introduce whitelist capability for nfs4_setfacl

[trel]

This feature would introduce a whitelist defined via metadata on users and groups.

If a user is in the whitelist or in a group in the whitelist, they would be able to run nfs4_setfacl on the specified logical path or any collection or object 'below' it, regardless of their own permissions on that collection or object.

Use Case

Data within a double-blind study should not be visible by the curators of the system. However, in order to allow others to see the data, the curators need to be able to set permissions. This set of curators would be defined by a search in the catalog of users or groups with the following attached AVU:

a - irods::nfsrods::grant_nfs4_setfacl
v - <logical_path_prefix>
u - 

Note

If this is implemented by calling 'change permissions' as the NFSRODS proxy_admin_account, then we need to confirm whether the curator's username appears in the server (and therefore in any audit logging).

[korydraughn]

The curator's username will not show up in the iRODS log file.

Possible solutions:

• NFSRODS logs the curator who triggered this in its own log file.
• NFSRODS could use Log4j and send messages directly to rsyslog (could be pointed to a remote/central logging service).
• NFSRODS could write into a log file in the iRODS logical namespace.

[michael-conway]

SL4J is in there down to the Jargon level so this sort of thing should be possible!

…

On Wed, Sep 25, 2019 at 3:13 PM korydraughn ***@***.***> wrote: The curator's username will not show up in the iRODS log file. Possible solutions: - NFSRODS logs the curator who triggered this in its own log file. - NFSRODS could use Log4j and send messages directly to rsyslog (could be pointed to a remote/central logging service). - NFSRODS could write into a log file in the iRODS logical namespace. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#43?email_source=notifications&email_token=AAIL4LM7KHTZ7C26GY6PYG3QLOZ5ZA5CNFSM4I2DJK42YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD7TAU4A#issuecomment-535169648>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAIL4LMOL4TGIITGYR2FEMDQLOZ5ZANCNFSM4I2DJK4Q> .