| 1 | The CIFS VFS support for Linux supports many advanced network filesystem |
| 2 | features such as hierarchical dfs like namespace, hardlinks, locking and more. |
| 3 | It was designed to comply with the SNIA CIFS Technical Reference (which |
| 4 | supersedes the 1992 X/Open SMB Standard) as well as to perform best practice |
| 5 | practical interoperability with Windows 2000, Windows XP, Samba and equivalent |
| 6 | servers. This code was developed in participation with the Protocol Freedom |
| 7 | Information Foundation. |
| 8 | |
| 9 | Please see |
| 10 | http://protocolfreedom.org/ and |
| 11 | http://samba.org/samba/PFIF/ |
| 12 | for more details. |
| 13 | |
| 14 | |
| 15 | For questions or bug reports please contact: |
| 16 | sfrench@samba.org (sfrench@us.ibm.com) |
| 17 | |
| 18 | Build instructions: |
| 19 | ================== |
| 20 | For Linux 2.4: |
| 21 | 1) Get the kernel source (e.g.from http://www.kernel.org) |
| 22 | and download the cifs vfs source (see the project page |
| 23 | at http://us1.samba.org/samba/Linux_CIFS_client.html) |
| 24 | and change directory into the top of the kernel directory |
| 25 | then patch the kernel (e.g. "patch -p1 < cifs_24.patch") |
| 26 | to add the cifs vfs to your kernel configure options if |
| 27 | it has not already been added (e.g. current SuSE and UL |
| 28 | users do not need to apply the cifs_24.patch since the cifs vfs is |
| 29 | already in the kernel configure menu) and then |
| 30 | mkdir linux/fs/cifs and then copy the current cifs vfs files from |
| 31 | the cifs download to your kernel build directory e.g. |
| 32 | |
| 33 | cp <cifs_download_dir>/fs/cifs/* to <kernel_download_dir>/fs/cifs |
| 34 | |
| 35 | 2) make menuconfig (or make xconfig) |
| 36 | 3) select cifs from within the network filesystem choices |
| 37 | 4) save and exit |
| 38 | 5) make dep |
| 39 | 6) make modules (or "make" if CIFS VFS not to be built as a module) |
| 40 | |
| 41 | For Linux 2.6: |
| 42 | 1) Download the kernel (e.g. from http://www.kernel.org) |
| 43 | and change directory into the top of the kernel directory tree |
| 44 | (e.g. /usr/src/linux-2.5.73) |
| 45 | 2) make menuconfig (or make xconfig) |
| 46 | 3) select cifs from within the network filesystem choices |
| 47 | 4) save and exit |
| 48 | 5) make |
| 49 | |
| 50 | |
| 51 | Installation instructions: |
| 52 | ========================= |
| 53 | If you have built the CIFS vfs as module (successfully) simply |
| 54 | type "make modules_install" (or if you prefer, manually copy the file to |
| 55 | the modules directory e.g. /lib/modules/2.4.10-4GB/kernel/fs/cifs/cifs.o). |
| 56 | |
| 57 | If you have built the CIFS vfs into the kernel itself, follow the instructions |
| 58 | for your distribution on how to install a new kernel (usually you |
| 59 | would simply type "make install"). |
| 60 | |
| 61 | If you do not have the utility mount.cifs (in the Samba 3.0 source tree and on |
| 62 | the CIFS VFS web site) copy it to the same directory in which mount.smbfs and |
| 63 | similar files reside (usually /sbin). Although the helper software is not |
| 64 | required, mount.cifs is recommended. Eventually the Samba 3.0 utility program |
| 65 | "net" may also be helpful since it may someday provide easier mount syntax for |
| 66 | users who are used to Windows e.g. |
| 67 | net use <mount point> <UNC name or cifs URL> |
| 68 | Note that running the Winbind pam/nss module (logon service) on all of your |
| 69 | Linux clients is useful in mapping Uids and Gids consistently across the |
| 70 | domain to the proper network user. The mount.cifs mount helper can be |
| 71 | trivially built from Samba 3.0 or later source e.g. by executing: |
| 72 | |
| 73 | gcc samba/source/client/mount.cifs.c -o mount.cifs |
| 74 | |
| 75 | If cifs is built as a module, then the size and number of network buffers |
| 76 | and maximum number of simultaneous requests to one server can be configured. |
| 77 | Changing these from their defaults is not recommended. By executing modinfo |
| 78 | modinfo kernel/fs/cifs/cifs.ko |
| 79 | on kernel/fs/cifs/cifs.ko the list of configuration changes that can be made |
| 80 | at module initialization time (by running insmod cifs.ko) can be seen. |
| 81 | |
| 82 | Allowing User Mounts |
| 83 | ==================== |
| 84 | To permit users to mount and unmount over directories they own is possible |
| 85 | with the cifs vfs. A way to enable such mounting is to mark the mount.cifs |
| 86 | utility as suid (e.g. "chmod +s /sbin/mount.cifs). To enable users to |
| 87 | umount shares they mount requires |
| 88 | 1) mount.cifs version 1.4 or later |
| 89 | 2) an entry for the share in /etc/fstab indicating that a user may |
| 90 | unmount it e.g. |
| 91 | //server/usersharename /mnt/username cifs user 0 0 |
| 92 | |
| 93 | Note that when the mount.cifs utility is run suid (allowing user mounts), |
| 94 | in order to reduce risks, the "nosuid" mount flag is passed in on mount to |
| 95 | disallow execution of an suid program mounted on the remote target. |
| 96 | When mount is executed as root, nosuid is not passed in by default, |
| 97 | and execution of suid programs on the remote target would be enabled |
| 98 | by default. This can be changed, as with nfs and other filesystems, |
| 99 | by simply specifying "nosuid" among the mount options. For user mounts |
| 100 | though to be able to pass the suid flag to mount requires rebuilding |
| 101 | mount.cifs with the following flag: |
| 102 | |
| 103 | gcc samba/source/client/mount.cifs.c -DCIFS_ALLOW_USR_SUID -o mount.cifs |
| 104 | |
| 105 | There is a corresponding manual page for cifs mounting in the Samba 3.0 and |
| 106 | later source tree in docs/manpages/mount.cifs.8 |
| 107 | |
| 108 | Allowing User Unmounts |
| 109 | ====================== |
| 110 | To permit users to ummount directories that they have user mounted (see above), |
| 111 | the utility umount.cifs may be used. It may be invoked directly, or if |
| 112 | umount.cifs is placed in /sbin, umount can invoke the cifs umount helper |
| 113 | (at least for most versions of the umount utility) for umount of cifs |
| 114 | mounts, unless umount is invoked with -i (which will avoid invoking a umount |
| 115 | helper). As with mount.cifs, to enable user unmounts umount.cifs must be marked |
| 116 | as suid (e.g. "chmod +s /sbin/umount.cifs") or equivalent (some distributions |
| 117 | allow adding entries to a file to the /etc/permissions file to achieve the |
| 118 | equivalent suid effect). For this utility to succeed the target path |
| 119 | must be a cifs mount, and the uid of the current user must match the uid |
| 120 | of the user who mounted the resource. |
| 121 | |
| 122 | Also note that the customary way of allowing user mounts and unmounts is |
| 123 | (instead of using mount.cifs and unmount.cifs as suid) to add a line |
| 124 | to the file /etc/fstab for each //server/share you wish to mount, but |
| 125 | this can become unwieldy when potential mount targets include many |
| 126 | or unpredictable UNC names. |
| 127 | |
| 128 | Samba Considerations |
| 129 | ==================== |
| 130 | To get the maximum benefit from the CIFS VFS, we recommend using a server that |
| 131 | supports the SNIA CIFS Unix Extensions standard (e.g. Samba 2.2.5 or later or |
| 132 | Samba 3.0) but the CIFS vfs works fine with a wide variety of CIFS servers. |
| 133 | Note that uid, gid and file permissions will display default values if you do |
| 134 | not have a server that supports the Unix extensions for CIFS (such as Samba |
| 135 | 2.2.5 or later). To enable the Unix CIFS Extensions in the Samba server, add |
| 136 | the line: |
| 137 | |
| 138 | unix extensions = yes |
| 139 | |
| 140 | to your smb.conf file on the server. Note that the following smb.conf settings |
| 141 | are also useful (on the Samba server) when the majority of clients are Unix or |
| 142 | Linux: |
| 143 | |
| 144 | case sensitive = yes |
| 145 | delete readonly = yes |
| 146 | ea support = yes |
| 147 | |
| 148 | Note that server ea support is required for supporting xattrs from the Linux |
| 149 | cifs client, and that EA support is present in later versions of Samba (e.g. |
| 150 | 3.0.6 and later (also EA support works in all versions of Windows, at least to |
| 151 | shares on NTFS filesystems). Extended Attribute (xattr) support is an optional |
| 152 | feature of most Linux filesystems which may require enabling via |
| 153 | make menuconfig. Client support for extended attributes (user xattr) can be |
| 154 | disabled on a per-mount basis by specifying "nouser_xattr" on mount. |
| 155 | |
| 156 | The CIFS client can get and set POSIX ACLs (getfacl, setfacl) to Samba servers |
| 157 | version 3.10 and later. Setting POSIX ACLs requires enabling both XATTR and |
| 158 | then POSIX support in the CIFS configuration options when building the cifs |
| 159 | module. POSIX ACL support can be disabled on a per mount basic by specifying |
| 160 | "noacl" on mount. |
| 161 | |
| 162 | Some administrators may want to change Samba's smb.conf "map archive" and |
| 163 | "create mask" parameters from the default. Unless the create mask is changed |
| 164 | newly created files can end up with an unnecessarily restrictive default mode, |
| 165 | which may not be what you want, although if the CIFS Unix extensions are |
| 166 | enabled on the server and client, subsequent setattr calls (e.g. chmod) can |
| 167 | fix the mode. Note that creating special devices (mknod) remotely |
| 168 | may require specifying a mkdev function to Samba if you are not using |
| 169 | Samba 3.0.6 or later. For more information on these see the manual pages |
| 170 | ("man smb.conf") on the Samba server system. Note that the cifs vfs, |
| 171 | unlike the smbfs vfs, does not read the smb.conf on the client system |
| 172 | (the few optional settings are passed in on mount via -o parameters instead). |
| 173 | Note that Samba 2.2.7 or later includes a fix that allows the CIFS VFS to delete |
| 174 | open files (required for strict POSIX compliance). Windows Servers already |
| 175 | supported this feature. Samba server does not allow symlinks that refer to files |
| 176 | outside of the share, so in Samba versions prior to 3.0.6, most symlinks to |
| 177 | files with absolute paths (ie beginning with slash) such as: |
| 178 | ln -s /mnt/foo bar |
| 179 | would be forbidden. Samba 3.0.6 server or later includes the ability to create |
| 180 | such symlinks safely by converting unsafe symlinks (ie symlinks to server |
| 181 | files that are outside of the share) to a samba specific format on the server |
| 182 | that is ignored by local server applications and non-cifs clients and that will |
| 183 | not be traversed by the Samba server). This is opaque to the Linux client |
| 184 | application using the cifs vfs. Absolute symlinks will work to Samba 3.0.5 or |
| 185 | later, but only for remote clients using the CIFS Unix extensions, and will |
| 186 | be invisbile to Windows clients and typically will not affect local |
| 187 | applications running on the same server as Samba. |
| 188 | |
| 189 | Use instructions: |
| 190 | ================ |
| 191 | Once the CIFS VFS support is built into the kernel or installed as a module |
| 192 | (cifs.o), you can use mount syntax like the following to access Samba or Windows |
| 193 | servers: |
| 194 | |
| 195 | mount -t cifs //9.53.216.11/e$ /mnt -o user=myname,pass=mypassword |
| 196 | |
| 197 | Before -o the option -v may be specified to make the mount.cifs |
| 198 | mount helper display the mount steps more verbosely. |
| 199 | After -o the following commonly used cifs vfs specific options |
| 200 | are supported: |
| 201 | |
| 202 | user=<username> |
| 203 | pass=<password> |
| 204 | domain=<domain name> |
| 205 | |
| 206 | Other cifs mount options are described below. Use of TCP names (in addition to |
| 207 | ip addresses) is available if the mount helper (mount.cifs) is installed. If |
| 208 | you do not trust the server to which are mounted, or if you do not have |
| 209 | cifs signing enabled (and the physical network is insecure), consider use |
| 210 | of the standard mount options "noexec" and "nosuid" to reduce the risk of |
| 211 | running an altered binary on your local system (downloaded from a hostile server |
| 212 | or altered by a hostile router). |
| 213 | |
| 214 | Although mounting using format corresponding to the CIFS URL specification is |
| 215 | not possible in mount.cifs yet, it is possible to use an alternate format |
| 216 | for the server and sharename (which is somewhat similar to NFS style mount |
| 217 | syntax) instead of the more widely used UNC format (i.e. \\server\share): |
| 218 | mount -t cifs tcp_name_of_server:share_name /mnt -o user=myname,pass=mypasswd |
| 219 | |
| 220 | When using the mount helper mount.cifs, passwords may be specified via alternate |
| 221 | mechanisms, instead of specifying it after -o using the normal "pass=" syntax |
| 222 | on the command line: |
| 223 | 1) By including it in a credential file. Specify credentials=filename as one |
| 224 | of the mount options. Credential files contain two lines |
| 225 | username=someuser |
| 226 | password=your_password |
| 227 | 2) By specifying the password in the PASSWD environment variable (similarly |
| 228 | the user name can be taken from the USER environment variable). |
| 229 | 3) By specifying the password in a file by name via PASSWD_FILE |
| 230 | 4) By specifying the password in a file by file descriptor via PASSWD_FD |
| 231 | |
| 232 | If no password is provided, mount.cifs will prompt for password entry |
| 233 | |
| 234 | Restrictions |
| 235 | ============ |
| 236 | Servers must support either "pure-TCP" (port 445 TCP/IP CIFS connections) or RFC |
| 237 | 1001/1002 support for "Netbios-Over-TCP/IP." This is not likely to be a |
| 238 | problem as most servers support this. |
| 239 | |
| 240 | Valid filenames differ between Windows and Linux. Windows typically restricts |
| 241 | filenames which contain certain reserved characters (e.g.the character : |
| 242 | which is used to delimit the beginning of a stream name by Windows), while |
| 243 | Linux allows a slightly wider set of valid characters in filenames. Windows |
| 244 | servers can remap such characters when an explicit mapping is specified in |
| 245 | the Server's registry. Samba starting with version 3.10 will allow such |
| 246 | filenames (ie those which contain valid Linux characters, which normally |
| 247 | would be forbidden for Windows/CIFS semantics) as long as the server is |
| 248 | configured for Unix Extensions (and the client has not disabled |
| 249 | /proc/fs/cifs/LinuxExtensionsEnabled). |
| 250 | |
| 251 | |
| 252 | CIFS VFS Mount Options |
| 253 | ====================== |
| 254 | A partial list of the supported mount options follows: |
| 255 | user The user name to use when trying to establish |
| 256 | the CIFS session. |
| 257 | password The user password. If the mount helper is |
| 258 | installed, the user will be prompted for password |
| 259 | if not supplied. |
| 260 | ip The ip address of the target server |
| 261 | unc The target server Universal Network Name (export) to |
| 262 | mount. |
| 263 | domain Set the SMB/CIFS workgroup name prepended to the |
| 264 | username during CIFS session establishment |
| 265 | forceuid Set the default uid for inodes to the uid |
| 266 | passed in on mount. For mounts to servers |
| 267 | which do support the CIFS Unix extensions, such as a |
| 268 | properly configured Samba server, the server provides |
| 269 | the uid, gid and mode so this parameter should not be |
| 270 | specified unless the server and clients uid and gid |
| 271 | numbering differ. If the server and client are in the |
| 272 | same domain (e.g. running winbind or nss_ldap) and |
| 273 | the server supports the Unix Extensions then the uid |
| 274 | and gid can be retrieved from the server (and uid |
| 275 | and gid would not have to be specifed on the mount. |
| 276 | For servers which do not support the CIFS Unix |
| 277 | extensions, the default uid (and gid) returned on lookup |
| 278 | of existing files will be the uid (gid) of the person |
| 279 | who executed the mount (root, except when mount.cifs |
| 280 | is configured setuid for user mounts) unless the "uid=" |
| 281 | (gid) mount option is specified. Also note that permission |
| 282 | checks (authorization checks) on accesses to a file occur |
| 283 | at the server, but there are cases in which an administrator |
| 284 | may want to restrict at the client as well. For those |
| 285 | servers which do not report a uid/gid owner |
| 286 | (such as Windows), permissions can also be checked at the |
| 287 | client, and a crude form of client side permission checking |
| 288 | can be enabled by specifying file_mode and dir_mode on |
| 289 | the client. (default) |
| 290 | forcegid (similar to above but for the groupid instead of uid) (default) |
| 291 | noforceuid Fill in file owner information (uid) by requesting it from |
| 292 | the server if possible. With this option, the value given in |
| 293 | the uid= option (on mount) will only be used if the server |
| 294 | can not support returning uids on inodes. |
| 295 | noforcegid (similar to above but for the group owner, gid, instead of uid) |
| 296 | uid Set the default uid for inodes, and indicate to the |
| 297 | cifs kernel driver which local user mounted. If the server |
| 298 | supports the unix extensions the default uid is |
| 299 | not used to fill in the owner fields of inodes (files) |
| 300 | unless the "forceuid" parameter is specified. |
| 301 | gid Set the default gid for inodes (similar to above). |
| 302 | file_mode If CIFS Unix extensions are not supported by the server |
| 303 | this overrides the default mode for file inodes. |
| 304 | fsc Enable local disk caching using FS-Cache (off by default). This |
| 305 | option could be useful to improve performance on a slow link, |
| 306 | heavily loaded server and/or network where reading from the |
| 307 | disk is faster than reading from the server (over the network). |
| 308 | This could also impact scalability positively as the |
| 309 | number of calls to the server are reduced. However, local |
| 310 | caching is not suitable for all workloads for e.g. read-once |
| 311 | type workloads. So, you need to consider carefully your |
| 312 | workload/scenario before using this option. Currently, local |
| 313 | disk caching is functional for CIFS files opened as read-only. |
| 314 | dir_mode If CIFS Unix extensions are not supported by the server |
| 315 | this overrides the default mode for directory inodes. |
| 316 | port attempt to contact the server on this tcp port, before |
| 317 | trying the usual ports (port 445, then 139). |
| 318 | iocharset Codepage used to convert local path names to and from |
| 319 | Unicode. Unicode is used by default for network path |
| 320 | names if the server supports it. If iocharset is |
| 321 | not specified then the nls_default specified |
| 322 | during the local client kernel build will be used. |
| 323 | If server does not support Unicode, this parameter is |
| 324 | unused. |
| 325 | rsize default read size (usually 16K). The client currently |
| 326 | can not use rsize larger than CIFSMaxBufSize. CIFSMaxBufSize |
| 327 | defaults to 16K and may be changed (from 8K to the maximum |
| 328 | kmalloc size allowed by your kernel) at module install time |
| 329 | for cifs.ko. Setting CIFSMaxBufSize to a very large value |
| 330 | will cause cifs to use more memory and may reduce performance |
| 331 | in some cases. To use rsize greater than 127K (the original |
| 332 | cifs protocol maximum) also requires that the server support |
| 333 | a new Unix Capability flag (for very large read) which some |
| 334 | newer servers (e.g. Samba 3.0.26 or later) do. rsize can be |
| 335 | set from a minimum of 2048 to a maximum of 130048 (127K or |
| 336 | CIFSMaxBufSize, whichever is smaller) |
| 337 | wsize default write size (default 57344) |
| 338 | maximum wsize currently allowed by CIFS is 57344 (fourteen |
| 339 | 4096 byte pages) |
| 340 | actimeo=n attribute cache timeout in seconds (default 1 second). |
| 341 | After this timeout, the cifs client requests fresh attribute |
| 342 | information from the server. This option allows to tune the |
| 343 | attribute cache timeout to suit the workload needs. Shorter |
| 344 | timeouts mean better the cache coherency, but increased number |
| 345 | of calls to the server. Longer timeouts mean reduced number |
| 346 | of calls to the server at the expense of less stricter cache |
| 347 | coherency checks (i.e. incorrect attribute cache for a short |
| 348 | period of time). |
| 349 | rw mount the network share read-write (note that the |
| 350 | server may still consider the share read-only) |
| 351 | ro mount network share read-only |
| 352 | version used to distinguish different versions of the |
| 353 | mount helper utility (not typically needed) |
| 354 | sep if first mount option (after the -o), overrides |
| 355 | the comma as the separator between the mount |
| 356 | parms. e.g. |
| 357 | -o user=myname,password=mypassword,domain=mydom |
| 358 | could be passed instead with period as the separator by |
| 359 | -o sep=.user=myname.password=mypassword.domain=mydom |
| 360 | this might be useful when comma is contained within username |
| 361 | or password or domain. This option is less important |
| 362 | when the cifs mount helper cifs.mount (version 1.1 or later) |
| 363 | is used. |
| 364 | nosuid Do not allow remote executables with the suid bit |
| 365 | program to be executed. This is only meaningful for mounts |
| 366 | to servers such as Samba which support the CIFS Unix Extensions. |
| 367 | If you do not trust the servers in your network (your mount |
| 368 | targets) it is recommended that you specify this option for |
| 369 | greater security. |
| 370 | exec Permit execution of binaries on the mount. |
| 371 | noexec Do not permit execution of binaries on the mount. |
| 372 | dev Recognize block devices on the remote mount. |
| 373 | nodev Do not recognize devices on the remote mount. |
| 374 | suid Allow remote files on this mountpoint with suid enabled to |
| 375 | be executed (default for mounts when executed as root, |
| 376 | nosuid is default for user mounts). |
| 377 | credentials Although ignored by the cifs kernel component, it is used by |
| 378 | the mount helper, mount.cifs. When mount.cifs is installed it |
| 379 | opens and reads the credential file specified in order |
| 380 | to obtain the userid and password arguments which are passed to |
| 381 | the cifs vfs. |
| 382 | guest Although ignored by the kernel component, the mount.cifs |
| 383 | mount helper will not prompt the user for a password |
| 384 | if guest is specified on the mount options. If no |
| 385 | password is specified a null password will be used. |
| 386 | perm Client does permission checks (vfs_permission check of uid |
| 387 | and gid of the file against the mode and desired operation), |
| 388 | Note that this is in addition to the normal ACL check on the |
| 389 | target machine done by the server software. |
| 390 | Client permission checking is enabled by default. |
| 391 | noperm Client does not do permission checks. This can expose |
| 392 | files on this mount to access by other users on the local |
| 393 | client system. It is typically only needed when the server |
| 394 | supports the CIFS Unix Extensions but the UIDs/GIDs on the |
| 395 | client and server system do not match closely enough to allow |
| 396 | access by the user doing the mount, but it may be useful with |
| 397 | non CIFS Unix Extension mounts for cases in which the default |
| 398 | mode is specified on the mount but is not to be enforced on the |
| 399 | client (e.g. perhaps when MultiUserMount is enabled) |
| 400 | Note that this does not affect the normal ACL check on the |
| 401 | target machine done by the server software (of the server |
| 402 | ACL against the user name provided at mount time). |
| 403 | serverino Use server's inode numbers instead of generating automatically |
| 404 | incrementing inode numbers on the client. Although this will |
| 405 | make it easier to spot hardlinked files (as they will have |
| 406 | the same inode numbers) and inode numbers may be persistent, |
| 407 | note that the server does not guarantee that the inode numbers |
| 408 | are unique if multiple server side mounts are exported under a |
| 409 | single share (since inode numbers on the servers might not |
| 410 | be unique if multiple filesystems are mounted under the same |
| 411 | shared higher level directory). Note that some older |
| 412 | (e.g. pre-Windows 2000) do not support returning UniqueIDs |
| 413 | or the CIFS Unix Extensions equivalent and for those |
| 414 | this mount option will have no effect. Exporting cifs mounts |
| 415 | under nfsd requires this mount option on the cifs mount. |
| 416 | This is now the default if server supports the |
| 417 | required network operation. |
| 418 | noserverino Client generates inode numbers (rather than using the actual one |
| 419 | from the server). These inode numbers will vary after |
| 420 | unmount or reboot which can confuse some applications, |
| 421 | but not all server filesystems support unique inode |
| 422 | numbers. |
| 423 | setuids If the CIFS Unix extensions are negotiated with the server |
| 424 | the client will attempt to set the effective uid and gid of |
| 425 | the local process on newly created files, directories, and |
| 426 | devices (create, mkdir, mknod). If the CIFS Unix Extensions |
| 427 | are not negotiated, for newly created files and directories |
| 428 | instead of using the default uid and gid specified on |
| 429 | the mount, cache the new file's uid and gid locally which means |
| 430 | that the uid for the file can change when the inode is |
| 431 | reloaded (or the user remounts the share). |
| 432 | nosetuids The client will not attempt to set the uid and gid on |
| 433 | on newly created files, directories, and devices (create, |
| 434 | mkdir, mknod) which will result in the server setting the |
| 435 | uid and gid to the default (usually the server uid of the |
| 436 | user who mounted the share). Letting the server (rather than |
| 437 | the client) set the uid and gid is the default. If the CIFS |
| 438 | Unix Extensions are not negotiated then the uid and gid for |
| 439 | new files will appear to be the uid (gid) of the mounter or the |
| 440 | uid (gid) parameter specified on the mount. |
| 441 | netbiosname When mounting to servers via port 139, specifies the RFC1001 |
| 442 | source name to use to represent the client netbios machine |
| 443 | name when doing the RFC1001 netbios session initialize. |
| 444 | direct Do not do inode data caching on files opened on this mount. |
| 445 | This precludes mmapping files on this mount. In some cases |
| 446 | with fast networks and little or no caching benefits on the |
| 447 | client (e.g. when the application is doing large sequential |
| 448 | reads bigger than page size without rereading the same data) |
| 449 | this can provide better performance than the default |
| 450 | behavior which caches reads (readahead) and writes |
| 451 | (writebehind) through the local Linux client pagecache |
| 452 | if oplock (caching token) is granted and held. Note that |
| 453 | direct allows write operations larger than page size |
| 454 | to be sent to the server. |
| 455 | strictcache Use for switching on strict cache mode. In this mode the |
| 456 | client read from the cache all the time it has Oplock Level II, |
| 457 | otherwise - read from the server. All written data are stored |
| 458 | in the cache, but if the client doesn't have Exclusive Oplock, |
| 459 | it writes the data to the server. |
| 460 | rwpidforward Forward pid of a process who opened a file to any read or write |
| 461 | operation on that file. This prevent applications like WINE |
| 462 | from failing on read and write if we use mandatory brlock style. |
| 463 | acl Allow setfacl and getfacl to manage posix ACLs if server |
| 464 | supports them. (default) |
| 465 | noacl Do not allow setfacl and getfacl calls on this mount |
| 466 | user_xattr Allow getting and setting user xattrs (those attributes whose |
| 467 | name begins with "user." or "os2.") as OS/2 EAs (extended |
| 468 | attributes) to the server. This allows support of the |
| 469 | setfattr and getfattr utilities. (default) |
| 470 | nouser_xattr Do not allow getfattr/setfattr to get/set/list xattrs |
| 471 | mapchars Translate six of the seven reserved characters (not backslash) |
| 472 | *?<>|: |
| 473 | to the remap range (above 0xF000), which also |
| 474 | allows the CIFS client to recognize files created with |
| 475 | such characters by Windows's POSIX emulation. This can |
| 476 | also be useful when mounting to most versions of Samba |
| 477 | (which also forbids creating and opening files |
| 478 | whose names contain any of these seven characters). |
| 479 | This has no effect if the server does not support |
| 480 | Unicode on the wire. |
| 481 | nomapchars Do not translate any of these seven characters (default). |
| 482 | nocase Request case insensitive path name matching (case |
| 483 | sensitive is the default if the server supports it). |
| 484 | (mount option "ignorecase" is identical to "nocase") |
| 485 | posixpaths If CIFS Unix extensions are supported, attempt to |
| 486 | negotiate posix path name support which allows certain |
| 487 | characters forbidden in typical CIFS filenames, without |
| 488 | requiring remapping. (default) |
| 489 | noposixpaths If CIFS Unix extensions are supported, do not request |
| 490 | posix path name support (this may cause servers to |
| 491 | reject creatingfile with certain reserved characters). |
| 492 | nounix Disable the CIFS Unix Extensions for this mount (tree |
| 493 | connection). This is rarely needed, but it may be useful |
| 494 | in order to turn off multiple settings all at once (ie |
| 495 | posix acls, posix locks, posix paths, symlink support |
| 496 | and retrieving uids/gids/mode from the server) or to |
| 497 | work around a bug in server which implement the Unix |
| 498 | Extensions. |
| 499 | nobrl Do not send byte range lock requests to the server. |
| 500 | This is necessary for certain applications that break |
| 501 | with cifs style mandatory byte range locks (and most |
| 502 | cifs servers do not yet support requesting advisory |
| 503 | byte range locks). |
| 504 | forcemandatorylock Even if the server supports posix (advisory) byte range |
| 505 | locking, send only mandatory lock requests. For some |
| 506 | (presumably rare) applications, originally coded for |
| 507 | DOS/Windows, which require Windows style mandatory byte range |
| 508 | locking, they may be able to take advantage of this option, |
| 509 | forcing the cifs client to only send mandatory locks |
| 510 | even if the cifs server would support posix advisory locks. |
| 511 | "forcemand" is accepted as a shorter form of this mount |
| 512 | option. |
| 513 | nostrictsync If this mount option is set, when an application does an |
| 514 | fsync call then the cifs client does not send an SMB Flush |
| 515 | to the server (to force the server to write all dirty data |
| 516 | for this file immediately to disk), although cifs still sends |
| 517 | all dirty (cached) file data to the server and waits for the |
| 518 | server to respond to the write. Since SMB Flush can be |
| 519 | very slow, and some servers may be reliable enough (to risk |
| 520 | delaying slightly flushing the data to disk on the server), |
| 521 | turning on this option may be useful to improve performance for |
| 522 | applications that fsync too much, at a small risk of server |
| 523 | crash. If this mount option is not set, by default cifs will |
| 524 | send an SMB flush request (and wait for a response) on every |
| 525 | fsync call. |
| 526 | nodfs Disable DFS (global name space support) even if the |
| 527 | server claims to support it. This can help work around |
| 528 | a problem with parsing of DFS paths with Samba server |
| 529 | versions 3.0.24 and 3.0.25. |
| 530 | remount remount the share (often used to change from ro to rw mounts |
| 531 | or vice versa) |
| 532 | cifsacl Report mode bits (e.g. on stat) based on the Windows ACL for |
| 533 | the file. (EXPERIMENTAL) |
| 534 | servern Specify the server 's netbios name (RFC1001 name) to use |
| 535 | when attempting to setup a session to the server. |
| 536 | This is needed for mounting to some older servers (such |
| 537 | as OS/2 or Windows 98 and Windows ME) since they do not |
| 538 | support a default server name. A server name can be up |
| 539 | to 15 characters long and is usually uppercased. |
| 540 | sfu When the CIFS Unix Extensions are not negotiated, attempt to |
| 541 | create device files and fifos in a format compatible with |
| 542 | Services for Unix (SFU). In addition retrieve bits 10-12 |
| 543 | of the mode via the SETFILEBITS extended attribute (as |
| 544 | SFU does). In the future the bottom 9 bits of the |
| 545 | mode also will be emulated using queries of the security |
| 546 | descriptor (ACL). |
| 547 | mfsymlinks Enable support for Minshall+French symlinks |
| 548 | (see http://wiki.samba.org/index.php/UNIX_Extensions#Minshall.2BFrench_symlinks) |
| 549 | This option is ignored when specified together with the |
| 550 | 'sfu' option. Minshall+French symlinks are used even if |
| 551 | the server supports the CIFS Unix Extensions. |
| 552 | sign Must use packet signing (helps avoid unwanted data modification |
| 553 | by intermediate systems in the route). Note that signing |
| 554 | does not work with lanman or plaintext authentication. |
| 555 | seal Must seal (encrypt) all data on this mounted share before |
| 556 | sending on the network. Requires support for Unix Extensions. |
| 557 | Note that this differs from the sign mount option in that it |
| 558 | causes encryption of data sent over this mounted share but other |
| 559 | shares mounted to the same server are unaffected. |
| 560 | locallease This option is rarely needed. Fcntl F_SETLEASE is |
| 561 | used by some applications such as Samba and NFSv4 server to |
| 562 | check to see whether a file is cacheable. CIFS has no way |
| 563 | to explicitly request a lease, but can check whether a file |
| 564 | is cacheable (oplocked). Unfortunately, even if a file |
| 565 | is not oplocked, it could still be cacheable (ie cifs client |
| 566 | could grant fcntl leases if no other local processes are using |
| 567 | the file) for cases for example such as when the server does not |
| 568 | support oplocks and the user is sure that the only updates to |
| 569 | the file will be from this client. Specifying this mount option |
| 570 | will allow the cifs client to check for leases (only) locally |
| 571 | for files which are not oplocked instead of denying leases |
| 572 | in that case. (EXPERIMENTAL) |
| 573 | sec Security mode. Allowed values are: |
| 574 | none attempt to connection as a null user (no name) |
| 575 | krb5 Use Kerberos version 5 authentication |
| 576 | krb5i Use Kerberos authentication and packet signing |
| 577 | ntlm Use NTLM password hashing (default) |
| 578 | ntlmi Use NTLM password hashing with signing (if |
| 579 | /proc/fs/cifs/PacketSigningEnabled on or if |
| 580 | server requires signing also can be the default) |
| 581 | ntlmv2 Use NTLMv2 password hashing |
| 582 | ntlmv2i Use NTLMv2 password hashing with packet signing |
| 583 | lanman (if configured in kernel config) use older |
| 584 | lanman hash |
| 585 | hard Retry file operations if server is not responding |
| 586 | soft Limit retries to unresponsive servers (usually only |
| 587 | one retry) before returning an error. (default) |
| 588 | |
| 589 | The mount.cifs mount helper also accepts a few mount options before -o |
| 590 | including: |
| 591 | |
| 592 | -S take password from stdin (equivalent to setting the environment |
| 593 | variable "PASSWD_FD=0" |
| 594 | -V print mount.cifs version |
| 595 | -? display simple usage information |
| 596 | |
| 597 | With most 2.6 kernel versions of modutils, the version of the cifs kernel |
| 598 | module can be displayed via modinfo. |
| 599 | |
| 600 | Misc /proc/fs/cifs Flags and Debug Info |
| 601 | ======================================= |
| 602 | Informational pseudo-files: |
| 603 | DebugData Displays information about active CIFS sessions and |
| 604 | shares, features enabled as well as the cifs.ko |
| 605 | version. |
| 606 | Stats Lists summary resource usage information as well as per |
| 607 | share statistics, if CONFIG_CIFS_STATS in enabled |
| 608 | in the kernel configuration. |
| 609 | |
| 610 | Configuration pseudo-files: |
| 611 | PacketSigningEnabled If set to one, cifs packet signing is enabled |
| 612 | and will be used if the server requires |
| 613 | it. If set to two, cifs packet signing is |
| 614 | required even if the server considers packet |
| 615 | signing optional. (default 1) |
| 616 | SecurityFlags Flags which control security negotiation and |
| 617 | also packet signing. Authentication (may/must) |
| 618 | flags (e.g. for NTLM and/or NTLMv2) may be combined with |
| 619 | the signing flags. Specifying two different password |
| 620 | hashing mechanisms (as "must use") on the other hand |
| 621 | does not make much sense. Default flags are |
| 622 | 0x07007 |
| 623 | (NTLM, NTLMv2 and packet signing allowed). The maximum |
| 624 | allowable flags if you want to allow mounts to servers |
| 625 | using weaker password hashes is 0x37037 (lanman, |
| 626 | plaintext, ntlm, ntlmv2, signing allowed). Some |
| 627 | SecurityFlags require the corresponding menuconfig |
| 628 | options to be enabled (lanman and plaintext require |
| 629 | CONFIG_CIFS_WEAK_PW_HASH for example). Enabling |
| 630 | plaintext authentication currently requires also |
| 631 | enabling lanman authentication in the security flags |
| 632 | because the cifs module only supports sending |
| 633 | laintext passwords using the older lanman dialect |
| 634 | form of the session setup SMB. (e.g. for authentication |
| 635 | using plain text passwords, set the SecurityFlags |
| 636 | to 0x30030): |
| 637 | |
| 638 | may use packet signing 0x00001 |
| 639 | must use packet signing 0x01001 |
| 640 | may use NTLM (most common password hash) 0x00002 |
| 641 | must use NTLM 0x02002 |
| 642 | may use NTLMv2 0x00004 |
| 643 | must use NTLMv2 0x04004 |
| 644 | may use Kerberos security 0x00008 |
| 645 | must use Kerberos 0x08008 |
| 646 | may use lanman (weak) password hash 0x00010 |
| 647 | must use lanman password hash 0x10010 |
| 648 | may use plaintext passwords 0x00020 |
| 649 | must use plaintext passwords 0x20020 |
| 650 | (reserved for future packet encryption) 0x00040 |
| 651 | |
| 652 | cifsFYI If set to non-zero value, additional debug information |
| 653 | will be logged to the system error log. This field |
| 654 | contains three flags controlling different classes of |
| 655 | debugging entries. The maximum value it can be set |
| 656 | to is 7 which enables all debugging points (default 0). |
| 657 | Some debugging statements are not compiled into the |
| 658 | cifs kernel unless CONFIG_CIFS_DEBUG2 is enabled in the |
| 659 | kernel configuration. cifsFYI may be set to one or |
| 660 | nore of the following flags (7 sets them all): |
| 661 | |
| 662 | log cifs informational messages 0x01 |
| 663 | log return codes from cifs entry points 0x02 |
| 664 | log slow responses (ie which take longer than 1 second) |
| 665 | CONFIG_CIFS_STATS2 must be enabled in .config 0x04 |
| 666 | |
| 667 | |
| 668 | traceSMB If set to one, debug information is logged to the |
| 669 | system error log with the start of smb requests |
| 670 | and responses (default 0) |
| 671 | LookupCacheEnable If set to one, inode information is kept cached |
| 672 | for one second improving performance of lookups |
| 673 | (default 1) |
| 674 | OplockEnabled If set to one, safe distributed caching enabled. |
| 675 | (default 1) |
| 676 | LinuxExtensionsEnabled If set to one then the client will attempt to |
| 677 | use the CIFS "UNIX" extensions which are optional |
| 678 | protocol enhancements that allow CIFS servers |
| 679 | to return accurate UID/GID information as well |
| 680 | as support symbolic links. If you use servers |
| 681 | such as Samba that support the CIFS Unix |
| 682 | extensions but do not want to use symbolic link |
| 683 | support and want to map the uid and gid fields |
| 684 | to values supplied at mount (rather than the |
| 685 | actual values, then set this to zero. (default 1) |
| 686 | |
| 687 | These experimental features and tracing can be enabled by changing flags in |
| 688 | /proc/fs/cifs (after the cifs module has been installed or built into the |
| 689 | kernel, e.g. insmod cifs). To enable a feature set it to 1 e.g. to enable |
| 690 | tracing to the kernel message log type: |
| 691 | |
| 692 | echo 7 > /proc/fs/cifs/cifsFYI |
| 693 | |
| 694 | cifsFYI functions as a bit mask. Setting it to 1 enables additional kernel |
| 695 | logging of various informational messages. 2 enables logging of non-zero |
| 696 | SMB return codes while 4 enables logging of requests that take longer |
| 697 | than one second to complete (except for byte range lock requests). |
| 698 | Setting it to 4 requires defining CONFIG_CIFS_STATS2 manually in the |
| 699 | source code (typically by setting it in the beginning of cifsglob.h), |
| 700 | and setting it to seven enables all three. Finally, tracing |
| 701 | the start of smb requests and responses can be enabled via: |
| 702 | |
| 703 | echo 1 > /proc/fs/cifs/traceSMB |
| 704 | |
| 705 | Per share (per client mount) statistics are available in /proc/fs/cifs/Stats |
| 706 | if the kernel was configured with cifs statistics enabled. The statistics |
| 707 | represent the number of successful (ie non-zero return code from the server) |
| 708 | SMB responses to some of the more common commands (open, delete, mkdir etc.). |
| 709 | Also recorded is the total bytes read and bytes written to the server for |
| 710 | that share. Note that due to client caching effects this can be less than the |
| 711 | number of bytes read and written by the application running on the client. |
| 712 | The statistics for the number of total SMBs and oplock breaks are different in |
| 713 | that they represent all for that share, not just those for which the server |
| 714 | returned success. |
| 715 | |
| 716 | Also note that "cat /proc/fs/cifs/DebugData" will display information about |
| 717 | the active sessions and the shares that are mounted. |
| 718 | |
| 719 | Enabling Kerberos (extended security) works but requires version 1.2 or later |
| 720 | of the helper program cifs.upcall to be present and to be configured in the |
| 721 | /etc/request-key.conf file. The cifs.upcall helper program is from the Samba |
| 722 | project(http://www.samba.org). NTLM and NTLMv2 and LANMAN support do not |
| 723 | require this helper. Note that NTLMv2 security (which does not require the |
| 724 | cifs.upcall helper program), instead of using Kerberos, is sufficient for |
| 725 | some use cases. |
| 726 | |
| 727 | DFS support allows transparent redirection to shares in an MS-DFS name space. |
| 728 | In addition, DFS support for target shares which are specified as UNC |
| 729 | names which begin with host names (rather than IP addresses) requires |
| 730 | a user space helper (such as cifs.upcall) to be present in order to |
| 731 | translate host names to ip address, and the user space helper must also |
| 732 | be configured in the file /etc/request-key.conf. Samba, Windows servers and |
| 733 | many NAS appliances support DFS as a way of constructing a global name |
| 734 | space to ease network configuration and improve reliability. |
| 735 | |
| 736 | To use cifs Kerberos and DFS support, the Linux keyutils package should be |
| 737 | installed and something like the following lines should be added to the |
| 738 | /etc/request-key.conf file: |
| 739 | |
| 740 | create cifs.spnego * * /usr/local/sbin/cifs.upcall %k |
| 741 | create dns_resolver * * /usr/local/sbin/cifs.upcall %k |
| 742 | |
| 743 | CIFS kernel module parameters |
| 744 | ============================= |
| 745 | These module parameters can be specified or modified either during the time of |
| 746 | module loading or during the runtime by using the interface |
| 747 | /proc/module/cifs/parameters/<param> |
| 748 | |
| 749 | i.e. echo "value" > /sys/module/cifs/parameters/<param> |
| 750 | |
| 751 | 1. enable_oplocks - Enable or disable oplocks. Oplocks are enabled by default. |
| 752 | [Y/y/1]. To disable use any of [N/n/0]. |
| 753 | |