GPFS: Administration and Programming Reference - IRA Home

Each GPFS file or directory has an access ACL that determines its access privileges. These ACLs control
who is allowed to read or write at the file or directory level, as well as who is allowed to change the ACL
itself.
In addition to an access ACL, a directory may also have a default ACL. If present, the default ACL is used
as a base for the access ACL of every object created in that directory. This allows a user to protect all files
in a directory without explicitly setting an ACL for each one.
When a new object is created, and the parent directory has a default ACL, the entries of the default ACL
are copied to the new object’s access ACL. After that, the base permissions for user, mask (or group if
mask is not defined), and other, are changed to their intersection with the corresponding permissions from
the mode parameter in the function that creates the object.
If the new object is a directory, its default ACL is set to the default ACL of the parent directory. If the parent
directory does not have a default ACL, the initial access ACL of newly created objects consists only of the
three required entries (user, group, other). The values of these entries are based on the mode parameter
in the function that creates the object and the umask currently in effect for the process.
Administrative tasks associated with traditional GPFS ACLs are:
1. “Setting traditional GPFS access control lists”
2. “Displaying traditional GPFS access control lists” on page 47
3. “Changing traditional GPFS access control lists” on page 48
4. “Deleting traditional GPFS access control lists” on page 48
Setting traditional GPFS access control lists
Use the mmputacl command to set the access ACL of a file or subdirectory, or the default ACL of a
directory. For example, to set the ACL for a file named project2.history, we can create a file named
project2.acl that contains this:
user::rwxc
group::rwx-
other::--x-
mask::rwxc
user:alpha:r-xc
group:audit:rw--
group:system:rwx-
In the project2.acl file above,
v The first three lines are the required ACL entries setting permissions for the file’s owner, the owner’s
group, and for processes that are not covered by any other ACL entry.
v The last three lines contain named entries for specific users and groups.
v Because the ACL contains named entries for specific users and groups, the fourth line contains the
required mask entry, which is applied to all named entries (entries other than the user and other).
Once you are satisfied that the correct permissions are set in the ACL file, you can apply them to the
target file with the mmputacl command. For example, to set permissions contained in the file project2.acl
for the file project2.history, enter:
mmputacl -i project2.acl project2.history
To confirm the changes, enter:
mmgetacl project2.history
The information sent to standard output is similar to:
46 GPFS: Administration and Programming Reference