<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body class=""><div>I'm digging into that as well. But its not granular enough. Unless I create a new group that owns the binaries and data and that is the limiting group.</div><div><br></div><div>Hmm.</div><div><br></div><div>On Mon, 2016-05-16 at 11:11 -0400, Jerald Sheets wrote:</div><blockquote type="cite"><div class="">Extended File Access?</div><div class=""><br class=""></div><div class="">getfacl</div><div class="">setfacl</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">all that?</div><div class=""><br class=""></div><div class="">GAWD I need a refresher before updating my RHCE….</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">—j</div><br class=""><div><blockquote type="cite"><div class="">On May 16, 2016, at 10:48 AM, Jim Kinney <<a href="mailto:jim.kinney@gmail.com">jim.kinney@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><p dir="ltr" class="">I'm trying to envision a process that will have some funky permissions in play and would appreciate ideas.</p><p dir="ltr" class="">Data is sensitive and stored in encrypted partition. Only users in the approved group can read in that folder.</p><p dir="ltr" class="">They need to run that data through custom code that may do temporary writes somewhere. That will need to be locked down and either encrypted or overwritten after use (or both). This is the easy part.</p><p dir="ltr" class="">I need to prevent that data from being written/copied anywhere else even if they have write permission (home dir).</p><p dir="ltr" class="">I run CentOS 7 systems so I have selinux. However, once this scales off the individual research system to the cluster, I've disabled selinux on the cluster for performance reasons. I can activate it if the encrypted folders are mounted and limit runs to specific nodes if always running.</p><p dir="ltr" class="">So I'm seeing (sort of. Not fully thought out yet) a rule that allows data read with binaries of a particular type that can only write to particular folders. Note that the final output of the data run is not sensitive but intermediate data may be. To run a process requires writing binary to specific folder. That folder forces all contents to be special type that is subject to selinux rule. </p><p dir="ltr" class="">Can't allow users to directly read the files in order to disallow 'cat file > newfile' to disallowed folder. </p><p dir="ltr" class="">Data files are (currently) video and output is ascii text so it's possible to check file types on output before allowed to copy to new folder.</p><p dir="ltr" class="">However, the input data files may be ascii for a different groups work. </p>
_______________________________________________<br class="">Ale mailing list<br class=""><a href="mailto:Ale@ale.org">Ale@ale.org</a><br class="">http://mail.ale.org/mailman/listinfo/ale<br class="">See JOBS, ANNOUNCE and SCHOOLS lists at<br class="">http://mail.ale.org/mailman/listinfo<br class=""></div></blockquote></div><br class=""></blockquote><div><span><pre>--
James P. Kinney III
Every time you stop a school, you will have to build a jail. What you
gain at one end you lose at the other. It's like feeding a dog on his
own tail. It won't fatten the dog.
- Speech 11/23/1900 Mark Twain
http://heretothereideas.blogspot.com/
</pre></span></div></body></html>