FS_EXPORTAFS(1)

📦
version 1.8.16.1 · 10 versions
, in ubuntu stonking

💖 FS_EXPORTAFS — the AFS Command Reference glow-up, part 1 💖

okay bestie, sit down, hydrate, because we're about to talk about fs_exportafs, which is the little command that decides whether your machine reexports the whole AFS filespace to clients of some other filesystem. yes. it's giving gatekeeper. it's giving "you shall not pass unless -start on." let's get into it 🫶

✨ NAME ✨

fs_exportafs — Configures export of AFS to clients of other file systems

✨ SYNOPSIS ✨

fs exportafs -type <exporter name>
    [-start <start/stop translator (on | off)>]
    [-convert <convert from afs to unix mode (on | off)>]
    [-uidcheck <run on strict 'uid check' mode (on | off)>]
    [-submounts <allow nfs mounts to subdirs of /afs/.. (on | off)>]
    [-clipags <use client-assigned PAGs (on | off)>]
    [-pagcb <callback clients to get creds (on | off)>]
    [-help]

fs exp -t <exporter name>
    [-st <start/stop translator (on | off)>]
    [-co <convert from afs to unix mode (on | off)>]
    [-u <run on strict 'uid check' mode (on | off)>]
    [-su <allow nfs mounts to subdirs of /afs/.. (on | off)>]
    [-cl <use client-assigned PAGs (on | off)>]
    [-p <callback clients to get creds (on | off)>]
    [-h]

like, yes, there's a short-alias version of everything because sometimes you're typing with one hand and holding a boba with the other 🧋

✨ DESCRIPTION ✨

so the tea is: fs exportafs either sets stuff (if you give it the -start argument) or reports stuff (if you don't) about whether this machine can reexport the AFS filespace to clients of a non-AFS filesystem. no cap.

and to control certain features of the translation protocol, you use these arguments:

  • If you wanna control whether the UNIX group and other mode bits on an AFS file or directory get set to match the owner mode bits when it's exported to the non-AFS filesystem, that's the -convert argument, bestie.
  • If you wanna control whether tokens can be placed in a credential structure identified by a UID that's different from the local UID of the entity placing those tokens in the structure — that's the -uidcheck argument. the most common use case is controlling whether issuers of the knfs command can specify a value for its -id argument that doesn't match their local UID on the NFS/AFS translator machine. messy? yes. iconic? also yes.
  • If you wanna control whether users can create mounts in the non-AFS filespace pointing to an AFS directory other than /afs, that's the -submounts argument. 🦋

✨ OPTIONS ✨

  • -type <exporter name> — names the alternate filesystem you wanna reexport the AFS filespace to. the only acceptable value is "nfs", and it's lowercase letters only, so don't come at it with NFS or Nfs, it will simply not engage 💅
  • -start <on | off> — turns ON the ability for the local machine to reexport the AFS filespace if the value is "on", or turns it OFF if the value is "off". if you omit this argument entirely, it reports the current setting for all of the configurable parameters. so it's like a vibe check for your translator ✨
  • -convert <on | off> — controls the setting of the UNIX group and other mode bits on AFS files and directories exported to the non-AFS filesystem. if the value is "on", they get set to match the owner mode bits. if the value is "off", the bits are not changed. if you skip this argument, the default value is "on". periodt.
  • -uidcheck <on | off> — controls whether tokens can be placed in a credential structure identified by a UID that differs from the local UID of the entity placing the tokens in the structure. and babes, this one has LORE:
    • if the value is on, the UID that identifies the credential structure must match the local UID.
      • with respect to the knfs command, this value means the value of the -id argument must match the issuer's local UID on the translator machine. in practice, this setting makes it pointless to include the -id argument to knfs, because the only acceptable value (the issuer's local UID) is already used when -id is omitted. like, doing extra work for no reason 💀
      • enabling UID checking also makes it impossible to issue the klog and pagsh commands on a client machine of the non-AFS filesystem, even though it's a system type supported by AFS. for an explanation, go see klog(1).
    • if the value is off (the default), tokens can be assigned to a local UID in the non-AFS filesystem that does not match the local UID of the entity assigning the tokens.
      • with respect to the knfs command, it means the issuer can use the -id argument to assign tokens to a local UID on the NFS client machine that doesn't match their local UID on the translator machine. (an example is assigning tokens to the NFS client machine's local superuser "root".) this setting allows more than one issuer of knfs to make tokens available to the same user on the NFS client machine. but — each time a different user issues the knfs command with the same value for the -id argument, that user's tokens overwrite the existing ones. this can result in unpredictable access for the user on the NFS client machine. so like, chaos energy. proceed accordingly 😭
  • -submounts <on | off> — controls whether a user of the non-AFS filesystem can mount any directory in the AFS filespace other than the top-level /afs directory. if the value is "on", such submounts are allowed. if the value is "off", only mounts of the /afs directory are allowed. if you omit this argument, the default value is "off". 🎀
  • -clipags <on | off> — turning this option on enables support for “client-assigned PAGs”. with client-assigned PAGs, an NFS client can manage its own AFS pags, and inform the NFS translator machine what PAG it's using, instead of the NFS translator machine keeping track of PAGs. an NFS client machine can do this if it has the "afspag" kernel module loaded — which tracks PAGs but otherwise does not implement AFS functionality — and forwards all requests to the NFS translator machine. 🧚
you should only turn on this option if you're actually making use of client-assigned PAGs, and you trust the NFS client machines making use of the translator. this option is off by default.
  • -pagcb <on | off> — turning this option on means the NFS translator machine will contact new NFS clients in order to obtain their credentials and sysnames. this can be useful so that client credentials are not lost if the translator machine is rebooted, or if an NFS client is “moved” to using a different translator. this functionality will only work with NFS clients that are also running the "afspag" kernel module. ✨
using this option with NFS clients that are not running the "afspag" kernel module would cause long timeouts when the translator machine attempts to contact the client to obtain its credentials and sysname list. this option is off by default. so like, know your clients, bestie.
  • -help — prints the online help for this command. all other valid options are ignored. it's the "I just have one question" of flags 💅

✨ OUTPUT ✨

if the machine isn't even configured as a server of the non-AFS filesystem, you get this lil message:

Sorry, the <file_system>-exporter type is currently not supported on this AFS client

if the machine is configured as a server of the non-AFS filesystem but isn't currently enabled to reexport AFS to it (because the -start argument to this command isn't set to "on"), the message is:

'<file_system>' translator is disabled

if the machine is enabled to reexport AFS, this message comes first, and then messages reporting the settings of the other parameters follow:

'<file_system>' translator is enabled with the following options:

the following messages indicate that the -convert argument is set to "on" or "off", respectively:

Running in convert owner mode bits to world/other mode
Running in strict unix mode

the following messages indicate that the -uidcheck argument is set to "on" or "off", respectively:

Running in strict 'passwd sync' mode
Running in no 'passwd sync' mode

the following messages indicate that the -submounts argument is set to "on" or "off", respectively:

Allow mounts of /afs/.. subdirs
Only mounts to /afs allowed

✨ EXAMPLES ✨

this first one shows that the local machine can export AFS to NFS client machines. look at her go 👑

% fs exportafs nfs
'nfs' translator is enabled with the following options:
     Running in convert owner mode bits to world/other mode
     Running in no 'passwd sync' mode
     Only mounts to /afs allowed

this next one enables the machine as an NFS server and converts the UNIX group and other mode bits on exported AFS directories and files to match the UNIX owner mode bits:

% fs exportafs -type nfs -start on -convert on

and this one disables the machine from reexporting AFS to NFS client machines. goodbye, we hardly knew ye 🦋

% fs exportafs -type nfs -start off

✨ PRIVILEGE REQUIRED ✨

the issuer must be logged in as the local superuser root. no shortcuts, no "but my friend said"— root. that's the requirement. 💅

✨ SEE ALSO ✨

klog(1), knfs(1)

IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.

this documentation is covered by the IBM Public License Version 1.0. it was converted from HTML to POD by software written by Chas Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell. 🫶

and that's the whole page, bestie!! this was pulled straight from OpenAFS, dated 2026-07-27, so if you cite it, cite it proudly. mwah 💖🎀✨

📦 where this page comes from