允許連線至檔案共用區的用戶端清單，由您為 Filestore 執行個體選取的虛擬私有雲網路中的所有內部 IP 位址組成。內部 IP 位址可以是「子網路範圍」中列出的任何範圍。不過，如果您有使用非 RFC 1918 子網路範圍的用戶端，則必須使用以 IP 為基礎的存取控管機制，明確授予這些用戶端存取 Filestore 執行個體的權限。
使用 rw 選項，因此檔案共用區允許讀取和寫入作業。
採用使用者 ID 對應選項 no_root_squash，因此在 Filestore 執行個體與用戶端中的所有使用者與群組 (包括 root 使用者) 都應相同。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eFilestore instance access can be controlled using Kerberos with the NFSv4.1 protocol or through Linux options and Identity and Access Management (IAM) for instance operations.\u003c/p\u003e\n"],["\u003cp\u003eBy default, Filestore file shares allow connections from any internal IP address within the selected VPC network, offering read and write access with \u003ccode\u003eno_root_squash\u003c/code\u003e user ID mapping.\u003c/p\u003e\n"],["\u003cp\u003eYou can customize export settings and create access control rules for Filestore instances via the Google Cloud console or gcloud CLI, including the ability to add or modify these rules after instance creation.\u003c/p\u003e\n"],["\u003cp\u003eFilestore instances have default POSIX file permissions of \u003ccode\u003erwxr-xr-x\u003c/code\u003e, with only root users on connected clients initially having read and write access, and all other users only having read.\u003c/p\u003e\n"],["\u003cp\u003eZonal, regional, and enterprise Filestore instances support overlapping permissions for different IP address subnets, where rules for smaller subnets take precedence over larger ones, but identical IPv4 subnets are not supported and basic tiers do not support overlapping permissions.\u003c/p\u003e\n"]]],[],null,["# Access control\n\nThis page describes how to control access to Filestore instances.\n\n- With the [NFSv4.1 protocol](/filestore/docs/configure-nfsv4), you can use\n Kerberos for securing access to Filestore instances. For more\n information, see [About supported protocols](/filestore/docs/about-supported-protocols).\n\n- Alternatively, you can use the Linux options to control NFS access and\n [Identity and Access Management (IAM)](/filestore/docs/iam) to control access to instance\n operations, such as creating, editing, viewing, and deleting instances. The\n following guide walks you through how to complete each of these tasks.\n\nFile share export settings\n--------------------------\n\nA Filestore file share is assigned the following default\n[`/etc/exports`](https://linux.die.net/man/5/exports)\nsettings:\n\n- The client list---which identifies the clients allowed to connect to the file share---contains every internal IP address in the VPC network you selected for the Filestore instance. Internal IP addresses can be any range listed in [subnet\n ranges](/vpc/docs/subnets#manually_created_subnet_ip_ranges). However, if you have clients on non-[RFC 1918](https://tools.ietf.org/html/rfc1918) subnet ranges, you must explicitly grant them access to the Filestore instance using [IP-based access control](/filestore/docs/creating-instances#configure_ip-based_access_control).\n- The `rw` option is used, so the file share allows both read and write operations.\n- The user ID mapping option `no_root_squash` is used, so all users and groups, including the root user, are expected to be the same on both the Filestore instance and the client.\n- All other options use the [`/etc/exports`](https://linux.die.net/man/5/exports) defaults.\n\n### Basic-tier instances\n\nBasic SSD and basic HDD instances create an exported share labeled\n`/config/google-prober`, used to help support internal probing processes, which\nin turn verify access, durability, or performance. The share is exported to a\nclient list made accessible to the instance IP address only, using the same\nsettings as indicated in the previous section. The share is accessible to probers\nhosted on or originating from the instance only and is inaccessible outside of\nthe instance. The instance exports the share regardless of whether\n[IP-based access control](/filestore/docs/creating-instances#configure_ip-based_access_control)\nis applied. Users can see the exported share using the `showmount -e` command.\n\n### IP-based access control\n\nYou can change these export settings by creating access control rules using\nthe Google Cloud console or by specifying a JSON configuration file during\ninstance creation using the gcloud CLI. For details, see\n[Configuring IP-based access control](/filestore/docs/creating-instances#configure_ip-based_access_control).\n\nYou can also add new access control rules or modify existing ones after an\ninstance is created. For details, see [Editing instances](/filestore/docs/editing-instances).\n\nFile share permissions\n----------------------\n\nWhen you create a Filestore instance, the file share for that\ninstance has default POSIX file permissions of `rwxr-xr-x`. These permissions\nmean that on a Filestore instance, only root users on connected\nclients have read and write access to the file share. Other users have only read\naccess by default. Client root users can change permissions and owners.\n\n### Configuring access on a file share\n\nWhen mounting a file share, you can use\n[mount options](https://linux.die.net/man/8/mount) and\n[`/etc/fstab`](https://linux.die.net/man/5/fstab) settings to determine whether the\nfile share is writable and if files can be executed on it. After mounting the file share,\nyou can use standard Linux commands like [`chmod`](https://linux.die.net/man/1/chmod),\nand [`setfacl`](https://linux.die.net/man/1/setfacl)\nto set file and file share permissions. Only basic tiers support `setfacl`.\n\n### Setting consistent permissions\n\nWe strongly recommend that you set consistent permissions for each user on all\nclients that connect to the same Filestore instance to prevent\nprivilege escalation. If a file share is mounted on more than one client\nand a user has root privileges on one client but not the others, then the\nfollowing privilege escalation scenario is possible:\n\n- A user sets the `setuid` attribute on an executable file from the client where the user has root access.\n- The user then uploads the executable file to the file share.\n- The user executes the uploaded file as root on any client where the user has at least read permission.\n\nThis scenario is possible because the `setuid` bit allows the user to execute a\nfile using the permissions of the file owner, which in this case is root.\n\n### Overlapping permissions\n\nZonal, regional, and enterprise\ninstances now support overlapping permissions.\n\nIf two separate access control rules are defined for overlapping IP address\nsubnets, the rule defined for the smaller subnet takes priority.\n\nFor example, if a JSON configuration file contains a rule granting read and\nwrite access for the IPv4 address subnet `10.0.0.0/24`, and a separate rule\ngrants read-only access for the IPv4 address subnet `10.0.0.0/28`, Filestore\nrecognizes and applies the rule for the smaller subnet first. The other rule is\nthen applied to the remaining portions of the defined IP address subnet. In this\nexample, a client using the IPv4 address `10.0.0.20` is granted read and write\npermissions, while a client using `10.0.0.12` is granted read-only permissions: \n\n```\n {\n \"--file-share\":\n {\n \"capacity\": \"2048\",\n \"name\": \"my_vol\",\n \"nfs-export-options\": [\n {\n \"access-mode\": \"READ_WRITE\",\n \"ip-ranges\": [\n \"10.0.0.0/24\"\n ],\n \"squash-mode\": \"ROOT_SQUASH\",\n \"anon_uid\": 1003,\n \"anon_gid\": 1003\n },\n {\n \"access-mode\": \"READ_ONLY\",\n \"ip-ranges\": [\n \"10.0.0.0/28\"\n ],\n \"squash-mode\": \"NO_ROOT_SQUASH\"\n }\n ]\n }\n}\n```\n\nSome restrictions apply:\n\n- Overlapping permissions for identical IPv4 subnets are not supported and return\n an error.\n\n- Overlapping permissions are not supported for basic SSD or basic HDD instances.\n\nWhat's next\n-----------\n\n- [Configure IP-based access control](/filestore/docs/creating-instances#configure_ip-based_access_control) or see an [example](/filestore/docs/creating-instances#example_2).\n- [Creating instances](/filestore/docs/creating-instances).\n- [Edit instances](/filestore/docs/editing-instances).\n- [Troubleshoot common Filestore networking or connection issues](/filestore/docs/troubleshooting)."]]
