Access control
LeilFS controls access at three layers: which hosts may mount the filesystem and with what rights (leil-exports.cfg), optional password authentication on an export, and the usual POSIX ownership and permission checks on every operation.
Export ACL (leil-exports.cfg)
leil-exports.cfg, read by the master, is the primary access‑control mechanism. Each line grants an address (or range) access to a directory, with a set of options:
ADDRESS DIRECTORY [OPTIONS]
Address formats
| Format | Matches |
|---|---|
* | any address |
n.n.n.n | a single IP |
n.n.n.n/b | a network, bit‑count mask (CIDR) |
n.n.n.n/m.m.m.m | a network, dotted mask |
f.f.f.f-t.t.t.t | an inclusive IP range |
Common options
| Option | Effect |
|---|---|
ro / readonly | Read‑only export |
rw / readwrite | Read‑write export |
maproot=USER[:GROUP] | Map remote root (uid 0) to this user/group |
mapall=USER[:GROUP] | Map all non‑privileged users to this user/group |
password=PASS | Require this password to mount |
md5pass=MD5 | Require a password given as an MD5 hash |
alldirs | Allow mounting any subdirectory of the export |
dynamicip | Allow reconnection from a different IP after authentication |
ignoregid | Skip group‑access testing at the master |
minversion=VER | Require a minimum client version |
mingoal=N / maxgoal=N | Constrain the goal range clients may set |
mintrashtime=T / maxtrashtime=T | Constrain the trashtime range clients may set |
# Read-write for a subnet, remote root mapped to uid/gid 999
192.168.10.0/24 / rw,maproot=999:999
The default options for an export are ro,maproot=999:999 — read‑only, with root mapped to uid/gid 999. Set rw explicitly where clients need to write, and choose maproot deliberately. See the full option list in the configuration reference.
Password authentication
Attach a password to an export with password= (or md5pass=), then supply it at mount time. Passwords are hashed before transmission, so they are not sent in plaintext even when TLS is not enabled.
# leil-exports.cfg
192.168.10.0/24 / rw,maproot=999:999,password=s3cr3t
# Prompt for the password interactively
sudo leil-mount /mnt/client -H 192.168.10.10 -p
# Or pass it non-interactively
sudo leil-mount /mnt/client -H 192.168.10.10 -o sfspassword=s3cr3t
password= is stored in plaintext in leil-exports.cfg. Protect the file with mode 0644 owned by root, and prefer md5pass= where possible.
POSIX permissions
LeilFS enforces standard POSIX ownership (uid/gid) and mode bits (rwx) on every filesystem operation. POSIX ACLs are also supported when the client is mounted with the appropriate options, giving finer‑grained per‑user and per‑group rules on top of the classic owner/group/other model.