8.1 Directory and File Access Authorization¶

The computing platform now applies a stricter security policy: personal directories are private by default and can be accessed only by the owner. If you need to share a directory or file for collaboration, do not open your entire home directory, and do not use broad permissions such as chmod 777. Choose the correct ACL command for the filesystem and grant access only to the required user or group.

8.1.1 Authorization Principles¶

Grant access only to the users or groups that really need it.
Share only the required directory. Use a dedicated directory such as ~/share or ~/public.
Grant only the required permissions. Prefer read-only access when write access is not needed.
Grant only the minimum traversal permission on parent directories.
Revoke access when it is no longer needed.
For sensitive data, experiment data, or unpublished results, confirm the data management requirements of your experiment group first.

8.1.2 Identify the Directory Type¶

Different filesystems use different ACL commands. Check the path before changing permissions.

Directory type	Common paths	Commands
AFS	`/afs/ihep.ac.cn/users/{a-z}/{username}`	`fs setacl`, `fs listacl`
Lustre/POSIX-like	`/home`, `/scratchfs`, `/sharefs`, `/aifs`, `/sugonfs`, `/ihepfs`, etc.	`setfacl`, `getfacl`
EOS	`/eos/juno`, `/eos/lhaaso`, etc.	`eos acl`

Warning

ACL commands for AFS, Lustre/POSIX-like directories, and EOS are different and cannot be used interchangeably. If you are not sure which filesystem you are using, run pwd and check the path first.

8.1.3 AFS Directories¶

AFS uses its own ACL mechanism. Standard chmod does not manage AFS directory access permissions. AFS permissions are set on directories. To share a file, put it in a directory with the proper ACL.

Common permissions:

Permission	Meaning
`l`	list directory contents
`r`	read file contents, usually used together with `l`
`rl`	enter and read, commonly used for read-only sharing
`write`	write access, including common read/write permissions
`all`	all permissions
`none`	remove access for the user or group

Grant access to a user:

# Allow zhangsan to read ~/public
fs setacl -dir ~/public -acl zhangsan rl

# Allow zhangsan to read and write ~/project
fs setacl -dir ~/project -acl zhangsan write

Grant access to a group:

fs setacl -dir ~/public -acl bes:members rl

View and revoke access:

fs listacl -path ~/public
fs setacl -dir ~/public -acl zhangsan none

Opening a directory to all AFS-accessible users should be treated as an exception and revoked after use:

fs setacl -dir ~/public -acl system:anyuser rl
fs setacl -dir ~/public -acl system:anyuser none

To let another user access ~/public, the user must also be able to reach that path. A safer approach is to grant only l on the parent directory and rl on the shared directory:

fs setacl -dir ~ -acl zhangsan l
fs setacl -dir ~/public -acl zhangsan rl

If you cannot access your own AFS files, your credentials may have expired. Refresh them with:

kinit username
aklog -d

8.1.4 Lustre/POSIX-like Directories¶

Directories such as /home, /scratchfs, /sharefs, /aifs, /sugonfs, and /ihepfs usually follow Linux POSIX permission rules. Use setfacl to grant fine-grained access to a specific user or group.

Grant access to a user:

# Allow zhangsan to enter and read
setfacl -m user:zhangsan:rx /home/cc/myname/share

# Allow zhangsan to read and write
setfacl -m user:zhangsan:rwx /home/cc/myname/share

Grant access to a group:

setfacl -m group:besusers:rx /home/cc/myname/share

For directories, x means the directory can be entered. Read-only sharing usually uses rx.

Apply permissions recursively to existing subdirectories and files:

setfacl -R -m user:zhangsan:rX /home/cc/myname/share

Here -R means recursive. Uppercase X adds execute permission only to directories and files that are already executable. It does not add execute permission to ordinary data files. To make new files inherit the same permission, add a default ACL:

setfacl -R -d -m user:zhangsan:rX /home/cc/myname/share

View and remove ACL entries:

getfacl /home/cc/myname/share
setfacl -x user:zhangsan /home/cc/myname/share
setfacl -b /home/cc/myname/share

A directory with ACL entries will show a + at the end of the permission bits in ls -l. setfacl -b removes all ACL entries and restores the original chmod permissions. Use it carefully.

To access /home/cc/myname/share, another user must have x permission on every parent directory in the path. You can grant only x on a parent directory, without r, so the user can pass through but cannot list other files:

setfacl -m user:zhangsan:x /home/cc/myname

Note

Only the directory owner can set ACLs on that directory. If a Lustre volume reports that user ACLs or extended attributes are not supported, contact ics@ihep.ac.cn.

8.1.5 EOS Directories¶

Directories such as /eos/juno and /eos/lhaaso use the EOS distributed filesystem. EOS ACLs are usually used for directory-level sharing. Avoid setting ACLs on a large number of individual files, because this may affect namespace management performance.

Grant access to a user:

# Allow zhangsan to enter and read
eos acl --user u:zhangsan=rx /eos/myname/share

# Allow zhangsan to read and write
eos acl --user u:zhangsan=rwx /eos/myname/share

Grant access to a group:

eos acl --user g:juno=rx /eos/myname/share

Set recursively, view, and remove ACL entries:

eos acl --user -R u:zhangsan=rx /eos/myname/share
eos acl -l /eos/myname/share
eos acl --user u:zhangsan= /eos/myname/share

Recursive ACL operations on directories with many files may take a long time. Use them carefully.

Note

When granting EOS write access to another user, also confirm that the user has available quota under the shared directory. If no quota is available, contact the directory owner or ics@ihep.ac.cn.

8.1.6 Quick Reference¶

Task	AFS	Lustre/POSIX-like	EOS
Grant read-only access to a user	`fs setacl -dir DIR -acl USER rl`	`setfacl -m user:USER:rx DIR`	`eos acl --user u:USER=rx DIR`
Grant read/write access to a user	`fs setacl -dir DIR -acl USER write`	`setfacl -m user:USER:rwx DIR`	`eos acl --user u:USER=rwx DIR`
Grant read-only access to a group	`fs setacl -dir DIR -acl GROUP rl`	`setfacl -m group:GROUP:rx DIR`	`eos acl --user g:GROUP=rx DIR`
View permissions	`fs listacl -path DIR`	`getfacl DIR`	`eos acl -l DIR`
Revoke a user's access	`fs setacl -dir DIR -acl USER none`	`setfacl -x user:USER DIR`	`eos acl --user u:USER= DIR`
Clear ACLs	Set entries to `none` one by one	`setfacl -b DIR`	Remove entries one by one

For help, contact helpdesk@ihep.ac.cn or call 88236855. For Lustre ACL enablement requests and EOS ACL problems, contact ics@ihep.ac.cn.

🤖 AI 助手