International Business Machines Corporation

Rodney Carlton Burnett

William Boyd Brown

Duen-wen Hsiao

Gerald Francis McBrearty

Jonathan Mark Haswell

Timothy Simon Bartley

Michael Andrew Powell

Tewari Renu

Ravi Shankar

Joefon Jann

David W Sheffield

Ramanjaneya Sarma Burugula

Niteesh Kumar Dubey

Paul David Mazzurana

Wu Zheng

Jean Elvira Pehkonen

System, method and computer program product for supporting a plurality of Access Control List types for a file system in an operating system in a data processing system. An Access Control List supporting system for managing access to a file system in a data processing system has at least one file system in an operating system of the data processing system, and an Access Control List management framework in the operating system and external to the at least one file system for managing access to the at least one file system. The Access Control List supporting system of the invention removes ACL management and access check-related functions from the at least one file system to an external Access Control List management framework, thus enabling an operating system to support a plurality of Access Control List types using the same Access Control List management framework and enabling new Access Control List types to be added to the operating system dynamically while the operating system is running.

System and method for supporting a plurality of access control list types for a file system in an operating system

A method for transparently navigating through exported file system namespaces on a server using a single mount. When an exported file system is mounted onto a client, the client creates a file system ID structure for the exported file system, wherein the file system ID structure is populated with unique properties of the exported file system, and wherein the unique properties include a file system ID. The client also creates an internal virtual file system structure for the exported file system ID structure, wherein the internal virtual file system structure includes a virtual file system ID. Once the file system and virtual file system structures are created, the client links the file system objects created within the mount to the file system ID structure until a user moves from one exported file system to a second exported file system and a new file system ID is detected.

Seamless remote traversal of multiple NFSv4 exported file systems

A file system boundary emulation system emulates a virtual boundary of a filesystem within an existing file system for data management at a fileset granularity, within the framework of a wide area filesystem federation. The system dynamically assigns a fileset ID to the file that belongs to that fileset. The system comprises a fileset defined by the virtual boundary of the file. The virtual boundary is less than and contained within the file system. The fileset identifies the file via the file ID and the fileset ID. The system maps the file ID to the fileset ID. The filesets are dynamically created and removed based on administrative instructions. Filesets are used for fine grained data management and namespace control in a filesystem federation.

System for emulating a virtual boundary of a file system for data management at a fileset granularity

An illustrative embodiment provides a computer-implemented method for target routing by initiator, using Internet small computer system interface. The computer-implemented method obtains a logical unit number configuration, containing a set of logical unit numbers, determines whether an initiator Internet protocol address, associated with a requester, has a mapping to a logical unit number in the set of logical unit numbers. The computer implemented method further sets a path for an input output/request from the requester to a backing file, according to the mapping, and returns success to the requester.

Target routing by initiator

The illustrative embodiments described herein provide a computer implemented method, apparatus, and computer program product for managing memory in a shared environment. Upon receiving a file open event associated with a file, a tag value is generated based on the attributes of the file. Upon receiving a file read or write event associated with the file, a memory object is created to hold data associated with the file. The tag value is associated with the memory object. The tag value and the associated memory object are provided to a virtual hosting platform layer as hints to the underlying page coalescing mechanisms.

Method and apparatus for improving memory coalescing in a virtualized hardware environment

A method, a system and a computer program product for mapping a client's request to perform boot and/or dump operations to a set of backing files which enable boot and dump operations in a data processing system. A Target Routing Driver (TRD) utility creates multiple Network Installation Management (NIM) objects and/or Network Dump Management (NDM) objects including (1) an Internet Small Computer Systems Interface (iSCSI) boot station and (2) an iSCSI dump collection point. The boot station exports a single iSCSI software (S/W) target from which a set of Diskless Servers obtain a boot image which enables a boot operation. The dump collection point exports a single iSCSI S/W target which is used by Diskless Servers as a dump location. The TRD utility uses the single target (exported from a particular NDM object type) to utilize the minimal resource allocation which allows listening on a single connection. The TRD utility enables block range mapping of the request to the backing files on a remote/separate storage device for the associated Diskless Server.

Internet small computer systems interface (iSCSI) software target boot and dump routing driver

A computer implemented method, data processing system, and computer program product for maintaining state consistency among multiple state-driven file system entities when the file system entities become disconnected. Responsive to a distributed file system server being disconnected from a distributed file system client, a monitor is registered with the consistency management framework (CMF) for a file system. When the CMF detects access to a file in the file system, the CMF notifies the monitor of the access to the file, and the monitor stores information about state of the file. When the distributed file system server is reconnected to the distributed file system client, information about state of the file stored in the monitor is provided to the distributed file system client.

Method for maintaining state consistency among multiple state-driven file system entities when entities become disconnected

A method, system, and computer-usable medium for implementing a file directory in a server. An application including a buffer for retrieving and storing at least one entry is interfaced with the file directory. Utilizing a determined average filename length, an estimate of a number of entries among the collection of entries that can be stored by the buffer is determined. In response to determining at least one attribute data field has been requested, the number of entries that can be stored by the buffer is recalculated. Recalculating the number of entries includes determining an amount of data required for storing the collection of filenames, a collection of fixed-length attribute data fields, and a collection of variable-length attribute data fields. The recalculated number of entries is then requested from the file directory, and the buffer is loaded, with the recalculated number of entries.

Implementing adaptive buffer management on network fetches of directory contents and object attributes

A method, apparatus, and computer usable code to manage data requests in a file system. A file access request is received from a client data processing system for a file access operation on a file in the file system. A determination is made as to whether the entry is present for the client in response to receiving the file access request. An open request is sent to the file system to open the file in response to the entry being absent. A cookie is received from the file system in response to sending the open request. An entry is created for the client and file with the cookie, and the file access request is sent to the file system using the cookie. Subsequent file access requests are sent to the file system using the same cookie in response to the entry being present.

Method and apparatus for managing multi-stream input/output requests in a network file server

The present invention is an algorithm that manages the ability of a user or software program to access certain protected file resources. This invention describes a method for file system security through techniques that control access to the file system resources using externally stored attributes. This invention accomplishes the described objectives in file system security by creating an external database containing auxiliary attributes for objects in the file system. During a file access attempt, an identifier of this file will be matched against a set of protected files in a security database. If that file is not in the database, there is not protection on the file and requester will be allowed to access the file. If a match does show that the file is protected there will be a determination as to whether the requester will be allowed access to the file. The basis for this access determination will be a set security rules defined in the external security attribute. This invention incorporates techniques and algorithms for attribute attachment, storage and organization of the associations to these attributes, and subsequent recognition of attached attributes. In this approach, the attributes would define authorization policy for controlling access to objects in the file system.

Method for file system security by controlling access to the file system resources using externally stored attributes

System and method for emulating a virtual boundary of a file system for data management at a fileset granularity

In this invention, when security policy is attached to a file, a device protection manager is given the protected file's name. If the file is a special device file, then the device manager records the device specification in a device database. When a device access occurs, the device specification is extracted from the special device file used in the access. This extracted device specification is then used to search the device database. If a matching device specification is found in the database and the accessed device file has the same name as the protected resource, then authorization policy rules on that resource determine the access. If the match is a different device file name from the protected file name for the same device, then the search continues until the exact accessed device is found or until all device specification matches are found. In the absence of an exact device file match, all the matching device files are presented to the external security manager for authorization checking and the most restrictive outcome prevails.

Method for adding and enforcing enhanced authorization policy on devices in computer operation systems

The techniques of the present invention involve constructing and caching a chain of FIDs that represent the directory path to a system resource. Typically a lookupname( ) service returns a handle to the object and a handle to the object's owning directory. The owning directory handle can then be used to obtain a file identifier (FID) for the owning directory. This FID constitutes the first FID in the chain and will also act as the lookup key in the cache. The process next finds the directory's parent. A FID is obtained with the parent handle. This FID is added to the chain. The process repeats until the root of the system's file tree is reached. This result is a chain or array of FIDs representing the full path name of the directory containing the accessed object. The chain begins with the directory FID closest to the accessed object and ends with the FID representing the root of the file tree. Once constructed, the FID chain which forms a binary representation of a directory path name is placed in a cache. The cached chain remains valid unless a rename operation occurs on any FID components in the chain. On an object access, the process obtains a FID for the object's owning directory. This FID which represents the first FID in a FID chain is then used to search the FID chain cache. If a match is found, then the cached FID represents the path name for the access object. With this found chain, the expense of constructing the additional component FIDs for the object's owning oath is avoided.

Method for constructing and caching a chain of file identifiers and enabling inheritance of resource properties in file systems

The method of the invention assumes there is a security manager and mechanism present for defining, attaching, and evaluating external authorization policy to file resources based on the file's path name. In this invention, protected symbolic links and the resources that the link points to are stored in a protected object database. When a system access attempt occurs, the file attribute is extracted from the file used in the access. The file attribute is then used to search the protected object database. If a matching system resource is found, and that resource is protected but does not have independent security policy on it, then the resource will have the security policy of a symbolic link that points to it. In this case, the security of each protected symbolic link pointing to the system resource has to grant access in order for allowance of the access attempt. This approach insures that the most restrictive outcome prevails.

Growing community of inventors

Austin, TX, United States of America

Rodney Carlton Burnett