Enable an override for default permissions on new directories

[marianne013]

Hi,

We have a site that has difficulties with the default permissions (0755) that DIRAC sets on new directories.
We think what happens is that a user using j.setOutputData([FILE], outputSE=STORAGE, outputPath=PATH)
and DIRAC creates the whole tree which is now write only for the user only and read for everyone else, preventing other members of the same group to create their own subdirectories under the top level directory.
Looking at the code

DIRAC/src/DIRAC/Resources/Storage/GFAL2_StorageBase.py

Line 894 in 20480d6

self.ctx.mkdir_rec(path, 0o755)

these permissions seem to be hardcoded without a possibility for an override.
Is there a way to make this configurable on an SE by SE basis ?
Tagging @afortiorama as the admin seeing the problem.

Cheers,
Daniela

[chaen]

we could add an option, but I am really not sure it would help as each tuple (protocol, storage implementation) has it's very own way (if not random....) to interpret the posix permission. What we observe in practice is that 0o755 is hardly ever respected...

But sure, we could take that option from the SE, but I guess that would be a per protocol section option

[sfayer]

I was looking at implementing this, but it looks like the behaviour has changed between 7.3 and 8.0. I must have used an old UI install for the initial testing.

The old 7.3 behaviour was to create the directories manually (which in turned used the built-in 0755 default):

DIRAC/src/DIRAC/Resources/Storage/GFAL2_StorageBase.py

Line 400 in 0c44a0e

res = self._createSingleDirectory(dest_path)

The new 8.0 behaviour is to use the gfal2 create_parent option:

DIRAC/src/DIRAC/Resources/Storage/GFAL2_StorageBase.py

Line 364 in 20480d6

params.create_parent = True

(Where GFAL doesn't offer any way to change the permissions it uses: I think it should just have the same behaviour as gfal-copy -p; I don't know if that's to default to 0755 or just rely on the SE to set the default permissions).

@afortiorama : We upgraded to version 8.0 about a month ago, have you seen this problem on directories created since then? Would you be able to test with dirac-dms-add-file using a version 8.0 UI and see how it behaves?

Regards,
Simon

[afortiorama]

Yes it was this month.

[fstagni]

Hello, any update here?

[marianne013]

There doesn't seem to be an easy fix on the DIRAC side. The SE should probably
ensure that directories inherit the correct permissions rather than relying
on the client software. I suggest we close it for now and get back to it once we have a more concrete test case (which with my luck will pop up pretty much immediately, but we'll see).