sp
92 .LP
93 The \fBsharemgr\fR command configures share groups and the shares contained
94 within them.
95 .sp
96 .LP
97 A group name must conform to service management facility (SMF) (see
98 \fBsmf\fR(5)) service-naming conventions, thus is limited to starting with an
99 alphabetic character, with the rest of the name consisting only of alphanumeric
100 characters plus \fB-\fR (hyphen) and \fB_\fR (underbar).
101 .sp
102 .LP
103 Subcommands that result in a configuration change support a dry-run option.
104 When dry-run (\fB-n\fR) is specified, the syntax and validity of the command is
105 tested but the configuration is not actually updated.
106 .sp
107 .LP
108 For all subcommands, the \fB-h\fR option lists usage and help information.
109 .sp
110 .LP
111 For subcommands with the verbose (\fB-v\fR) option, additional information will
112 be provided. For example, in conjunction with the \fB-n\fR option, verbose mode
113 will also indicate whether the current user has sufficient permissions to
114 accomplish the operation.
115 .sp
116 .LP
117 There are two groups that are created automatically. The \fBdefault\fR group
118 always exists and covers legacy NFS shares only. The \fBzfs\fR group will be
119 created when ZFS shares are enabled.
120 .sp
121 .LP
122 The options shown in the SYNOPSIS section are described in the context of each
123 subcommand. All subcommands except \fBlist\fR and \fBshow\fR require root
124 privileges or that you assume the Primary Administrator role.
125 .SS "Subcommands"
126 .sp
127 .LP
128 With no subcommand entered, a \fBsharemgr\fR command with the \fB-h\fR option
129 displays a usage message for all subcommands.
130 .sp
131 .LP
132 The following subcommands follow \fBsharemgr\fR on a command line. Commands
133 take the form:
134 .sp
135 .in +2
136 .nf
137 % \fBsharemgr \fI<subcommand>\fR [\fIoptions\fR]\fR
138 .fi
139 .in -2
140 .sp
142 .sp
143 .ne 2
144 .na
145 \fB\fBcreate\fR \fB[-nvh] [-P \fIproto\fR [-p \fIproperty\fR=\fIvalue\fR]]
146 \fIgroup\fR\fR\fR
147 .ad
148 .sp .6
149 .RS 4n
150 Create a new group with specified name.
151 .sp
152 If \fB-n\fR is specified, the command checks only the validity of the command
153 and that the group does not already exist.
154 .sp
155 If no protocol is specified, all known protocols are enabled for the specified
156 group. If a protocol is specified, only that protocol is enabled. You can
157 specify properties for a specified protocol.
158 .sp
159 If \fIgroup\fR exists, use of \fB-P\fR adds the specified protocol to that
160 group.
161 .sp
162 As an example of the \fBcreate\fR subcommand, the following command creates a
163 new group with the name \fBmygroup\fR.
164 .sp
165 .in +2
166 .nf
167 # \fBsharemgr create mygroup\fR
168 .fi
169 .in -2
170 .sp
172 Because no protocol was specified in the preceding command, all defined
173 protocols will be enabled on the group.
174 .RE
176 .sp
177 .ne 2
178 .na
179 \fB\fBdelete\fR \fB[-nvh] [-P \fIproto\fR] [-f] \fIgroup\fR\fR\fR
180 .ad
181 .sp .6
182 .RS 4n
183 Delete the specified group. If the group is not empty, you can use the \fB-f\fR
184 option to force the deletion, which unshares and removes all shares from the
185 group before removing the group itself.
186 .sp
187 If you specify a protocol, rather than deleting the whole group, this
188 subcommand deletes the protocol from the group.
189 .sp
190 The \fB-n\fR option can be used to test the syntax of the command.
191 .sp
192 As an example, the following command removes the group \fBmygroup\fR from the
193 configuration if it is empty.
194 .sp
195 .in +2
196 .nf
197 # \fBsharemgr delete mygroup\fR
198 .fi
199 .in -2
200 .sp
202 The following command removes any existing shares prior to removing the group.
203 .sp
204 .in +2
205 .nf
206 # \fBsharemgr delete -f mygroup\fR
207 .fi
208 .in -2
209 .sp
211 Note the use of the force (\fB-f\fR) option, above.
212 .RE
214 .sp
215 .ne 2
216 .na
217 \fB\fBlist\fR \fB[-vh] [-P \fIproto\fR]\fR\fR
218 .ad
219 .sp .6
220 .RS 4n
221 List the defined groups.
222 .sp
223 If a protocol is specified, list only those groups that have the specified
224 protocol defined.
225 .sp
226 If the verbose option is specified, the current state of the group and all
227 protocols enabled on the group are listed as well. For example:
228 .sp
229 .in +2
230 .nf
231 # \fBsharemgr list -v\fR
232 mygroup enabled nfs
233 rdonlygrp disabled nfs
234 .fi
235 .in -2
236 .sp
238 .RE
240 .sp
241 .ne 2
242 .na
243 \fB\fBshow\fR \fB[-pvxh] [-P \fIproto\fR] [\fIgroup\fR...]\fR\fR
244 .ad
245 .sp .6
246 .RS 4n
247 Shows the contents of the specified group(s).
248 .sp
249 If the verbose option is specified, the resource name and description of each
250 share is displayed if they are defined. Otherwise, only the share paths are
251 displayed. Also, when temporary shares are listed, they are prefixed with an
252 asterisk (\fB*\fR).
253 .sp
254 If the \fB-p\fR option is specified, all options defined for the protocols of
255 the group are displayed, in addition to the display without options. If the
256 \fB-P\fR option is used, the output is limited to those groups that have the
257 specified protocol enabled. If the \fB-x\fR option is specified, output is in
258 XML format and the \fB-p\fR and \fB-v\fR options are ignored, because all
259 information is included in the XML.
260 .sp
261 The following example illustrates the use of the \fB-p\fR option.
262 .sp
263 .in +2
264 .nf
265 # \fBsharemgr show -p mygroup\fR
266 default nfs=()
267 * /data/backup
268 mygroup nfs=(nosuid=true)
269 /export/home/home0
270 /export/home/home1
271 .fi
272 .in -2
273 .sp
275 The following example illustrates the use of the \fB-v\fR option.
276 .sp
277 .in +2
278 .nf
279 # \fBsharemgr show -v mygroup\fR
280 mygroup
281 HOME0=/export/home/home0 "Home directory set 0"
282 HOME1=/export/home/home1 "Home directory set 1"
283 .fi
284 .in -2
285 .sp
287 ZFS managed shares are handled in a way similar to the way NFS shares are
288 handled. These shares appear as subgroups within the parent group \fBzfs\fR.
289 The subgroups are always prefixed with \fBzfs/\fR and use the ZFS dataset name
290 for the rest of the name. The mount point and any sub-mounts that inherit
291 sharing are shown as the shares of the subgroup. For example:
292 .sp
293 .in +2
294 .nf
295 # \fBsharemgr show -vp zfs\fR
296 zfs nfs=()
297 zfs/ztest
298 /ztest
299 /ztest/backups
300 .fi
301 .in -2
302 .sp
304 .RE
306 .sp
307 .ne 2
308 .na
309 \fB\fBset\fR \fB[-nvh] -P \fIproto\fR [-S \fIoptionset\fR] [-p
310 \fIproperty\fR=\fIvalue\fR]* [-s \fIshare path\fR] \fIgroup\fR\fR\fR
311 .ad
312 .sp .6
313 .RS 4n
314 Set protocol-specific properties on the specified group.
315 .sp
316 The \fB-P\fR option is required and must specify a valid protocol.
317 .sp
318 Optionsets are protocol-specific sets of properties that can be negotiated by
319 the protocol client. For NFS, optionsets are equivalent to security modes as
320 defined in \fBnfssec\fR(5). If \fB-S\fR \fIoptionset\fR is specified, the
321 properties are applied to the selected optionset. Otherwise they are applied to
322 the general optionset.
323 .sp
324 Together, \fB-P\fR and \fB-S\fR select a specific view of the group's options
325 on which to work.
326 .sp
327 Property values are strings. A specified property is set to a new value if the
328 property already exists or is added to the protocol if it does not already
329 exist.
330 .sp
331 In the general case, at least one property must be set. If \fB-S\fR is
332 specified, properties can be omitted and the specified optionset is enabled for
333 the protocol.
334 .sp
335 The \fB-s\fR option allows setting properties on a per-share basis. While this
336 is supported, it should be limited to managing legacy shares and to the
337 occasional need for an override of a group-level property or placing an
338 additional property on one share within a group.
339 .sp
340 An example of this subcommand:
341 .sp
342 .in +2
343 .nf
344 # \fBsharemgr set -P nfs -p anon=1234 mygroup\fR
345 .fi
346 .in -2
347 .sp
349 The preceding command adds the property \fBanon=1234\fR to the \fBnfs\fR view
350 of group \fBmygroup\fR. If \fBmygroup\fR has existing shares, they will all be
351 reshared with the new property value(s).
352 .RE
354 .sp
355 .ne 2
356 .na
357 \fB\fBunset\fR \fB[-nvh] -P proto [-S \fIoptionset\fR] [-p \fIproperty\fR]* [-s
358 \fIsharepath\fR ] \fIgroup\fR\fR\fR
359 .ad
360 .sp .6
361 .RS 4n
362 Unset the specified properties for the protocol or for the specified
363 \fIoptionset\fR of the protocol.
364 .sp
365 In the general case, at least one property must be set. If \fB-S\fR is
366 specified, properties can be omitted and the specified optionset is removed
367 from the protocol.
368 .sp
369 The \fB-s\fR option allows removing a share-specific property.
370 .sp
371 An example of this subcommand:
372 .sp
373 .in +2
374 .nf
375 # \fBsharemgr unset -P nfs -p anon mygroup\fR
376 .fi
377 .in -2
378 .sp
380 The preceding command removes the \fBanon=\fR property from the \fBnfs\fR view
381 of group \fBmygroup\fR. If \fBmygroup\fR has existing shares, they will all be
382 reshared with the new property value(s).
383 .RE
385 .sp
386 .ne 2
387 .na
388 \fB\fBadd-share\fR \fB[-nth] [-r \fIresource-name\fR] [-d "\fIdescription
389 text\fR"] -s \fIsharepath\fR \fIgroup\fR\fR\fR
390 .ad
391 .sp .6
392 .RS 4n
393 Add a new share to the specified group.
394 .sp
395 The \fB-s\fR option is mandatory and takes a full directory path.
396 .sp
397 If either or both of \fB-d\fR and \fB-r\fR are specified, they specify values
398 associated with the share. \fB-d\fR provides a description string to document
399 the share and \fB-r\fR provides a protocol-independent resource name. Resource
400 names are not used by NFS at this time but can be specified. These names
401 currently follow the same naming rules as group names.
402 .sp
403 The temporary option (\fB-t\fR) results in the share being shared but not
404 stored in the configuration repository. This option is intended for shares that
405 should not survive a reboot or server restart, or for testing purposes.
406 Temporary shares are indicated in the \fBshow\fR subcommand output with an
407 asterisk (\fB*\fR) preceding the share.
408 .sp
409 If \fIsharepath\fR is a ZFS path and that path is added to the \fBzfs\fR group,
410 \fBsharemgr\fR creates a new ZFS subgroup; the new share is added to that
411 subgroup. Any ZFS sub-filesystems under the ZFS filesystem designated by
412 \fIsharepath\fR will inherit the shared status of \fIsharepath\fR.
413 .sp
414 The effect of the \fBadd-share\fR subcommand on a ZFS dataset is determined by
415 the values of the \fBsharesmb\fR and \fBsharenfs\fR properties of that dataset.
416 .sp
417 See \fBzfs\fR(1M) for a description of the \fBsharesmb\fR and \fBsharenfs\fR
418 properties.
419 .sp
420 The following are examples of the \fBadd-share\fR subcommand.
421 .sp
422 .in +2
423 .nf
424 # \fBsharemgr add-share -s /export/home/home0 -d "home \e
425 directory set 0" -r HOME0 mygroup\fR
427 # \fBsharemgr add-share -s /export/home/home1 -d "home \e
428 directory set 1" -r HOME1 mygroup\fR
429 .fi
430 .in -2
431 .sp
433 The preceding commands add \fB/export/home/home0\fR and
434 \fB/export/home/home1\fR to the group \fBmygroup\fR. A descriptive comment and
435 a resource name are included.
436 .RE
438 .sp
439 .ne 2
440 .na
441 \fB\fBmove-share\fR \fB[-nvh] -s \fIsharepath\fR \fIdestination-group\fR\fR\fR
442 .ad
443 .sp .6
444 .RS 4n
445 Move the specified share from the group it is currently in to the specified
446 destination group. The \fBmove-share\fR subcommand does not create a group. A
447 specified group must exist for the command to succeed.
448 .sp
449 The following is an example of this subcommand.
450 .sp
451 .in +2
452 .nf
453 # \fBsharemgr move-share -s /export/home/home1 newgroup\fR
454 .fi
455 .in -2
456 .sp
458 Assuming \fB/export/home/home1\fR is in the group \fBmygroup\fR, the preceding
459 command moves \fB/export/home/home1\fR to the group \fBnewgroup\fR and unshares
460 and then reshares the directory with the properties associated with
461 \fBnewgroup\fR.
462 .RE
464 .sp
465 .ne 2
466 .na
467 \fB\fBremove-share\fR \fB[-fnvh] -s \fIsharepath\fR \fIgroup\fR\fR\fR
468 .ad
469 .sp .6
470 .RS 4n
471 Remove the specified share from the specified group. The force (\fB-f\fR)
472 option forces the share to be removed even if it is busy.
473 .sp
474 You must specify the full path for \fIsharepath\fR. For group, use the subgroup
475 as displayed in the output of the \fBsharemgr show\fR command. Note that if
476 there are subshares that were created by inheritance, these will be removed,
477 along with the parent shares.
478 .RE
480 .sp
481 .ne 2
482 .na
483 \fB\fBset-share\fR \fB[-nvh] [-r \fIresource\fR] [-d "\fIdescription text\fR"]
484 -s \fIsharepath\fR \fIgroup\fR\fR\fR
485 .ad
486 .sp .6
487 .RS 4n
488 Set or change the specified share's description and resource values. One use of
489 \fBset-share\fR is to rename a resource. The syntax for this use of the
490 subcommand is:
491 .sp
492 .in +2
493 .nf
494 # \fBsharemgr set-share -r \fIcurrent_name\fR=\fInew_name\fR -s \fIsharepath\fR \fIgroup\fR\fR
495 .fi
496 .in -2
497 .sp
499 .RE
501 .sp
502 .ne 2
503 .na
504 \fB\fBenable\fR \fB[-nvh] [\fIgroup\fR... | -a]\fR\fR
505 .ad
506 .sp .6
507 .RS 4n
508 Enable the specified group(s), or (with \fB-a\fR) all groups, and start sharing
509 the contained shares. This state persists across reboots.
510 .sp
511 An enabled group will be shared whenever the corresponding SMF service instance
512 is enabled. \fBsharemgr\fR will start the SMF service instance if it is not
513 currently online.
514 .RE
516 .sp
517 .ne 2
518 .na
519 \fB\fBdisable\fR \fB[-nvh] [\fIgroup\fR... | -a]\fR\fR
520 .ad
521 .sp .6
522 .RS 4n
523 Disable the specified group(s), or (with \fB-a\fR) all groups, and unshare the
524 shares that they contain. This state persists across reboots.
525 .sp
526 A disabled group will not be shared even if the corresponding SMF service
527 instance is online. This feature is useful when you do not want a group of
528 shares to be started at boot time.
529 .RE
531 .sp
532 .ne 2
533 .na
534 \fB\fBstart\fR \fB[-vh] [-P \fIproto\fR] [\fIgroup\fR... | -a]\fR\fR
535 .ad
536 .sp .6
537 .RS 4n
538 Start the specified group, or (with \fB-a\fR) all groups. The \fBstart\fR
539 subcommand is similar to \fBenable\fR in that all shares are started, but
540 \fBstart\fR works only on groups that are enabled. \fBstart\fR is used by the
541 SMF to start sharing at system boot.
542 .sp
543 A group will not start sharing if it is in the \fBsharemgr\fR \fBdisabled\fR
544 state. However, the corresponding SMF service instance will be started.
545 .sp
546 Note that the \fBstart\fR subcommand is similar to the \fBshareall\fR(1M)
547 command in that it starts up only the configured shares. That is, the enabled
548 shares will start being shared, but the configuration state is left the same.
549 The command:
550 .sp
551 .in +2
552 .nf
553 # \fBsharemgr start -a\fR
554 .fi
555 .in -2
556 .sp
558 \&...is equivalent to:
559 .sp
560 .in +2
561 .nf
562 # \fBshareall\fR
563 .fi
564 .in -2
565 .sp
567 .RE
569 .sp
570 .ne 2
571 .na
572 \fB\fBstop\fR \fB[-vh] [-P \fIproto\fR] [\fIgroup\fR... | -a]\fR\fR
573 .ad
574 .sp .6
575 .RS 4n
576 Stop the specified group, or (with \fB-a\fR) all groups. The \fBstop\fR
577 subcommand is similar to \fBdisable\fR in that all shares are no longer shared,
578 but it works only on groups that are enabled. \fBstop\fR is used by the SMF to
579 stop sharing at system shutdown.
580 .sp
581 Note that the \fBstop\fR subcommand is similar to the \fBunshareall\fR(1M)
582 command in that all active shares are unshared, but the configuration is left
583 the same. That is, the shares are stopped but the service instances are left
584 enabled. The command:
585 .sp
586 .in +2
587 .nf
588 # \fBsharemgr stop -a\fR
589 .fi
590 .in -2
591 .sp
593 \&...is equivalent to:
594 .sp
595 .in +2
596 .nf
597 # \fBunshareall\fR
598 .fi
599 .in -2
600 .sp
602 .RE
604 .sp
605 .ne 2
606 .na
607 \fB\fBshare\fR \fB[-F \fIfstype\fR] [-p] [-o \fIoptionlist\fR] [-d
608 \fIdescription\fR] [\fIpathname\fR [\fIresourcename\fR]]\fR\fR
609 .ad
610 .sp .6
611 .RS 4n
612 Shares the specified path in the \fBdefault\fR share group. This subcommand
613 implements the \fBshare\fR(1M) functionality. Shares that are shared in this
614 manner will be transient shares. Use of the \fB-p\fR option causes the shares
615 to be persistent.
616 .RE
618 .sp
619 .ne 2
620 .na
621 \fB\fBunshare\fR \fB[-F \fIfstype\fR] [-p] [-o \fIoptionlist\fR]
622 \fIsharepath\fR\fR\fR
623 .ad
624 .sp .6
625 .RS 4n
626 Unshares the specified share. This subcommand implements the \fBunshare\fR(1M)
627 functionality. By default, the \fBunshare\fR is temporary. The \fB-p\fR option
628 is provided to remove the share from the configuration in a way that persists
629 across reboots.
630 .RE
632 .SS "Supported Properties"
633 .sp
634 .LP
635 Properties are protocol-specific. Currently, only the NFS and SMB protocols are
636 supported. Properties have the following characteristics:
637 .RS +4
638 .TP
639 .ie t \(bu
640 .el o
641 Values of type \fIboolean\fR take either \fBtrue\fR or \fBfalse\fR.
642 .RE
643 .RS +4
644 .TP
645 .ie t \(bu
646 .el o
647 Values of type \fIvalue\fR take a numeric value.
648 .RE
649 .RS +4
650 .TP
651 .ie t \(bu
652 .el o
653 Values of type \fIfile\fR take a file name and not a file path.
654 .RE
655 .RS +4
656 .TP
657 .ie t \(bu
658 .el o
659 Values of type \fIaccess-list\fR are described in detail following the
660 descriptions of the NFS properties.
661 .RE
662 .sp
663 .LP
664 The general properties supported for NFS are:
665 .sp
666 .ne 2
667 .na
668 \fB\fBabe=\fR\fIboolean\fR\fR
669 .ad
670 .sp .6
671 .RS 4n
672 Set the access-based enumeration (ABE) policy for a share. When set to
673 \fBtrue\fR, ABE filtering is enabled on this share and directory entries to
674 which the requesting user has no access will be omitted from directory listings
675 returned to the client. When set to \fBfalse\fR or not defined, ABE filtering
676 will not be performed on this share. This property is not defined by default.
677 .sp
678 .ne 2
679 .na
680 \fB\fBdisabled\fR\fR
681 .ad
682 .sp .6
683 .RS 4n
684 Disable ABE for this share.
685 .RE
687 .sp
688 .ne 2
689 .na
690 \fB\fBenabled\fR\fR
691 .ad
692 .sp .6
693 .RS 4n
694 Enable ABE for this share.
695 .RE
697 .RE
699 .sp
700 .ne 2
701 .na
702 \fB\fBaclok=\fIboolean\fR\fR\fR
703 .ad
704 .sp .6
705 .RS 4n
706 Allows the NFS server to do access control for NFS Version 2 clients (running
707 SunOS 2.4 or earlier). When \fBaclok\fR is set on the server, maximum access is
708 given to all clients. For example, with \fBaclok\fR set, if anyone has read
709 permissions, then everyone does. If \fBaclok\fR is not set, minimum access is
710 given to all clients.
711 .RE
713 .sp
714 .ne 2
715 .na
716 \fB\fBad-container\fR\fR
717 .ad
718 .sp .6
719 .RS 4n
720 Specifies the AD container in which to publish shares.
721 .sp
722 The AD container is specified as a comma-separated list of attribute name-value
723 pairs using the LDAP distinguished name (DN) or relative distinguished name
724 (RDN) format. The DN or RDN must be specified in LDAP format using the
725 \fBcn=\fR, \fBou=\fR, and \fBdc=\fR prefixes:
726 .RS +4
727 .TP
728 .ie t \(bu
729 .el o
730 \fBcn\fR represents the common name
731 .RE
732 .RS +4
733 .TP
734 .ie t \(bu
735 .el o
736 \fBou\fR represents the organizational unit
737 .RE
738 .RS +4
739 .TP
740 .ie t \(bu
741 .el o
742 \fBdc\fR represents the domain component
743 .RE
744 \fBcn=\fR, \fBou=\fR and \fBdc=\fR are attribute types. The attribute type used
745 to describe an object's RDN is called the naming attribute, which, for ADS,
746 includes the following object classes:
747 .RS +4
748 .TP
749 .ie t \(bu
750 .el o
751 \fBcn\fR for the \fBuser\fR object class
752 .RE
753 .RS +4
754 .TP
755 .ie t \(bu
756 .el o
757 \fBou\fR for the organizational unit (\fBOU\fR) object class
758 .RE
759 .RS +4
760 .TP
761 .ie t \(bu
762 .el o
763 \fBdc\fR for the \fBdomainDns\fR object class
764 .RE
765 .RE
767 .sp
768 .ne 2
769 .na
770 \fB\fBanon=\fIuid\fR\fR\fR
771 .ad
772 .sp .6
773 .RS 4n
774 Set \fIuid\fR to be the effective user ID of unknown users. By default, unknown
775 users are given the effective user ID \fBUID_NOBODY\fR. If uid is set to
776 \fB-1\fR, access is denied.
777 .RE
779 .sp
780 .ne 2
781 .na
782 \fB\fBcatia=\fIboolean\fR\fR\fR
783 .ad
784 .sp .6
785 .RS 4n
786 CATIA V4 uses characters in file names that are considered to be invalid by
787 Windows. CATIA V5 is available on Windows. A CATIA V4 file could be
788 inaccessible to Windows clients if the file name contains any of the characters
789 that are considered illegal in Windows. By default, CATIA character
790 substitution is not performed.
791 .sp
792 If the \fBcatia\fR property is set to true, the following character
793 substitution is applied to file names.
794 .sp
795 .in +2
796 .nf
797 CATIA CATIA
798 V4 UNIX V5 Windows
799 " \e250 0x00a8 Dieresis
800 * \e244 0x00a4 Currency Sign
801 / \e370 0x00f8 Latin Small Letter O with Stroke
802 : \e367 0x00f7 Division Sign
803 < \e253 0x00ab Left-Pointing Double Angle Quotation Mark
804 > \e273 0x00bb Right-Pointing Double Angle Quotation Mark
805 ? \e277 0x00bf Inverted Question Mark
806 \e \e377 0x00ff Latin Small Letter Y with Dieresis
807 | \e246 0x00a6 Broken Bar
808 .fi
809 .in -2
810 .sp
812 .RE
814 .sp
815 .ne 2
816 .na
817 \fB\fBcksum=\fIcksumlist\fR\fR\fR
818 .ad
819 .sp .6
820 .RS 4n
821 Set the share to attempt to use end-to-end checksums. The value \fIcksumlist\fR
822 specifies the checksum algorithms that should be used.
823 .RE
825 .sp
826 .ne 2
827 .na
828 \fB\fBcsc=\fR\fIvalue\fR\fR
829 .ad
830 .sp .6
831 .RS 4n
832 Set the client-side caching policy for a share. Client-side caching is a client
833 feature and offline files are managed entirely by the clients.
834 .sp
835 .LP
836 The following are valid values for the \fBcsc\fR property:
837 .RS +4
838 .TP
839 .ie t \(bu
840 .el o
841 \fBmanual\fR \fB-\fR Clients are permitted to cache files from the specified
842 share for offline use as requested by users. However, automatic file-by-file
843 reintegration is not permitted. \fBmanual\fR is the default value.
844 .RE
845 .RS +4
846 .TP
847 .ie t \(bu
848 .el o
849 \fBauto\fR \fB-\fR Clients are permitted to automatically cache files from the
850 specified share for offline use and file-by-file reintegration is permitted.
851 .RE
852 .RS +4
853 .TP
854 .ie t \(bu
855 .el o
856 \fBvdo\fR \fB-\fR Clients are permitted to automatically cache files from the
857 specified share for offline use, file-by-file reintegration is permitted, and
858 clients are permitted to work from their local cache even while offline.
859 .RE
860 .RS +4
861 .TP
862 .ie t \(bu
863 .el o
864 \fBdisabled\fR \fB-\fR Client-side caching is not permitted for this share.
865 .RE
866 .RE
868 .sp
869 .ne 2
870 .na
871 \fB\fBguestok=\fR\fIboolean\fR\fR
872 .ad
873 .sp .6
874 .RS 4n
875 Set the guest access policy for the share. When set to \fBtrue\fR guest access
876 is allowed on this share. When set to \fBfalse\fR or not defined guest access
877 is not allowed on this share. This property is not defined by default.
878 .sp
879 An \fBidmap\fR(1M) name-based rule can be used to map \fBguest\fR to any local
880 username, such as \fBguest\fR or \fBnobody\fR. If the local account has a
881 password in \fB/var/smb/smbpasswd\fR the guest connection will be authenticated
882 against that password. Any connection made using an account that maps to the
883 local guest account will be treated as a guest connection.
884 .sp
885 Example name-based rule:
886 .sp
887 .in +2
888 .nf
889 # \fBidmap add winname:Guest unixuser:guest\fR
890 .fi
891 .in -2
892 .sp
894 .RE
896 .sp
897 .ne 2
898 .na
899 \fB\fBindex=\fIfile\fR\fR\fR
900 .ad
901 .sp .6
902 .RS 4n
903 Load \fIfile\fR rather than a listing of the directory containing this file
904 when the directory is referenced by an NFS URL.
905 .RE
907 .sp
908 .ne 2
909 .na
910 \fB\fBlog=\fItag\fR\fR\fR
911 .ad
912 .sp .6
913 .RS 4n
914 Enables NFS server logging for the specified system. The optional tag
915 determines the location of the related log files. The tag is defined in
916 \fBetc/nfs/nfslog.conf\fR. If no tag is specified, the default values
917 associated with the global tag in \fBetc/nfs/nfslog.conf\fR is used. Support of
918 NFS server logging is available only for NFS Version 2 and Version 3 requests.
919 .RE
921 .sp
922 .ne 2
923 .na
924 \fB\fBnosub=\fIboolean\fR\fR\fR
925 .ad
926 .sp .6
927 .RS 4n
928 Prevents clients from mounting subdirectories of shared directories. For
929 example, if \fB/export\fR is shared with the \fBnosub\fR option on server
930 \fBwool\fR then an NFS client cannot do:
931 .sp
932 .in +2
933 .nf
934 # \fBmount -F nfs wool:/export/home/mnt\fR
935 .fi
936 .in -2
937 .sp
939 NFS Version 4 does not use the MOUNT protocol. The \fBnosub\fR option applies
940 only to NFS Version 2 and Version 3 requests.
941 .RE
943 .sp
944 .ne 2
945 .na
946 \fB\fBnosuid=\fIboolean\fR\fR\fR
947 .ad
948 .sp .6
949 .RS 4n
950 By default, clients are allowed to create files on a shared file system with
951 the \fBsetuid\fR or \fBsetgid\fR mode enabled. Specifying \fBnosuid\fR causes
952 the server file system to silently ignore any attempt to enable the
953 \fBsetuid\fR or \fBsetgid\fR mode bits.
954 .RE
956 .sp
957 .ne 2
958 .na
959 \fB\fBpublic=\fIboolean\fR\fR\fR
960 .ad
961 .sp .6
962 .RS 4n
963 Moves the location of the public file handle from root (\fB/\fR) to the
964 exported directory for WebNFS-enabled browsers and clients. This option does
965 not enable WebNFS service; WebNFS is always on. Only one file system per server
966 can have the \fBpublic\fR property. You can apply the \fBpublic\fR property
967 only to a share and not to a group.
968 .RE
970 .sp
971 .LP
972 NFS also supports negotiated optionsets for supported security modes. The
973 security modes are documented in \fBnfssec\fR(5). The properties supported for
974 these optionsets are:
975 .sp
976 .ne 2
977 .na
978 \fB\fIcharset\fR=\fIaccess-list\fR\fR
979 .ad
980 .sp .6
981 .RS 4n
982 Where \fIcharset\fR is one of: \fBeuc-cn\fR, \fBeuc-jp\fR, \fBeuc-jpms\fR,
983 \fBeuc-kr\fR, \fBeuc-tw\fR, \fBiso8859-1\fR, \fBiso8859-2\fR, \fBiso8859-5\fR,
984 \fBiso8859-6\fR, \fBiso8859-7\fR, \fBiso8859-8\fR, \fBiso8859-9\fR,
985 \fBiso8859-13\fR, \fBiso8859-15\fR, \fBkoi8-r\fR.
986 .sp
987 Clients that match the \fIaccess-list\fR for one of these properties will be
988 assumed to be using that character set and file and path names will be
989 converted to UTF-8 for the server.
990 .RE
992 .sp
993 .ne 2
994 .na
995 \fB\fBro=\fIaccess-list\fR\fR\fR
996 .ad
997 .sp .6
998 .RS 4n
999 Sharing is read-only to the clients listed in \fIaccess-list\fR; overrides the
1000 \fBrw\fR suboption for the clients specified. See the description of
1001 \fIaccess-list\fR below.
1002 .RE
1004 .sp
1005 .ne 2
1006 .na
1007 \fB\fBrw=\fIaccess-list\fR\fR\fR
1008 .ad
1009 .sp .6
1010 .RS 4n
1011 Sharing is read-write to the clients listed in \fIaccess-list\fR; overrides the
1012 \fBro\fR suboption for the clients specified. See the description of
1013 \fIaccess-list\fR below.
1014 .RE
1016 .sp
1017 .ne 2
1018 .na
1019 \fB\fBnone=\fIaccess-list\fR\fR\fR
1020 .ad
1021 .sp .6
1022 .RS 4n
1023 Access is not allowed to any client that matches the access list. The exception
1024 is when the access list is an asterisk (\fB*\fR), in which case \fBro\fR or
1025 \fBrw\fR can override \fBnone\fR.
1026 .RE
1028 .sp
1029 .ne 2
1030 .na
1031 \fB\fBroot=\fIaccess-list\fR\fR\fR
1032 .ad
1033 .sp .6
1034 .RS 4n
1035 Only root users from the hosts specified in \fIaccess-list\fR have root access.
1036 See details on \fIaccess-list\fR below. By default, no host has root access, so
1037 root users are mapped to an anonymous user ID (see the \fBanon=uid\fR option
1038 described above). Netgroups can be used if the file system shared is using UNIX
1039 authentication (\fBAUTH_SYS\fR).
1040 .RE
1042 .sp
1043 .ne 2
1044 .na
1045 \fB\fBroot_mapping=\fIuid\fR\fR\fR
1046 .ad
1047 .sp .6
1048 .RS 4n
1049 For a client that is allowed root access, map the root UID to the specified
1050 user id.
1051 .RE
1053 .sp
1054 .ne 2
1055 .na
1056 \fB\fBwindow=\fIvalue\fR\fR\fR
1057 .ad
1058 .sp .6
1059 .RS 4n
1060 When sharing with \fBsec=dh\fR (see \fBnfssec\fR(5)), set the maximum lifetime
1061 (in seconds) of the RPC request's credential (in the authentication header)
1062 that the NFS server allows. If a credential arrives with a lifetime larger than
1063 what is allowed, the NFS server rejects the request. The default value is 30000
1064 seconds (8.3 hours). This property is ignored for security modes other than
1065 \fBdh\fR.
1066 .RE
1068 .sp
1069 .LP
1070 The general properties supported for SMB are:
1071 .sp
1072 .ne 2
1073 .na
1074 \fB\fBro=\fIaccess-list\fR\fR\fR
1075 .ad
1076 .sp .6
1077 .RS 4n
1078 Sharing is read-only to the clients listed in \fIaccess-list\fR; overrides the
1079 \fBrw\fR suboption for the clients specified. See the description of
1080 \fIaccess-list\fR below.
1081 .RE
1083 .sp
1084 .ne 2
1085 .na
1086 \fB\fBrw=\fIaccess-list\fR\fR\fR
1087 .ad
1088 .sp .6
1089 .RS 4n
1090 Sharing is read-write to the clients listed in \fIaccess-list\fR; overrides the
1091 \fBro\fR suboption for the clients specified. See the description of
1092 \fIaccess-list\fR below.
1093 .RE
1095 .sp
1096 .ne 2
1097 .na
1098 \fB\fBnone=\fIaccess-list\fR\fR\fR
1099 .ad
1100 .sp .6
1101 .RS 4n
1102 Access is not allowed to any client that matches the access list. The exception
1103 is when the access list is an asterisk (\fB*\fR), in which case \fBro\fR or
1104 \fBrw\fR can override \fBnone\fR.
1105 .RE
1107 .SS "Access List Argument"
1108 .sp
1109 .LP
1110 The \fIaccess-list\fR argument is either the string \fB"*"\fR to represent all
1111 hosts or a colon-separated list whose components can be any number of the
1112 following:
1113 .sp
1114 .ne 2
1115 .na
1116 \fB\fIhostname\fR\fR
1117 .ad
1118 .sp .6
1119 .RS 4n
1120 The name of a host. With a server configured for DNS or LDAP naming in the
1121 \fBnsswitch.conf\fR(4) \fBhosts\fR entry, a hostname must be represented as a
1122 fully qualified DNS or LDAP name.
1123 .RE
1125 .sp
1126 .ne 2
1127 .na
1128 \fB\fInetgroup\fR\fR
1129 .ad
1130 .sp .6
1131 .RS 4n
1132 A \fInetgroup\fR contains a number of hostnames. With a server configured for
1133 DNS or LDAP naming in the \fBnsswitch.conf\fR(4) \fBhosts\fR entry, any
1134 hostname in a netgroup must be represented as a fully qualified DNS or LDAP
1135 name.
1136 .RE
1138 .sp
1139 .ne 2
1140 .na
1141 \fB\fIdomainname\fR.\fIsuffix\fR\fR
1142 .ad
1143 .sp .6
1144 .RS 4n
1145 To use domain membership the server must use DNS or LDAP, rather than, for
1146 example, NIS or NIS+, to resolve hostnames to IP addresses. That is, the
1147 \fBhosts\fR entry in the \fBnsswitch.conf\fR(4) must specify \fBdns\fR or
1148 \fBldap\fR ahead of \fBnis\fR or \fBnisplus\fR, because only DNS and LDAP
1149 return the full domain name of the host. Other name services, such as NIS or
1150 NIS+, cannot be used to resolve hostnames on the server because, when mapping
1151 an IP address to a hostname, they do not return domain information. For
1152 example, for the IP address 172.16.45.9:
1153 .sp
1154 .ne 2
1155 .na
1156 \fBNIS or NIS+\fR
1157 .ad
1158 .sp .6
1159 .RS 4n
1160 Returns: \fBmyhost\fR
1161 .RE
1163 .sp
1164 .ne 2
1165 .na
1166 \fBDNS or LDAP\fR
1167 .ad
1168 .sp .6
1169 .RS 4n
1170 Returns: \fBmyhost.mydomain.mycompany.com\fR
1171 .RE
1173 The domain name suffix is distinguished from hostnames and netgroups by a
1174 prefixed dot. For example:
1175 .sp
1176 .in +2
1177 .nf
1178 rw=.mydomain.mycompany.com
1179 .fi
1180 .in -2
1182 A single dot can be used to match a hostname with no suffix. For example, the
1183 specification:
1184 .sp
1185 .in +2
1186 .nf
1187 rw=.
1188 .fi
1189 .in -2
1191 \&...matches \fBmydomain\fR but not \fBmydomain.mycompany.com\fR. This feature
1192 can be used to match hosts resolved through NIS and NIS+ rather than DNS and
1193 LDAP.
1194 .RE
1196 .sp
1197 .ne 2
1198 .na
1199 \fB\fInetwork\fR\fR
1200 .ad
1201 .sp .6
1202 .RS 4n
1203 The network or subnet component is preceded by an at-sign (\fB@\fR). It can be
1204 either a name or a dotted address. If a name, it is converted to a dotted
1205 address by \fBgetnetbyname\fR(3SOCKET). For example:
1206 .sp
1207 .in +2
1208 .nf
1209 =@mynet
1210 .fi
1211 .in -2
1213 \&...is equivalent to:
1214 .sp
1215 .in +2
1216 .nf
1217 =@172.16 or =@172.16.0.0
1218 .fi
1219 .in -2
1221 The network prefix assumes an octet-aligned netmask determined from the zeroth
1222 octet in the low-order part of the address up to and including the high-order
1223 octet, if you want to specify a single IP address. In the case where network
1224 prefixes are not byte-aligned, the syntax allows a mask length to be specified
1225 explicitly following a slash (\fB/\fR) delimiter. For example:
1226 .sp
1227 .in +2
1228 .nf
1229 =@theothernet/17 or =@172.16.132/22
1230 .fi
1231 .in -2
1233 \&...where the mask is the number of leftmost contiguous significant bits in
1234 the corresponding IP address.
1235 .RE
1237 .sp
1238 .LP
1239 A prefixed minus sign (\fB-\fR) denies access to a component of
1240 \fIaccess-list\fR. The list is searched sequentially until a match is found
1241 that either grants or denies access, or until the end of the list is reached.
1242 For example, if host \fBterra\fR is in the netgroup \fBengineering\fR, then:
1243 .sp
1244 .in +2
1245 .nf
1246 rw=-terra:engineering
1247 .fi
1248 .in -2
1250 .sp
1251 .LP
1252 \&...denies access to \fBterra\fR, but:
1253 .sp
1254 .in +2
1255 .nf
1256 rw=engineering:-terra
1257 .fi
1258 .in -2
1260 .sp
1261 .LP
1262 \&...grants access to \fBterra\fR.
1263 .SH EXIT STATUS
1264 .sp
1265 .ne 2
1266 .na
1267 \fB\fB0\fR\fR
1268 .ad
1269 .RS 18n
1270 Successful completion.
1271 .RE
1273 .sp
1274 .ne 2
1275 .na
1276 \fB\fB98\fR\fR
1277 .ad
1278 .RS 18n
1279 Service is offline and cannot be enabled (start only).
1280 .RE
1282 .sp
1283 .ne 2
1284 .na
1285 \fB\fIother non-zero\fR\fR
1286 .ad
1287 .RS 18n
1288 Command failed.
1289 .RE
1291 .SH FILES
1292 .sp
1293 .ne 2
1294 .na
1295 \fB\fB/usr/include/libshare.h\fR\fR
1296 .ad
1297 .RS 27n
1298 Error codes used for exit status.
1299 .RE
1301 .SH ATTRIBUTES
1302 .sp
1303 .LP
1304 See \fBattributes\fR(5) for descriptions of the following attributes:
1305 .sp
1307 .sp
1308 .TS
1309 box;
1310 c | c
1311 l | l .
1312 ATTRIBUTE TYPE ATTRIBUTE VALUE
1313 _
1314 Interface Stability Committed
1315 .TE
1317 .SH SEE ALSO
1318 .sp
1319 .LP
1320 \fBidmap\fR(1M), \fBsharectl\fR(1M), \fBzfs\fR(1M), \fBattributes\fR(5),
1321 \fBnfssec\fR(5), \fBsmf\fR(5), \fBstandards\fR(5)