File access control in TSD

About file permissions

Warning: do not attempt to set access restrictions on files and/or folders on network storage from virtual Windows machines. Instead, use the procedure described below.

Groups

Access control is based on groups.

• A group is a collection of project members who, for example, should have access to a folder.
• Each group has a moderator group. Members of the moderator group can add and remove members in the group they moderate.
• A folder or file can only belong to one group. We recommend minimizing the number of groups.

Types of permissions

A group can have these permissions on a folder:

• Read permissions - r
  • Gives access to open and read data files.
• Write permissions - w
  • Gives access to modify, delete and create new data files.
• Execute permissions - x
  • Gives access to run programs located in the folder.

These can be combined in different ways. For example, a group can have all permissions on a folder (rwx), or read-only permissions (r).

Limitations and important notes

• By default, the group containing all project members (pXX-member-group) has full access (rwx) to the entire project area (data/durable).
• It is not possible to grant access to subfolders without also granting access to the folders above. Therefore, for example, the folder data/durable must always be available to all project members.
• Users must log out and back in completely to get updated group membership.
  • See the guide on how to log out completely

Note: A file that is moved from a folder that everyone has access to (e.g. data/durable) to an access-controlled folder within the same file system will not inherit the permissions of the folder it is moved to. Instead, the file should always be copied to the access-controlled folder. The copy inherits the permissions of the access-controlled folder.

Examples of access control

When you send us a request for access control, you must specify which folders it concerns, and which groups and permissions you want us to set.

Two student groups

You have a group of master’s students and a group of PhD candidates. You want:

• the master’s students to have full access to student_data
• the PhD candidates to have full access to phd_data
• the project administrators to:
  • have full access to both folders
  • be able to add/remove members in the student and PhD groups (be moderators)

Suggested folders

• /tsd/pXX/data/durable/student_data
• /tsd/pXX/data/durable/phd_data

Suggested groups

• pXX-student-group – master’s students
• pXX-phd-group – PhD candidates

Suggested permissions

• pXX-student-group has rwx on /tsd/pXX/data/durable/student_data
• pXX-phd-group has rwx on /tsd/pXX/data/durable/phd_data
• pXX-admin-group has rwx on both student_data and phd_data

Suggested moderator

• pXX-admin-group is moderator for both pXX-student-group and pXX-phd-group

Students and supervisors

You have a group of students, a group of supervisors and a group of staff members. You want:

• the master’s students to have full access to the folder stud1
• the supervisors to have read access, but not write access, to the folder stud1
• the staff members to have full access to the folder stud1
• the project administrators and staff members to:
  • have full access to the folder
  • be able to add/remove members in the student group (be moderators)

Suggested folders

• /tsd/pXX/data/durable/students/stud1

Suggested groups

• pXX-stud1-group - master’s students
• pXX-supervisor-group - supervisors
• pXX-staff-group - staff members

Suggested permissions

• pXX-student-group has rwx on /tsd/pXX/data/durable/students/stud1
• pXX-supervisor-group has r on /tsd/pXX/data/durable/students/stud1
• pXX-staff-group has rwx on /tsd/pXX/data/durable/students/stud1

Suggested moderator

• pXX-staff-group is moderator for pXX-stud1-group and pXX-supervisor-group
• pXX-admin-group is moderator for pXX-staff-group

The folder students becomes available to everyone in the project, while the folder stud1 is access restricted. All folders in stud1 are therefore also restricted.

Working group for analysis

You have a smaller working group that will work on a specific analysis (e.g. a master’s thesis or sub-study), and you want to collect all the work in one project folder.

Suggested folders

• /tsd/pXX/data/durable/substudy1

Suggested groups

• pXX-substudy1-group – members of this working group

Suggested permissions

• pXX-substudy1-group has rwx on /tsd/pXX/data/durable/substudy1
• pXX-admin-group has rwx on /tsd/pXX/data/durable/substudy1

Suggested moderator

• pXX-admin-group is moderator for pXX-substudy1-group

Request access control

You must contact us to set up the access control. Only the administrator can do this.

• Go to the form to request access control in TSD