easybuild-framework icon indicating copy to clipboard operation
easybuild-framework copied to clipboard

Group writable and special groups

Open damianam opened this issue 8 years ago • 4 comments

I'd argue that when using special groups for installing software, EB shouldn't make the files group writable unless explicitly forced. Example:

-You have a group of people installing software. They belong to the "sw" group. -You want to allow this group to overwrite each other installations, to enable collaboration, so by default you enable the group writable option. -You have software that just specific users can access. -To do that, you install software using, for instance, the "namd" group.

You have now a set of users, belonging to the "namd" group, that can overwrite the installation done by your software team. Not something you want.

damianam avatar Sep 14 '17 14:09 damianam

We had the same problem with MATLAB. This feature would be certainly useful.

vanzod avatar Sep 14 '17 18:09 vanzod

--group-writable-installdir is disabled by default, you must have EasyBuild configured to enable it?

In that case, you are effectively telling EasyBuild to make the install dir group writable. If you don't want that, you should use --disable-group-writable-installdir.

I do understand this is easy to overlook though... How can we improve this?

Hard disable --group-writable-installdir when the group easyconfig parameter is set? That doesn't seem right to me...

Maybe we can print a clear warning?

boegel avatar Nov 01 '17 13:11 boegel

Somehow this got forgotten for 6 years :-D. We stumble on this issue again. Also with MATLAB. No, group writing is disabled group-writable-installdir (D) = False. Naïvely it still looks to me like using group = 'XXX' sets group-writable-installdir as True

damianam avatar Aug 23 '23 17:08 damianam

--group doesn't change permissions for the group. So you can use either --read-only-installdir or --umask to make the directories less writeable

Flamefire avatar May 08 '24 12:05 Flamefire