Sharing Data on HPC

Introduction

To share files on the cluster with other users, we recommend using file access control lists (FACL) for a user to share access to their data with others.  FACL mechanism allows a fine-grained control access to any files by any users or groups of users. We discourage users from setting '777' permissions with chmod, because this can lead to data loss (by a malicious user or unintentionally, by accident). Linux commands getfacl and setfacl are used to view and set access. 

ACL mechanism, just like regular Linux POSIX, allows three different levels of access control:

• Read (r) - the permission to see the contents of a file

• Write (w) - the permission to edit a file

• eXecute (X) - the permission to call a file or run it (in this case we use X instead of x because the X permission uses inherited executable permissions and not all files need execution)

This level of access can be granted to 

• user (owner of the file)

• group (owner group)

• other (everyone else)

ACL allows to grant the same type access without modifying file ownership and without changing POSIX permissions. 

Viewing ACL

Use getfacl to retrieve access permissions for a file. 

The example above illustrates that in most cases ACL looks just like the chmod-based permissions: owner of the file has read and write permission, members of the group and everyone else have no permissions at all.

Setting ACL

Modify access permissions

Use setfacl:

Important: Give Access to Parent Directories in the Path

Remove All ACL Entries

Check ACLs

You can see with 'ls -l' if a file has extended permissions set with setfacl: the '+' in the last column of the permissions field indicates that this file has detailed access permissions via ACLs:

Flags

Please read 'man setfacl' for possible flags. For example:

• '-m' - modify

• '-x' - remove

• '-R' - recursive (apply ACL to all content inside a directory)

• '-d' - default (set given settings as default - useful for a directory - all the new content inside in the future will have given ACL)

Examples

File ACL Example

Set read, write, and execute (rwX) permissions for user johnny to file named abc:

NOTE: We recommend for the permissions using a capital 'X' as using a lowercase 'x' will make all files executable, so we reommcned this:

Check permissions:

Change permissions for user johnny:

Check permissions:

Directory ACL Example

Let's say alice123 wants to share directory /scratch/alice123/shared/researchGroup/group1 with user bob123

Note: user bob123 will be able to see content of the following directories

• /scratch/alise123/

• /scratch/alise123/shared

• /scratch/alise123/shared/researchGroup/

• /scratch/alise123/shared/researchGroup/group1