--- /n/sources/plan9/sys/src/cmd/exportfs/exportfs.c	Sun Apr 14 16:33:20 2019
+++ /sys/src/cmd/exportfs/exportfs.c	Sun Jun 21 00:00:00 2026
@@ -7,6 +7,7 @@
  */
 #include <u.h>
 #include <libc.h>
+#include <bio.h>
 #include <auth.h>
 #include <fcall.h>
 #include <libsec.h>
@@ -57,6 +58,7 @@
 int	encproto = Encnone;
 char	*tlscert = "/sys/lib/tls/cert.pem";
 int	readonly;
+int	localonly;
 
 static void	mksecret(char *, uchar *);
 static int localread9pmsg(int, void *, uint, ulong *);
@@ -70,7 +72,7 @@
 void
 usage(void)
 {
-	fprint(2, "usage: %s [-adnsR] [-f dbgfile] [-m msize] [-r root] "
+	fprint(2, "usage: %s [-adnsLR] [-f dbgfile] [-m msize] [-r root] "
 		"[-S srvfile] [-e 'crypt hash'] [-P exclusion-file] "
 		"[-A announce-string] [-B address]\n", argv0);
 	fatal("usage");
@@ -112,6 +114,31 @@
 	return efd;
 }
 
+/*
+ * report whether u is a user of the local file server, so a key in
+ * the auth domain alone does not grant a whole-namespace export
+ */
+int
+localuser(char *u)
+{
+	Biobuf *b;
+	char *l, *f[4];
+	int ok;
+
+	if((b = Bopen("/adm/users", OREAD)) == nil)
+		return 0;	/* fail closed */
+	ok = 0;
+	while((l = Brdline(b, '\n')) != nil){
+		l[Blinelen(b)-1] = '\0';
+		if(getfields(l, f, nelem(f), 0, ":") >= 2 && strcmp(f[1], u) == 0){
+			ok = 1;
+			break;
+		}
+	}
+	Bterm(b);
+	return ok;
+}
+
 void
 main(int argc, char **argv)
 {
@@ -156,6 +183,9 @@
 	case 'n':
 		nonone = 0;
 		break;
+	case 'L':
+		localonly = 1;
+		break;
 	case 'r':
 		srv = EARGF(usage());
 		break;
@@ -203,6 +233,8 @@
 			fatal("auth_proxy: %r");
 		if(nonone && strcmp(ai->cuid, "none") == 0)
 			fatal("exportfs by none disallowed");
+		if(localonly && !localuser(ai->cuid))
+			fatal("%s: not a local user", ai->cuid);
 		if(auth_chuid(ai, nsfile) < 0)
 			fatal("auth_chuid: %r");
 		putenv("service", "exportfs");
--- /n/sources/plan9/sys/man/4/exportfs	Sat Aug  3 10:50:02 2013
+++ /sys/man/4/exportfs	Sun Jun 21 00:00:00 2026
@@ -129,6 +129,12 @@
 Disallow mounts by user
 .BR none .
 .TP
+.B -L
+Refuse any authenticated user not listed in the local file server's
+.B /adm/users
+file, so that a key in the authentication domain alone does not grant
+access.
+.TP
 .B -P \fIpatternfile
 Restrict the set of exported files.
 .I Patternfile