Enhanced Pnfs Security
With pnfs version 3.1.10, installed Nov 7 2002, we are able to
disallow the remove/move operation of directory contents.
Once a directory got this property, no nfs command, independent
of the client machine and the issuer, is able to remove or move
an object within this directory. The action of enabling and disabling
of the property can only be done on the database server (resp. nfs server)
itself.
The following details have to be considered :
- The property of a directory to dis/enable remove/move operations
is only valid for exactly this directory. Subdirectories
are not affected if they exist at the point in time,
the property of the parent is set/changed.
- For convenience, a newly created directory inherits the
properties of its parent directory. From that point on,
they are independent again. So, changing the
property of the parent doesn't change the property of the child.
- No other nfs operations are affected by the remove/move directory properties.
create/chmod/chown etc. are still allowed.
Patrick Fuhrmann (patrick.fuhrmann@desy.de) $Id: pnfsDirAttr.html,v 1.2 2002-11-12 11:42:24 cvs Exp $