|
1 | 1 | [](){#ref-guides-storage} |
2 | 2 | # Storage |
3 | 3 |
|
| 4 | +[](){#ref-guides-storage-sharing} |
| 5 | +## Sharing files and data |
| 6 | + |
| 7 | +Newly created user folders are not accessible by other groups or users on CSCS systems. |
| 8 | +Linux [Access Control Lists](https://www.redhat.com/en/blog/linux-access-control-lists) (ACLs) let you grant access to one or more groups or users. |
| 9 | + |
| 10 | +In traditional POSIX, access permissions are granted to `user/group/other` in mode `read`/`write`/`execute`. |
| 11 | +The permissions can be checked with the `-l` option of the command `ls`. |
| 12 | +For instance, if `user1` owns the folder `test`, the output would be the following: |
| 13 | + |
| 14 | +```console title="Checking posix permissions with ls" |
| 15 | +$ ls -lahd test/ |
| 16 | +drwxr-xr-x 2 user1 csstaff 4.0K Feb 23 13:46 test/ |
| 17 | +``` |
| 18 | + |
| 19 | +ACLs are an extension of these permissions to give one or more users or groups access to your data. |
| 20 | +The ACLs of the same `test` folder of `user1` can be shown with the command `getfacl`: |
| 21 | + |
| 22 | +```console title="Checking permissions with getfacl" |
| 23 | +$ getfacl test |
| 24 | +# file: test |
| 25 | +# owner: user1 |
| 26 | +# group: csstaff |
| 27 | +user::rwx |
| 28 | +group::r-x |
| 29 | +other::r-x |
| 30 | +``` |
| 31 | + |
| 32 | +The command `setfacl` is used to change ACLs for a file or directory. |
| 33 | + |
| 34 | +To add users or groups to read/write/execute on a selected file or folder, use the `-M,--modify-file` or `-m,--modify` flags to modify the ACL of a file or directory. |
| 35 | + |
| 36 | +!!! example "give user2 read+write access to test" |
| 37 | + Where `test` is owned by `user1`. |
| 38 | + ```console |
| 39 | + $ setfacl -m user:user2:rw test/ |
| 40 | + |
| 41 | + $ getfacl test/ |
| 42 | + # file: test |
| 43 | + # owner: user1 |
| 44 | + # group: csstaff |
| 45 | + user::rwx |
| 46 | + user:user2:rw |
| 47 | + group::r-x |
| 48 | + mask::rwx |
| 49 | + other::r-x |
| 50 | + ``` |
| 51 | + |
| 52 | +The `-X,--remove-file` and `-x,--remove` options will remove ACL entries. |
| 53 | + |
| 54 | +!!! example "remove user2 access to test" |
| 55 | + This reverts the access that was granted in the previous example. |
| 56 | + ```console |
| 57 | + $ setfacl -x user:user2 test/ |
| 58 | + |
| 59 | + $ getfacl test/ |
| 60 | + # file: test |
| 61 | + # owner: user1 |
| 62 | + # group: csstaff |
| 63 | + user::rwx |
| 64 | + group::r-x |
| 65 | + mask::rwx |
| 66 | + other::r-x |
| 67 | + ``` |
| 68 | + |
| 69 | +Access rights can also be granted recursively to a folder and its children (if they exist) using the option `-R,--recursive`. |
| 70 | + |
| 71 | +!!! note |
| 72 | + This applies only to existing files - files added after this call won't inherit the permissions. |
| 73 | + |
| 74 | +!!! example "recursively grant user2 access to test and its contents" |
| 75 | + ```console |
| 76 | + $ setfacl -Rm user:user2 test |
| 77 | + |
| 78 | + $ getfacl test/subdir |
| 79 | + # file: test/subdir |
| 80 | + # owner: user1 |
| 81 | + # group: csstaff |
| 82 | + user::rwx |
| 83 | + user:user2:rwx |
| 84 | + group::--- |
| 85 | + group:csstaff:r-x |
| 86 | + mask::rwx |
| 87 | + other::--- |
| 88 | + ``` |
| 89 | + |
| 90 | +To set up a default so all newly created folders and dirs inside or your desired path will inherit the permissions, use the `-d,--default` option. |
| 91 | + |
| 92 | +!!! example "recursively grant user2 access to test and its contents" |
| 93 | + `user2` will have access to files created inside `test` after this call: |
| 94 | + |
| 95 | + ```console |
| 96 | + $ setfacl -dm user:user2:rw test/ |
| 97 | + |
| 98 | + $ getfacl test |
| 99 | + # file: test |
| 100 | + # owner: user1 |
| 101 | + # group: csstaff |
| 102 | + user::rwx |
| 103 | + group::r-x |
| 104 | + mask::rwx |
| 105 | + other::r-x |
| 106 | + default:user::rwx |
| 107 | + default:user:user2:rw |
| 108 | + default:group::r-x |
| 109 | + default:mask::rwx |
| 110 | + default:other::r-x |
| 111 | + ``` |
| 112 | + |
| 113 | +!!! info |
| 114 | + For more information read the setfacl man page: `man setfacl`. |
| 115 | + |
4 | 116 | ## Many small files vs. HPC File Systems |
5 | 117 |
|
6 | 118 | Workloads that read or create many small files are not well-suited to parallel file systems, which are designed for parallel and distributed I/O. |
|
0 commit comments