<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
Security in Linux is user based. Nodes (hostname) has no role to<br>
play. If I understand you correctly, you want a user+hostname<br>
based security. Probably hostname providing a default set of<br>
permissions. I am not aware of any fs providing this. Do you have<br>
an example that would better illustrate your point.<br>
<br>
Remember that node based security does not make much sense<br>
considering the basic idea behind clustering is to allow services<br>
to be available across the cluster. As in, if a node dies, the
service<br>
is restarted on an available node. Shared disk clustered file
systems<br>
have been designed to operate in such an environment.<br>
<br>
On 02/04/2011 12:44 PM, Petr Vacek wrote:
<blockquote
cite="mid:AANLkTi=+1uPcJjybEpgB3PYOzw1vqiFnu+m+cnf62z-K@mail.gmail.com"
type="cite">Greetings,<br>
I would like to know if there is possibility to deny / obscure
access into some directory within ocfs2 for specific nodes - or
allow just specific nodes.<br>
I am using ocfs2 shared storage among Xen VM (because it's
performance is better than NFS with our hardware), but then root
of each VM has absolute access to the whole ocfs2 filesystem -
which I would like to limit this at least a little bit,<br>
I know that the root of node has access to a raw block device so
it cannot be done down to all levels, but if the mounted
filesystem would respect some limits for a local root<br>
that would be very fine for me.<br>
<br>
Is this doable and if it is easy which utility/ command would
allow that ? <br>
<br>
If not, should a simple kernel module/patch limiting access to
specific UID/GIDs for all users including root do the trick ? (I
am thinking that if such module does not exist, I can get it made
and then map node-specific directories into these uid/gids , so
they will be accessible only from a single node , if that's viable
...)<br>
<br>
Thanks for any hints or tips in advance<br>
<br>
Regards<br>
Petr Vacek<br>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
Ocfs2-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Ocfs2-users@oss.oracle.com">Ocfs2-users@oss.oracle.com</a>
<a class="moz-txt-link-freetext" href="http://oss.oracle.com/mailman/listinfo/ocfs2-users">http://oss.oracle.com/mailman/listinfo/ocfs2-users</a></pre>
</blockquote>
<br>
</body>
</html>