exportfs(8)

📦
version 3.1.1 · 3 versions
, in arch rolling, nixpkgs unstable

💖 exportfs — the manual, but make it make sense 💖

okay bestie, so this is a page from the System Manager's Manual — it's exportfs(8), and it's literally the girlboss who keeps your NFS exports in check. let's get into it 🫶

✨ NAME ✨

exportfs — maintain the table of exported NFS file systems

🌸 SYNOPSIS 🌸

/usr/sbin/exportfs [-avi] [-o options,..] [client:/path ..]
/usr/sbin/exportfs -r [-v]
/usr/sbin/exportfs [-av] -u [client:/path ..]
/usr/sbin/exportfs [-v]
/usr/sbin/exportfs -f
/usr/sbin/exportfs -s

💅 DESCRIPTION 💅

So an NFS server keeps a whole table of local physical file systems that NFS clients are allowed to reach. every file system in that table is called an exported file system, or just an export for short. iconic, honestly.

The exportfs command is the one maintaining the current table of exports for the NFS server. the master export table lives in a file named /var/lib/nfs/etab. this file gets read by rpc.mountd when a client sends an NFS MOUNT request. 💫

normally, that master export table gets initialized with the contents of /etc/exports and files under /etc/exports.d, by invoking exportfs -a. but — plot twist — a system administrator can also choose to add or delete exports without touching /etc/exports or the files under /etc/exports.d, just by using the exportfs command directly. main character energy fr.

here's the thing though: exportfs does not talk to the kernel directly. nope. it writes export info to /var/lib/nfs/etab and relies on its partner programs rpc.mountd and nfsv4.exportd to handle kernel communication. these daemons work in one of two modes: a netlink mode and a /proc mode. 🦋

netlink mode is available on sufficiently recent kernels. in this mode, rpc.mountd (or nfsv4.exportd) communicates with the kernel via generic netlink sockets. the kernel sends multicast notifications when cache entries need to be resolved, and the daemon responds with the appropriate export information. cache flushing (via exportfs -f) is also performed over netlink. you can disable this mode with the -L option.

/proc mode is used when netlink isn't available — then rpc.mountd manages kernel requests for info about exports via the /proc/net/rpc channel files.

✨ OPTIONS ✨

  • -d kind or --debug kind — turn on debugging. valid kinds are: all, auth, call, general and parse. debugging can also be turned on by setting debug= in the [exportfs] section of /etc/nfs.conf. 👑
  • -a — export or unexport all directories.
  • -o options,... — specify a list of export options in the same manner as in exports(5).
  • -i — ignore the /etc/exports file and files under the /etc/exports.d directory. only default options and options given on the command line are used.
  • -r — reexport all directories, synchronizing /var/lib/nfs/etab with /etc/exports and files under /etc/exports.d. this option removes entries in /var/lib/nfs/etab which have been deleted from /etc/exports or files under /etc/exports.d, and removes any entries from the kernel export table which are no longer valid. spring cleaning vibes 🧹
  • -u — unexport one or more directories.
  • -f — if /proc/fs/nfsd or /proc/fs/nfs is mounted, flush everything out of the kernel's export table. fresh entries for active clients get added to the kernel's export table by rpc.mountd when they make their next NFS mount request.
  • -v — be verbose. when exporting or unexporting, show what's going on. when displaying the current export list, also display the list of export options.
  • -s — display the current export list, formatted suitable for /etc/exports.
  • -L — disable the use of netlink for kernel communication and force the use of the legacy /proc interfaces for cache flushing and export validation.

🎀 CONFIGURATION FILE 🎀

The [exportfs] section of the /etc/nfs.conf configuration file can contain a debug value, which can be one or more from the list general, call, auth, parse, all. when a list is given, the members should be comma-separated.

exportfs will also recognize the state-directory-path and no-netlink values from both the [mountd] section and the [exportd] section. when no-netlink is set, exportfs will skip the netlink probe and use the legacy /proc interfaces for cache flushing and export validation.

💬 DISCUSSION 💬

🌈 Exporting Directories 🌈

The first synopsis shows how to invoke exportfs when you're adding new entries to the export table. when using exportfs -a, all exports listed in /etc/exports and files under /etc/exports.d are added to /var/lib/nfs/etab. the kernel's export table also gets updated as needed. ✨

The host:/path argument specifies a local directory to export, along with the client or clients permitted to access it. see exports(5) for a description of supported options and access list formats.

heads up bestie: IPv6 presentation addresses contain colons, and colons are already used to separate the "host" and "path" command line arguments. when specifying a client using a raw IPv6 address, enclose the address in square brackets. for IPv6 network addresses, place the prefix just after the closing bracket. 🦋

To export a directory to the world, simply specify :/path.

The export options for a particular host/directory pair derive from several sources. the default export options are sync,ro,root_squash,wdelay. these can be overridden by entries in /etc/exports or files under /etc/exports.d.

A system administrator may override options from these sources using the -o command-line option on exportfs. this option takes a comma-separated list of options in the same fashion as one would specify them in /etc/exports. so exportfs can be used to modify the export options of an already exported directory. 💅

💜 Unexporting Directories 💜

The third synopsis shows how to unexport a currently exported directory. when using exportfs -ua, all entries listed in /var/lib/nfs/etab are removed from the kernel export tables, and the file is cleared. this effectively shuts down all NFS activity. 😭

To remove an export, specify a host:/path pair. this deletes the specified entry from /var/lib/nfs/etab and removes the corresponding kernel entry (if any).

When the last client for a given export path is unexported, exportfs signals the kernel to revoke NFSv4 state (opens, locks, and delegations) and release cached state for that path. without this revocation, retained state would prevent the underlying filesystem from being unmounted. affected clients receive NFS4ERR_ADMIN_REVOKED errors for operations that use revoked state. 💀

exportfs -ua does not revoke NFSv4 state, however. if nfsd is then restarted, clients may reclaim state during the grace period.

🍓 Dumping the Export Table 🍓

Invoking exportfs without options shows the current list of exported file systems. adding the -v option causes exportfs to display the export options for each export.

🔥 EXAMPLES 🔥

The following adds all directories listed in /etc/exports and files under /etc/exports.d to /var/lib/nfs/etab and pushes the resulting export entries into the kernel:

# exportfs -a

To export the /usr/tmp directory to host django, allowing insecure file locking requests from clients:

# exportfs -o insecure_locks django:/usr/tmp

To unexport the /usr/tmp directory:

# exportfs -u django:/usr/tmp

To unexport all exports listed in /etc/exports and files under /etc/exports.d:

# exportfs -au

To export the /usr/tmp directory to IPv6 link-local clients:

# exportfs [fe80::]/64:/usr/tmp

⭐ USAGE NOTES ⭐

Exporting to IP networks or DNS and NIS domains does not enable clients from these groups to access NFS immediately. rather, these sorts of exports are hints to rpc.mountd(8) to grant any mount requests from these clients. this is usually not a problem, because any existing mounts are preserved in rmtab across reboots. no cap. 🫶

When unexporting a network or domain entry, any current exports to members of this group will be checked against the remaining valid exports and, if they themselves are no longer valid, they will be removed.

🧚 FILES 🧚

  • /etc/exports — input file listing exports, export options, and access control lists
  • /etc/exports.d — directory where extra input files are stored. Note: only files that end with .exports are used.
  • /var/lib/nfs/etab — master table of exports
  • /var/lib/nfs/rmtab — table of clients accessing server's exports

👑 SEE ALSO 👑

exports(5), nfs.conf(5), rpc.mountd(8), exportd(8), netgroup(5)

💖 AUTHORS 💖

  • Olaf Kirch <okir@monad.swb.de>
  • Neil Brown <neilb@cse.unsw.edu.au>

and that's the whole thing, bestie — this page is from 30 September 2013, from the exportfs(8) corner of the System Manager's Manual. slay, go forth and export responsibly 💅✨🌈

📦 where this page comes from