{"id":139480,"date":"2022-04-01T12:57:09","date_gmt":"2022-04-01T16:57:09","guid":{"rendered":"http:\/\/www.bu.edu\/tech\/?page_id=139480"},"modified":"2022-04-01T12:57:09","modified_gmt":"2022-04-01T16:57:09","slug":"project-disk-file-access","status":"publish","type":"page","link":"https:\/\/www.bu.edu\/tech\/support\/research\/system-usage\/using-file-system\/file-permissions\/project-disk-file-access\/","title":{"rendered":"Project and STASH Disk Space File Access"},"content":{"rendered":"

As of May 16, 2019, the default permissions for all top-level Project Disk Space directories and STASH directories on the SCC are set such that only project group members have any access to the files. This means that, regardless of how permissions are set within lower level directories, people who are not members of the project will not be able to access any of the files. For your own files\/directories, you can further limit them so that even group members have limited access, but you cannot grant people outside the project access without opting out of this policy as discussed below. For all \/restricted<\/code> directories, this has been the policy for many years and cannot be changed.<\/p>\n

The project spaces affected include:<\/p>\n

\/project\/PROJECTNAME<\/span>\/             \/restricted\/project\/PROJECTNAME<\/span>\/\r\n\/projectnb\/PROJECTNAME<\/span>\/           \/restricted\/projectnb\/PROJECTNAME<\/span>\/\r\n\/stash\/PROJECTNAME<\/span>\/               \/restricted\/stash\/PROJECTNAME<\/span>\/<\/code><\/pre>\n
Granting Access to Files to People who are not<\/b> Members of your Project<\/h2>\n
If you are the Lead Project Investigator (LPI) for a project, you can opt out of the default permissions and ask us to allow all SCC users to have limited access to your project space(s). This is allowed on the \/project<\/code>, \/projectnb<\/code>, and \/stash<\/code> spaces to give read and execute access to the world, if the lower level files\/directories\u2019 permissions also allow that. This is most commonly needed for projects that are serving primarily or partially as data storage where a large number of people need read access to the files and you do not want to have to add and remove those people from the project group. To do this, send email to help@scc.bu.edu<\/a> and indicate the top-level Project directory(-ies) you wish to have the permissions changed for.<\/p>\n
If you do this, you should be very careful about setting permissions on your files\/directories or it may be possible for any SCC user on the system to accidentally delete some of your files.  In general, you should almost never set global\/world write permissions for any directory or file.   Note that although you can set such permissions yourself (chmod 666<\/span> filename<\/span><\/code>), you can also end up with files with those permissions via many other ways.  Some of these include transferring them from another machine (such as via Globus<\/a> or SFTP), copying them from another user, or by using a command such as tar -x<\/span><\/code>.<\/p>\n
Controlling Access to Files for Project Group Members<\/h2>\n
You can use the standard Linux commands chmod<\/a><\/b> and umask<\/a><\/b> to control access to files within your directories.  Contact us<\/a> if you need help with this or need to have some unusual file access scheme set up and we may be able to help.<\/p>\n
Using the sticky bit<\/b> to Protect Files<\/h2>\n
Using the Linux sticky bit<\/a>, it is possible to create a directory<\/b> which is world writable but where only the person who writes a given file\/directory can then delete it.  An example is given below.  Note the characters highlighted in yellow.<\/p>\n
scc1%<\/span> mkdir<\/span> myrepository<\/span> \r\nscc1%<\/span> chmod<\/span> 1<\/span>777 myrepository<\/span>\r\nscc1%<\/span> ls -l<\/span> myrepository<\/span>\r\ntotal 1\r\ndrwxrwxrwt<\/span> 2 aarondf scv 512 Apr 24 14:30 myrepository\/<\/span><\/code><\/pre>\n
A user who has access to the directory containing myrepository<\/span><\/code> will be able to write files\/directories to this directory and only he\/she (and also the directory owner) will be able to delete those files\/directories.<\/p>\n
Used carefully, this feature can protect a directory that needs to have group (and world) write access from accidental deletion of files by group members (for all projects) or by everyone on the system (for those opting out of the default permissions).<\/p>\n","protected":false},"excerpt":{"rendered":"
As of May 16, 2019, the default permissions for all top-level Project Disk Space directories and STASH directories on the SCC are set such that only project group members have any access to the files. This means that, regardless of how permissions are set within lower level directories, people who are not members of the…<\/p>\n","protected":false},"author":1692,"featured_media":0,"parent":137939,"menu_order":3,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"_links":{"self":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/139480"}],"collection":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/users\/1692"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/comments?post=139480"}],"version-history":[{"count":1,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/139480\/revisions"}],"predecessor-version":[{"id":139481,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/139480\/revisions\/139481"}],"up":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/137939"}],"wp:attachment":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/media?parent=139480"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}