IBM General Parallel File System for AIX: Administration and Programming Reference

Managing GPFS access control lists

Access control protects directories and files by providing a means of specifying who should be granted access. GPFS access control lists (ACLs) extend the base permissions, or traditional file access modes, of read (r), write (w), and execute (x) beyond the three categories of file owner, file group, and other users, to allow the definition of additional users and user groups. In this way, an ACL can be created that might look like this:
#owner:jesmith
#group:team_A
user::rwx
group::rwx
other::--x
mask::rwx
user:alpha:r-x
group:audit:r-x
group:system:rwx

In this ACL:

• The first two lines are comments showing the file's owner, jesmith, and group name, team_A
• The next three lines contain the base permissions for the file. These three entries are the minimum necessary for a GPFS ACL:
  1. The permissions set for the file owner (user), jesmith
  2. The permissions set for the owner's group, team_A
  3. The permissions set for other groups or users outside the owner's group and not belonging to any named entry
• The next line, with an entry type of mask, contains the maximum permissions allowed for any entries other than the owner (the user entry) and those covered by other in the ACL.
• The last 3 lines contain additional entries for specific users and groups. These permissions are limited by those specified in the mask entry, but you may specify any number of additional entries up to a memory page (approximately 4K) in size.

GPFS ACLs are fully compatible with the base operating system permission set. Any change to the base permissions, using the chmod command, for example, modifies the corresponding GPFS ACL as well. Similarly, any change to the GPFS ACL is reflected in the output of commands such as ls -l.

Each GPFS file or directory has an access ACL that determines its access privileges. These ACLs control who is allowed to read or write at the file or directory level.

In addition to an access ACL, a directory may also have a default ACL, which is assigned as an access ACL to every file created in that directory. This allows a user to protect all files in a directory without explicitly setting an ACL for each one. When a new subdirectory is created, both its access ACL and its default ACL are set to the default ACL of its parent directory.

If the directory does not have a default ACL, the initial access ACL of newly created objects consists only of the three required entries. The values of these entries are based on the mode parameter on the function that creates the object and the umask currently in effect for the process.

Administrative tasks are associated with GPFS ACLs are:

1. Setting GPFS access control lists
2. Displaying GPFS access control lists
3. Changing GPFS access control lists
4. Deleting GPFS access control lists