E3SM-Project / E3SM-Project/simboard
[DevOps]: Implement shared directory and unix group for multi-user simboard operations
- Dominant language
- Python
- Stars
- 1
- Forks
- 2
- Avg merge
- 25m
- Merged PRs (30d)
- 14
Description
### Task Details
Implement a shared "simboard" directory, and unix group, representing a common location for simboard repository and work directory that can persist across personnel changes. The group has no special privileges, and once the group is established, sys admins (root) are only needed to add or remove this group membership designation to selected accounts. Files within can be made group-writable or executable without being more generally accessible to non-member manipulation.
### Steps to Complete
Obtain sys admin cooperation in establishing the unix group "simboard"
Have an admin add this group to selected user accounts, making them members.
Thereafter, any member can "chgrp simboard"[*] a file or directory to make it accessible while restricted to only other simboard members.. For instance, we expect to make a directory `/lcrc/group/e3sm2/simboard` that will be "simboard" readable, writeable and executable, as a stable location of simboard operations.
[*] may not always be true. See Additional Notes.
### Additional Notes
I asked LivChat:
```
If (user-level) chgrp is not available, and a user belongs to several groups, a file they create will gain only their primary group ownership. To force the more restricted "simboard" group ownership, what steps must be taken that would not incur a (root) sys-admin be continually involved?
```
The Response:
```
Use a setgid directory owned by simboard. Then files and directories created within it inherit simboard as their group, regardless of the creator’s primary group.
sudo mkdir -p /path/to/simboard
sudo chown root:simboard /path/to/simboard
sudo chmod 2770 /path/to/simboard
The 2 in 2770 enables the setgid bit. Add users once:
sudo usermod -aG simboard alice
sudo usermod -aG simboard bob
After users start a new login session, files created there inherit the group:
/path/to/simboard/file group: simboard
For consistent group-readable and group-writable permissions, configure default ACLs if supported:
sudo setfacl -m g:simboard:rwx /path/to/simboard
sudo setfacl -d -m g:simboard:rwx /path/to/simboard
Users must also ensure their umask does not remove the desired group permissions. A setgid directory is normally sufficient, and no continuing administrator involvement is required.
```
The important point, "no continuing administrator involvement is required."
Contributor guide
Research direction
No repository files or tests are named. Start by confirming the sys-admin process, target path (/lcrc/group/e3sm2/simboard), group membership, and required permissions; done means the simboard group and shared setgid directory exist and selected users can use it without continuing root involvement.
Written by the indexing model from the issue text.
Assessment
- Domain
- infrastructure, operating-systems
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100