KAFS(7)

📦
version 0.9 · 6 versions
, in fedora 43, fedora 44

💖 KAFS(7) — kafs, the in-kernel AFS filesystem 💖

okay bestie, pull up a chair, because this is the page for kafs and it's genuinely one of the coolest things in the Linux kernel 💅

✨ NAME ✨

kafs — in-kernel AFS filesystem 🦋

🌸 DESCRIPTION 🌸

So "kafs" is a network filesystem driver that lives inside the Linux kernel, and it's out here accessing AFS cells and the servers chillin' inside them, all so it can locate the logical volumes that make up the cell, plus every file contained in each volume. it's giving very organized, very main character energy 👑

It supports transport over IPv4 UDP and IPv6 UDP, and its security is based on Kerberos. The authentication token is what defines the user — for the purpose of providing access control and for providing communications security. one token, two jobs, iconic 🎀

The filesystem is of type "afs", and the mount command can be used to mount afs volumes manually using the -t flag on mount(8). slay.

🧚 SETTING UP 🧚

The "kafs-client" package should be installed so that systemd is configured to include a mount of the AFS dynamic root on /afs. But heads up bestie — mounting /afs is not enabled by default, so if you need it, "systemd" should be told to enable it. do it like this:

systemctl enable afs.mount

This will mount a special directory on "/afs" which will be populated by an automount directory for each cell listed in the configuration. And the way that doing a pathwalk into one of these directories will result in the "afs.cell" volume from the cell being mounted onto that directory? obsessed. 💫

Local configuration should be placed in a file in the /etc/kafs/client.d/ directory. That gets included from the /etc/client.conf file. fr fr.

Typically in the local configuration, you'd specify the local cell name and give backup details of its Volume Location server addresses.

Also, any overrides for the @sys filename substitution would be specified right there. See kafs-client.conf(5) for the deets 🫶

🔥 OPERATION 🔥

Once the kafs-client is set up — and ngl, if there's no local cell, this is practically zero-conf, provided the cells to be accessed are properly set up with AFSDB or SRV records in the DNS — the /afs directory can be accessed:

ls /afs/<cell>/location/within/cell

For example:

ls /afs/rivendell.example.com/doc

And you're not limited to cells listed in /afs, bestie — any cell can be tried by just substituting the name of the cell into the above formula. It does require the target to have DNS-based configuration provided though, so no skipping that step 🙈

Note that each logical volume gets a discrete superblock, and links between volumes turn into kernel mountpoints that, if stepped on, cause the appropriate volume to be mounted over them. lowkey magical ⭐

🔐 SECURITY 🔐

kafs supports Kerberos-based authentication and communication encryption through the use of Kerberos. The "kinit" program can be used to authenticate with a Kerberos server:

kinit myname@RIVENDELL.EXAMPLE.COM

and then the "aklog-kafs" program to get a ticket for the kernel filesystem to use:

aklog-kafs rivendell.example.com

This will be placed on the caller's session keyring, and can be viewed there with:

keyctl show

Note that the default realm is assumed to be the same as the cell name, but in all upper case. so rivendell.example.com becomes RIVENDELL.EXAMPLE.COM — the caps are not optional 💅

👑 SEE ALSO 👑

Copyright (C) 2019 Red Hat, Inc. All Rights Reserved.

Written by David Howells (dhowells@redhat.com)

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

okay that's the whole page, bestie!! version 0.9, dated 2026-08-27, brought to you by kafs-client 🎀 go mount something iconic 💖✨🦋
📦 where this page comes from