Methods and systems for managing permissions data

• US 20080306954A1
• Filed: 06/07/2007
• Published: 12/11/2008
• Est. Priority Date: 06/07/2007
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Hornqvist, John M.
• Granted Patent: US 8,239,351 B2
• Time in Patent Office: Days
• US Class Current: 707/9
• CPC Class Codes: G06F 16/144 Query formulation
• CPC Class Codes: G06F 16/168 Details of user interfaces specifically adapted to file systems, e.g. browsing and visualisation, 2d or 3d GUIs query results presentation G06F16/156
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

Methods, systems and computer readable media which use permissions checking when deciding whether to allow access to a file are described. In one exemplary embodiment, a method includes receiving a notification of a change of permissions of a directory in a hierarchical file system and determining, in response to the notification, whether to update partially a permissions cache which is used in screening access based on permissions, such as access to search results. The determining may include a comparison of an identifier of the directory to a data structure of cached directories which have files represented in the permissions cache.

Claims

1. A machine readable medium containing executable computer program instructions which cause a data processing system to perform a method comprising:

receiving a notification of a change of permissions of a directory in a hierarchical file system;

determining, in response to the notification, whether to update partially a permissions cache, wherein the permissions cache is used in screening search results based on permissions.

2. The medium as in claim 1 wherein the determining comprises comparing the directory to a data structure for cached directories having files represented in the permissions cache, and wherein the directory is a subdirectory.

3. The medium as in claim 2, wherein the method further comprises:

updating, for at least a period of time, at least a portion of the permissions cache, wherein the updating comprises at least one of setting invalidity data for the portion or removing the portion from the permissions cache, and wherein the updating is performed in response to determining to update partially the permissions cache.

4. The medium as in claim 3, wherein the updating is performed in response to determining that the directory is one of the cached directories in the data structure.

5. The medium as in claim 2, wherein the determining whether to update partially determines to not update the permission cache if the directory is not one of the cached directories in the data structure which stores representations of identifiers for the cached directories.

6. The medium as in claim 4 wherein after the period of time, the updating is terminated automatically and if the updating is incomplete when terminated, the entire permissions cache is at least one of invalidated or flushed.

7. The medium as in claim 5 wherein any updating performed in response to determining to update partially is performed for a first portion of the permissions cache while a second portion of the permissions cache is not updated.

8. The medium as in claim 6 wherein the data structure is configured as a fixed size Bloom filter in which directory identifiers are hashed and stored in the data structure.

9. The medium as in claim 4 wherein separate permission caches and data structures are maintained for each user and each permission cache and each data structure is stored as one or two files in the hierarchical file system.

10. The medium as in claim 4 wherein the method further comprises:

receiving a notification of a change of permissions of a file in the hierarchical file system;

determining whether to update partially the permissions cache for permissions of the file in response to the receiving of the notification of the change of permissions of the file.

11. A machine implemented method comprising:

receiving a notification of a change of permissions of a directory in a hierarchical file system;

determining, in response to the notification, whether to update partially a permissions cache, wherein the permissions cache is used in screening search results based on permissions.

12. The method as in claim 11 wherein the determining comprises comparing the directory to a data structure for cached directories having files represented in the permissions cache, and wherein the directory is a subdirectory.

13. The method as in claim 12, wherein the method further comprises:

updating, for at least a period of time, at least a portion of the permissions cache, wherein the updating comprises at least one of setting invalidity data for the portion or removing the portion from the permissions cache, and wherein the updating is performed in response to determining to update partially the permissions cache.

14. The method as in claim 13, wherein the updating is performed in response to determining that the directory is one of the cached directories in the data structure.

15. The method as in claim 12, wherein the determining whether to update partially determines to not update the permission cache if the directory is not one of the cached directories in the data structure which stores representations of identifiers for the cached directories.

16. The method as in claim 14 wherein after the period of time, the updating is terminated automatically and if the updating is incomplete when terminated, the entire permissions cache is at least one of invalidated or flushed.

17. The method as in claim 15 wherein any updating performed in response to determining to update partially is performed for a first portion of the permissions cache while a second portion of the permissions cache is not updated.

18. The method as in claim 16 wherein the data structure is configured as a fixed size Bloom filter in which directory identifiers are hashed and stored in the data structure.

19. The method as in claim 14 wherein separate permission caches and data structures are maintained for each user and each permission cache and each data structure is stored as one or two files in the hierarchical file system.

20. The method as in claim 14 wherein the method further comprises:

receiving a notification of a change of permissions of a file in the hierarchical file system;

determining whether to update partially the permissions cache for permissions of the file in response to the receiving of the notification of the change of permissions of the file.

21. A data processing system comprising:

means for receiving a notification of a change of permissions of a directory in a hierarchical file system

means for determining, in response to the notification, whether to update partially a permissions cache, wherein the permissions cache is used in screening search results based on permissions.

22. A machine readable medium containing executable computer program instructions which cause a data processing system to perform a method comprising:

receiving a notification of a change of permissions of a directory in a hierarchical file system;

determining, in response to the notification and based on a comparison of the directory to a data structure for cached directories having files represented in a permissions cache, whether to update the permissions cache, wherein the permissions cache is used in determining whether to allow access to files.

23. The medium as in claim 22 wherein the permissions cache is used in screening search results based on permissions, and wherein the determining whether to update determines to not update the permissions cache if the directory is not one of the cached directories in the data structure which stores representations of identifiers for the cached directories.

24. The medium as in claim 22 wherein the determining determines that the directory is one of the cached directories, and wherein, in response to the determining, the entire permissions cache is at least one of invalidated or flushed.

25. The medium as in claim 24 wherein the permissions cache is used in screening search results based on permission.

26. The medium as in claim 23 wherein the method further comprises:

updating, for at least a period of time, at least a portion of the permissions cache, wherein the updating comprises at least one of setting invalidity data for the portion or removing the portion from the permissions cache, and wherein the updating is performed in response to determining to update the permissions cache.

27. The medium as in claim 26, wherein the updating is performed in response to determining that the directory is one of the cached directories in the data structure.

28. The medium as in claim 27, wherein after the period of time, the updating is terminated automatically and if the updating is incomplete when terminated, the entire permissions cache is at least one of invalidated or flushed.

29. The medium as in claim 28, wherein the data structure stores hashed directory identifiers in a lossy manner.

30. The medium as in claim 23, wherein the method further comprises:

receiving a notification of a change of permissions of a file in the hierarchical file system;

determining whether to update partially the permissions cache for permissions of the file in response to the receiving of the notification of the change of permissions of the file.

31. A machine implemented method comprising:

receiving a notification of a change of permissions of a directory in a hierarchical file system;

determining, in response to the notification and based on a comparison of the directory to a data structure for cached directories having files represented in a permissions cache, whether to update the permissions cache, wherein the permissions cache is used in determining whether to allow access to files.

32. The method as in claim 31 wherein the permissions cache is used in screening search results based on permissions, and wherein the determining whether to update determines to not update the permissions cache if the directory is not one of the cached directories in the data structure which stores representations of identifiers for the cached directories.

33. The method as in claim 31 wherein the determining determines that the directory is one of the cached directories, and wherein, in response to the determining, the entire permissions cache is at least one of invalidated or flushed.

34. The method as in claim 33 wherein the permissions cache is used in screening search results based on permission.

35. The method as in claim 32 wherein the method further comprises:

updating, for at least a period of time, at least a portion of the permissions cache, wherein the updating comprises at least one of setting invalidity data for the portion or removing the portion from the permissions cache, and wherein the updating is performed in response to determining to update the permissions cache.

36. The method as in claim 35, wherein the updating is performed in response to determining that the directory is one of the cached directories in the data structure.

37. The method as in claim 36, wherein after the period of time, the updating is terminated automatically and if the updating is incomplete when terminated, the entire permissions cache is at least one of invalidated or flushed.

38. The method as in claim 37, wherein the data structure stores hashed directory identifiers in a lossy manner.

39. The method as in claim 32, wherein the method further comprises:

receiving a notification of a change of permissions of a file in the hierarchical file system;

determining whether to update partially the permissions cache for permissions of the file in response to the receiving of the notification of the change of permissions of the file.

40. A data processing system comprising:

means for receiving a notification of a change of permissions of a directory in a hierarchical file system;

means for determining, in response to the notification and based on a comparison of the directory to a data structure for cached directories having files represented in a permissions cache, whether to update the permissions cache, wherein the permissions cache is used in determining whether to allow access to files.