ONTAP NFS: Remove Write Access from an Existing Export Rule

This ONTAP 9 NFS example removes write access from one existing export rule. Identify the SVM, policy, rule index and client first; the source uses svm1_cluster1, policy default, rule 1 and client 192.168.0.100. Queries without SVM/policy filters can match more than one rule, so verify the returned identity before editing.

1. Inspect the current rule

cluster1::*> export-policy rule show -clientmatch 192.168.0.100 -ruleindex 1 -instance

Vserver: svm1_cluster1
Policy Name: default
Rule Index: 1
Access Protocol: nfs3, nfs4, cifs, nfs
List of Client Match Hostnames, IP Addresses, Netgroups, or Domains: 192.168.0.100
RO Access Rule: any
RW Access Rule: any
User ID To Which Anonymous Users Are Mapped: 65534
Superuser Security Types: any
Honor SetUID Bits in SETATTR: true
Allow Creation of Devices: true
NTFS Unix Security Options: fail
Vserver NTFS Unix Security Options: use_export_policy
Change Ownership Mode: restricted
Vserver Change Ownership Mode: use_export_policy
Policy ID: 12884901889

2. Remove write access

cluster1::*> vserver export-policy rule modify -vserver svm1_cluster1 -clientmatch 192.168.0.100 -ruleindex 1 -rwrule never -policyname default

3. Verify the change

cluster1::*> vserver export-policy rule show -clientmatch 192.168.0.100 -ruleindex 1 -instance

Vserver: svm1_cluster1
Policy Name: default
Rule Index: 1
Access Protocol: nfs3, nfs4, cifs, nfs
List of Client Match Hostnames, IP Addresses, Netgroups, or Domains: 192.168.0.100
RO Access Rule: any
RW Access Rule: never
User ID To Which Anonymous Users Are Mapped: 65534
Superuser Security Types: any
Honor SetUID Bits in SETATTR: true
Allow Creation of Devices: true
NTFS Unix Security Options: fail
Vserver NTFS Unix Security Options: use_export_policy
Change Ownership Mode: restricted
Vserver Change Ownership Mode: use_export_policy
Policy ID: 12884901889

In this example, RW Access Rule changes from any to never; RO Access Rule remains any. The documented never value denies write access for clients matching this rule, regardless of the effective security type. It does not delete the export or itself alter filesystem permissions.

Changing this rule affects every client matched by it and the objects using this policy. Confirm the intended impact before applying the example. See the official export-policy rule modify reference.