nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Branch security when using tsgroups & alternate store

RonaldV

Hi,

- TS650 Sp3 @ Sol8
- branch/workarea-security: on
- branch/workarea_default_perm: 770

I can't seem to restrict access to a branch in a non-default store when using tsgroups. ls -l will always report 'drwxrwxrwx'; the command 'chmod 770' wil NOT give an error but nevertheless has no effect.

Strangely enough it works just fine in ANY of these scenarios:
- when using the 'default'-store:

[HTML]drwxrwxr-x 6 iwglobal 512 Aug 13 12:03 test/ [/HTML]

- when using an os-group:

[HTML]drwxrwx--- 5 512 Aug 18 11:43 test/ [/HTML]

Has anybody ever seen this before?
Has anybody seen this working properly?

Cheers, Ronald

Find more posts tagged with

Comments

Frederik

seems to work fine for me: TS 6.5 SP2 on Sol 9 (branch_default_perm=750)

created as root:

iwmkbr /test0001/main test_tsgroups 'test' INITIAL root tsgrp01

ls -l as root:

drwxr-x--- 5 root iwglobal 512 Aug 19 10:53 test_tsgroups/

ls -l as a member of tsgroup tsgrp01

drwxr-xr-x 5 root iwglobal 512 Aug 19 10:53 test_tsgroups/

ls -l as a non-member of tsgrp01

drwxrwx--- 5 root iwglobal 512 Aug 19 10:53 test_tsgroups

Remember that TS groups work by mapping the permissions you should have through your group, onto the "world/other" permissions of NFS. That's why the world permissions are modified per user that makes the access.

PS: that's also why it's critical that, if you use TS groups, you must use /.iwmnt and not /iwmnt (because the cached access could give your cached permissions to the next user making an access - which could elevate his permissions, or block him out of a file he should be able to access)

PS2: an detailed write-up about TS group & Unix NFS interaction here: http://devnet.interwoven.com/forums_vb/showpost.php?p=117467&postcount=6

RonaldV

Hum Frederik,

funny and unexpected. But it confirms what I've seen happening sofar.

Two more questions:

1. how would you do a chmod to change group permissions (when using ts-groups). chmod 750 or chmod 7x5?

2. how can you see what privileges another user has on a specific branch? Like when a user complains to me about not being able to access branch 'x' and I want to check all privs?

Cheers, Ronald

Frederik

1) I was playing with it this morning, and (as root) I was doing "chmod 770" and "chmod 750" with seemingly correct results. Are you having problems setting permissions?

2) nothing direct, to my knowledge.
Use logical deduction: (real) permissions on branch + (real) group of branch + user is (not) member of group => ...
Or log in with user's credentials.