You work with a team. By default your VAST projects folder (/vast/projects/PENNKEY/wharton_PENNKEY, by default) is writable by all team members. Which might be fine! But if not, there are some straightforward ways to lock things down, depending on your needs. Each of the methods can be used on different folders, too.
You might need:
- folders that are “entire team”
- folders that are “named team members”
- folders that are “your eyes only”
ACLs, to the rescue!
On Betty in an SSH or Open OnDemand session (Terminal):
## LOCK YOUR PROJECT FOLDER ENTIRELY (nobody but you will be able to see anything inside ## even members of your group) $ chmod 2700 /vast/projects/PIPENNKEY/wharton_PIPENNKEY ## "PASS THRU" PROJECT FOLDER (members of your group will be able to "get to" folders inside ## but will not be able to see / list the contents of your project folder) $ chmod 2710 /vast/projects/PIPENNKEY/wharton_PIPENNKEY ## PROJECT FOLDERS INSIDE YOUR projects FOLDER $ cd /vast/projects/PIPENNKEY/wharton_PIPENNKEY ## PRIVATE "PI ONLY" PROJECT FOLDER ### CREATE: $ mkdir -m 2700 PROJECT001 ### MODIFY EXISTING: $ chmod 2700 PROJECT001 ## Recursively (-R) ADD (-a) someone (RA? Co-Author? as ReadONLY for a private project folder $ nfs4_setfacl -a A:d:USER_PENNKEY1:RX -R PROJECT001 ## Recursively (-R) ADD (-a) someone (RA? Co-Author? as ReadWRITE for a private project folder ## you could also do this on a SUB-folder, so an RA can only write to a single folder inside $ nfs4_setfacl -a A:d:USER_PENNKEY2:RWX -R PROJECT001 ## Examine Current ACL Permissions: $ nfs4_getfacl PROJECT001 # file: PROJECT001/ A:d:USER_PENNKEY1@cm.cluster:rxtncy A:d:USER_PENNKEY2@cm.cluster:rwaDxtTnNcCy A::OWNER@:rwaDxtTnNcy A:g:GROUP@: A::EVERYONE@: ## Use the Output from Examine, above, to recursively (-R) REMOVE (-x) an ACL (note ## the '@cm.cluster', different than the create commands): nfs4_setfacl -x A:d:lamona@cm.cluster:rxtncy -R PROJECT001
Other permutations exist! For example, the ability for you (faculty PI) to always be able to see everything in your projects folder, no matter how an RA / Co-Author fiddles with permissions. If you have a use-case not covered by the above, please reach out to us at research-computing@wharton.upenn.edu.