--- /dev/null	Mon Aug  5 17:17:26 2019
+++ new/usr/src/man/man5/sharenfs.5	Mon Aug  5 17:17:26 2019
@@ -0,0 +1,491 @@
+.\"
+.\" CDDL HEADER START
+.\"
+.\" The contents of this file are subject to the terms of the
+.\" Common Development and Distribution License (the "License").
+.\" You may not use this file except in compliance with the License.
+.\"
+.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+.\" or http://www.opensolaris.org/os/licensing.
+.\" See the License for the specific language governing permissions
+.\" and limitations under the License.
+.\"
+.\" When distributing Covered Code, include this CDDL HEADER in each
+.\" file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+.\" If applicable, add the following below this CDDL HEADER, with the
+.\" fields enclosed by brackets "[]" replaced with your own identifying
+.\" information: Portions Copyright [yyyy] [name of copyright owner]
+.\"
+.\" CDDL HEADER END
+.\"
+.\"
+.\" Copyright (C) 2008, Sun Microsystems, Inc. All Rights Reserved
+.\" Copyright 2017 Nexenta Systems, Inc.
+.\" Copyright 2016 Jason King.
+.\"
+.Dd November 22, 2017
+.Dt SHARENFS 5
+.Os
+.Sh NAME
+.Nm sharenfs
+.Nd NFS share options
+.Sh DESCRIPTION
+The following options are supported:
+.Bl -tag -width Ds
+.It Cm aclok
+Allows the NFS server to do access control for NFS Version 2 clients (running
+SunOS 2.4 or earlier).
+When
+.Cm aclok
+is set on the server, maximal access is given to all clients.
+For example, with
+.Cm aclok
+set, if anyone has read permissions, then everyone does.
+If
+.Cm aclok
+is not set, minimal access is given to all clients.
+.It Cm anon Ns = Ns Ar uid
+Set
+.Ar uid
+to be the effective user ID of unknown users.
+By default, unknown users are given the effective user ID
+.Dv UID_NOBODY .
+If uid is set to -1, access is denied.
+.It Ar charset Ns = Ns Ar access-list
+Where
+.Ar charset
+is one of:
+.Cm euc-cn , euc-jp , euc-jpms , euc-kr , euc-tw , iso8859-1 , iso8859-2 ,
+.Cm iso8859-5 , iso8859-6 , iso8859-7 , iso8859-8 , iso8859-9 , iso8859-13 ,
+.Cm iso8859-15 , koi8-r .
+.Pp
+Clients that match the
+.Ar access-list
+for one of these properties will be assumed to be using that character set and
+file and path names will be converted to UTF-8 for the server.
+.It Cm gidmap Ns = Ns Ar mapping Ns Oo ~ Ns Ar mapping Oc Ns ...
+Where
+.Ar mapping
+is:
+.Oo Ar clnt Oc : Ns Oo Ar srv Oc : Ns Ar access-list
+.Pp
+Allows remapping the group ID
+.Pq gid
+in the incoming request to some other gid.
+This effectively changes the identity of the user in the request to that of
+some other local user.
+.Pp
+For clients where the gid in the incoming request is
+.Ar clnt
+and the client matches the
+.Ar access-list ,
+change the group ID to
+.Ar srv .
+If
+.Ar clnt
+is asterisk
+.Pq Qq * ,
+all groups are mapped by this rule.
+If
+.Ar clnt
+is omitted, all unknown groups are mapped by this rule.
+If
+.Ar srv
+is set to -1, access is denied.
+If
+.Ar srv
+is omitted, the gid is mapped to
+.Dv UID_NOBODY .
+.Pp
+Multiple
+.Ar mapping Ns s
+in the
+.Cm gidmap Ns =
+option are separated by tilde
+.Pq Qq ~
+and are evaluated in the specified order until a match is found.
+Both
+.Cm root Ns =
+and
+.Cm root_mapping Ns =
+options
+.Pq if specified
+are evaluated before the
+.Cm gidmap Ns =
+option.
+The
+.Cm gidmap Ns =
+option is skipped in the case where the client matches the
+.Cm root Ns =
+option.
+.Pp
+The
+.Cm gidmap Ns =
+option is evaluated before the
+.Cm anon Ns =
+option.
+.Pp
+This option is supported only for AUTH_SYS.
+.It Cm index Ns = Ns Ar file
+Load
+.Ar file
+rather than a listing of the directory containing this file when the
+directory is referenced by an NFS URL.
+.It Cm log Ns Oo = Ns Ar tag Oc
+Enables NFS server logging for the specified file system.
+The optional
+.Ar tag
+determines the location of the related log files.
+The
+.Ar tag
+is defined in
+.Pa /etc/nfs/nfslog.conf .
+If no
+.Ar tag
+is specified, the default values associated with the global tag in
+.Pa /etc/nfs/nfslog.conf
+are used.
+Support of NFS server logging is only available for NFS Version 2 and
+Version 3 requests.
+.It Cm nohide
+By default, if server exports two filesystems, one of which is mounted as a
+child of the other, NFSv2 and NFSv3 clients must mount both filesystems
+explicitly in order to access them.
+If a client only mounts the parent, it will see an empty directory at the
+location where the other filesystem is mounted.
+.Pp
+Setting the
+.Cm nohide
+option on a filesystem causes it to no longer be hidden in this manner, and the
+client will be able to move from the parent filesystem to this one without
+noticing the change.
+However, some NFS clients or applications may not function correctly when this
+option is used.
+In particular, files on different underlying filesystems may appear to have the
+same inode numbers.
+The
+.Cm nohide
+option only applies to NFSv2 and NFSv3 requests.
+.It Cm noaclfab
+By default, the NFS server will fabricate POSIX-draft style ACLs in response
+to ACL requests from NFSv2 or NFSv3 clients accessing shared file systems that
+do not support POSIX-draft ACLs
+.Pq such as ZFS .
+Specifying
+.Cm noaclfab
+disables this behavior.
+.It Cm none Ns = Ns Ar access-list
+Access is not allowed to any client that matches the access list.
+The exception is when the access list is an asterisk
+.Pq Qq * ,
+in which case
+.Cm ro
+or
+.Cm rw
+can override
+.Cm none .
+.It Cm nosub
+Prevents clients from mounting subdirectories of shared directories.
+For example, if
+.Pa /export
+is shared with the
+.Cm nosub
+option on server
+.Em fooey
+then a NFS client cannot do
+.Ql mount -F nfs fooey:/export/home/mnt
+.Pp
+NFSv4 does not use the MOUNT protocol.
+The
+.Cm nosub
+option only applies to NFSv2 and NFSv3 requests.
+.It Cm nosuid
+By default, clients are allowed to create files on the shared file system with
+the setuid or setgid mode enabled.
+Specifying
+.Cm nosuid
+causes the server file system to silently ignore any attempt to enable the
+setuid or setgid mode bits.
+.It Cm public
+Moves the location of the public file handle from root
+.Pq Qq Pa /
+to the exported directory for WebNFS-enabled browsers and clients.
+This option does not enable WebNFS service; WebNFS is always on.
+Only one file system per server may use this option.
+Any other option, including the
+.Cm ro Ns = Ns Ar list
+and
+.Cm rw Ns = Ns Ar list
+options can be included with the
+.Cm public
+option.
+.It Cm ro
+Sharing is read-only to all clients.
+.It Cm ro Ns = Ns Ar access-list
+Sharing is read-only to the clients listed in
+.Ar access-list ;
+overrides the
+.Cm rw
+suboption for the clients specified.
+See
+.Xr shareacl 5
+for the description of
+.Ar access-list .
+.It Cm root Ns = Ns Ar access-list
+Only root users from the hosts specified in
+.Ar access-list
+have root access.
+See
+.Xr shareacl 5
+for the description of
+.Ar access-list .
+By default, no host has root access, so root users are mapped to an anonymous
+user ID
+.Po see the
+.Cm anon Ns = Ns Ar uid
+option described above
+.Pc .
+Netgroups can be used if the file system shared is using AUTH_SYS.
+.It Cm root_mapping Ns = Ns Ar uid
+For a client that is allowed root access, map the root UID to the specified
+user ID.
+.It Cm rw
+Sharing is read-write to all clients.
+.It Cm rw Ns = Ns Ar access-list
+Sharing is read-write to the clients listed in
+.Ar access-list ;
+overrides the
+.Cm ro
+suboption for the clients specified.
+See
+.Xr shareacl 5
+for the description of
+.Ar access-list .
+.It Cm sec Ns = Ns Ar mode Ns Oo : Ns Ar mode Oc Ns ...
+Sharing uses one or more of the specified security modes.
+The
+.Ar mode
+in the
+.Cm sec Ns = Ns Ar mode
+option must be a mode name supported on the client.
+If the
+.Cm sec Ns =
+option is not specified, the default security mode used is AUTH_SYS.
+Multiple
+.Cm sec Ns =
+options can be specified on the command line, although each mode can appear
+only once.
+The security modes are defined in
+.Xr nfssec 5 .
+.Pp
+Each
+.Cm sec Ns =
+option specifies modes that apply to any subsequent
+.Cm window Ns = ,
+.Cm rw ,
+.Cm ro ,
+.Cm rw Ns = ,
+.Cm ro Ns = ,
+and
+.Cm root Ns =
+options that are provided before another
+.Cm sec Ns =
+option.
+Each additional
+.Cm sec Ns =
+resets the security mode context, so that more
+.Cm window Ns = ,
+.Cm rw ,
+.Cm ro ,
+.Cm rw Ns = ,
+.Cm ro Ns = ,
+and
+.Cm root Ns =
+options can be supplied for additional modes.
+.It Cm sec Ns = Ns Cm none
+If the option
+.Cm sec Ns = Ns Cm none
+is specified when the client uses AUTH_NONE, or if the client uses a security
+mode that is not one that the file system is shared with, then the credential
+of each NFS request is treated as unauthenticated.
+See the
+.Cm anon Ns = Ns Ar uid
+option for a description of how unauthenticated requests are handled.
+.It Cm secure
+This option has been deprecated in favor of the
+.Cm sec Ns = Ns Cm dh
+option.
+.It Cm uidmap Ns = Ns Ar mapping Ns Oo ~ Ns Ar mapping Oc Ns ...
+Where
+.Ar mapping
+is:
+.Oo Ar clnt Oc : Ns Oo Ar srv Oc : Ns Ar access-list
+.Pp
+Allows remapping the user ID
+.Pq uid
+in the incoming request to some other uid.
+This effectively changes the identity of the user in the request to that of
+some other local user.
+.Pp
+For clients where the uid in the incoming request is
+.Ar clnt
+and the client matches the
+.Ar access-list ,
+change the user ID to
+.Ar srv .
+If
+.Ar clnt
+is asterisk
+.Pq Qq * ,
+all users are mapped by this rule.
+If
+.Ar clnt
+is omitted, all unknown users are mapped by this rule.
+If
+.Ar srv
+is set to -1, access is denied.
+If
+.Ar srv
+is omitted, the uid is mapped to
+.Dv UID_NOBODY .
+.Pp
+Multiple
+.Ar mapping Ns s
+in the
+.Cm uidmap Ns =
+option are separated by tilde
+.Pq Qq ~
+and are evaluated in the specified order until a match is found.
+Both
+.Cm root Ns =
+and
+.Cm root_mapping Ns =
+options
+.Pq if specified
+are evaluated before the
+.Cm uidmap Ns =
+option.
+The
+.Cm uidmap Ns =
+option is skipped in the case where the client matches the
+.Cm root Ns =
+option.
+.Pp
+The
+.Cm uidmap Ns =
+option is evaluated before the
+.Cm anon Ns =
+option.
+.Pp
+This option is supported only for AUTH_SYS.
+.It Cm window Ns = Ns Ar value
+When sharing with
+.Cm sec Ns = Ns Cm dh ,
+set the maximum life time
+.Pq in seconds
+of the RPC request's credential
+.Pq in the authentication header
+that the NFS server allows.
+If a credential arrives with a life time larger than what is allowed, the NFS
+server rejects the request.
+The default value is 30000 seconds
+.Pq 8.3 hours .
+.El
+.Sh FILES
+.Bl -tag -width "/etc/nfs/nfslog.conf"
+.It Pa /etc/dfs/fstypes
+list of system types, NFS by default
+.It Pa /etc/dfs/sharetab
+system record of shared file systems
+.It Pa /etc/nfs/nfslogtab
+system record of logged file systems
+.It Pa /etc/nfs/nfslog.conf
+logging configuration file
+.El
+.Sh SEE ALSO
+.Xr mount 1M ,
+.Xr mountd 1M ,
+.Xr nfsd 1M ,
+.Xr nfslogd 1M ,
+.Xr share 1M ,
+.Xr unshare 1M ,
+.Xr netgroup 4 ,
+.Xr nfslog.conf 4 ,
+.Xr acl 5 ,
+.Xr attributes 5 ,
+.Xr nfssec 5 ,
+.Xr shareacl 5
+.Sh NOTES
+If the
+.Cm sec Ns =
+option is presented at least once, all uses of the
+.Cm window Ns = ,
+.Cm rw ,
+.Cm ro ,
+.Cm rw Ns = ,
+.Cm ro Ns = ,
+and
+.Cm root Ns =
+options must come after the first
+.Cm sec Ns =
+option.
+If the
+.Cm sec Ns =
+option is not presented, then
+.Cm sec Ns = Ns Cm sys
+is implied.
+.Pp
+If one or more explicit
+.Cm sec Ns =
+options are presented,
+.Cm sys
+must appear in one of the options mode lists for accessing using the AUTH_SYS
+security mode to be allowed.
+.Pp
+Access checking for the
+.Cm window Ns = ,
+.Cm rw ,
+.Cm ro ,
+.Cm rw Ns = ,
+and
+.Cm ro Ns =
+options is done per NFS request, instead of per mount request.
+.Pp
+The
+.Cm ro Ns =
+and
+.Cm rw Ns =
+options are guaranteed to work over UDP and TCP but may not work over other
+transport providers.
+.Pp
+The
+.Cm root Ns =
+option with AUTH_SYS is guaranteed to work over UDP and TCP but may not work
+over other transport providers.
+.Pp
+The
+.Cm root Ns =
+option with AUTH_DES is guaranteed to work over any transport provider.
+.Pp
+There are no interactions between the
+.Cm root Ns =
+option and the
+.Cm ro ,
+.Cm rw ,
+.Cm ro Ns = ,
+and
+.Cm rw Ns =
+options.
+Putting a host in the root list does not override the semantics of the other
+options.
+The access the host gets is the same as when the
+.Cm root Ns =
+option is absent.
+.Pp
+The
+.Cm nohide
+option violates RFC 1094,
+.%T "Network File System Protocol Specification"
+and RFC 1813,
+.%T "NFS: Network File System Version 3 Protocol Specification"
+and is provided for compatibility with Linux NFS.
