{"action":"created","issue":{"url":"https://api.github.com/repos/galaxyproject/pulsar/issues/65","labels_url":"https://api.github.com/repos/galaxyproject/pulsar/issues/65/labels{/name}","comments_url":"https://api.github.com/repos/galaxyproject/pulsar/issues/65/comments","events_url":"https://api.github.com/repos/galaxyproject/pulsar/issues/65/events","html_url":"https://github.com/galaxyproject/pulsar/issues/65","id":67424871,"number":65,"title":"Allow permission restrictions on staging/<jobid> directory?","user":{"login":"dctrud","id":4522799,"avatar_url":"https://avatars.githubusercontent.com/u/4522799?v=3","gravatar_id":"","url":"https://api.github.com/users/dctrud","html_url":"https://github.com/dctrud","followers_url":"https://api.github.com/users/dctrud/followers","following_url":"https://api.github.com/users/dctrud/following{/other_user}","gists_url":"https://api.github.com/users/dctrud/gists{/gist_id}","starred_url":"https://api.github.com/users/dctrud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dctrud/subscriptions","organizations_url":"https://api.github.com/users/dctrud/orgs","repos_url":"https://api.github.com/users/dctrud/repos","events_url":"https://api.github.com/users/dctrud/events{/privacy}","received_events_url":"https://api.github.com/users/dctrud/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-04-09T18:37:51Z","updated_at":"2015-04-13T15:06:25Z","closed_at":"2015-04-10T14:52:19Z","body":"I'm using pulsar to get around the limitation of Galaxy DRMAA as a real user, where the Galaxy datasets need to be world-readable. This is not acceptable for our user base. I have the following solution in use.... \r\n\r\n* Galaxy files dir is 660 galaxy:galaxy - so that galaxy itself can see everything, but no user on the cluster can access anyone else's dataset.\r\n\r\n* Pulsar is being used to submit external real-user DRMAA jobs, where the 'copy' file action is used so that the private galaxy files/* are staged and available to the job. Anything not private, such as genome indices is using the 'none' action as is world-readable.\r\n\r\n* Galaxy/pulsar can always access what they need, as relevant files have group ownership 'galaxy'. \r\n\r\n* The pulsar chown functionality gives neccessary real-user rights when jobs run under SLURM on the cluster.\r\n\r\n* Am running galaxy and pulsar under umask 0007 so that dataset files aren't created world-readable. This ensures they aren't world readable when copied into the pulsar job staging dir.\r\n\r\nThis seems to be working nicely. However, instead of relying on umask it would be nice if it was possible to restrict the permissions on the `staging/<jobid>` directories, which always seem to be completely open (drwxrwxrwx).\r\n\r\nI looked around, but couldn't find any configuration option, or obvious place where the perms are set for these job staging dirs.\r\n\r\nWould it be possible to allow these dirs to be created (drwxrwx---) so that access can be restricted without relying on the umask when the staged datasets were originally created by galaxy?\r\n\r\nWould be happy to work on this for a PR if I can get a pointer r.e. where the open perms on the staging dirs are set - I've looked but I'm lost.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/galaxyproject/pulsar/issues/comments/92393076","html_url":"https://github.com/galaxyproject/pulsar/issues/65#issuecomment-92393076","issue_url":"https://api.github.com/repos/galaxyproject/pulsar/issues/65","id":92393076,"user":{"login":"natefoo","id":286969,"avatar_url":"https://avatars.githubusercontent.com/u/286969?v=3","gravatar_id":"","url":"https://api.github.com/users/natefoo","html_url":"https://github.com/natefoo","followers_url":"https://api.github.com/users/natefoo/followers","following_url":"https://api.github.com/users/natefoo/following{/other_user}","gists_url":"https://api.github.com/users/natefoo/gists{/gist_id}","starred_url":"https://api.github.com/users/natefoo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/natefoo/subscriptions","organizations_url":"https://api.github.com/users/natefoo/orgs","repos_url":"https://api.github.com/users/natefoo/repos","events_url":"https://api.github.com/users/natefoo/events{/privacy}","received_events_url":"https://api.github.com/users/natefoo/received_events","type":"User","site_admin":false},"created_at":"2015-04-13T15:06:25Z","updated_at":"2015-04-13T15:06:25Z","body":"Just wanted to say it's awesome you've got pulsar working this way, to work around the limitations in Galaxy's internal real user handling.\r\n\r\nIs your underlying filesystem capable of extended ACLs? It might be reasonable for real-user job handling to just modify ACLs to avoid expensive copying. But this does mean potentially maintaining a bunch of fs-specific plugins."}}