HANDLING PERMISSIONS FOR VIRTUALIZED FILE SERVERS

• US 20180157860A1
• Filed: 12/01/2017
• Published: 06/07/2018
• Est. Priority Date: 12/02/2016
• Status: Active Grant

• Current Assignee: Nutanix Incorporated
• Original Assignee: Nutanix Incorporated
• Inventors: Nair, Saji Kumar Vijaya Kumari Rajendran, Thummala, Hemanth Kumar, Tammineedi, Veerraju, Rathi, Shyamsunder Prayagchand, Naik, Manoj, Gupta, Manish, Arikatla, Durga Mahesh, Kumar, Gaurav
• Granted Patent: US 11,568,073 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/172 Caching, prefetching or hoarding of files
• CPC Class Codes: G06F 16/192 Implementing virtual folder structures
• CPC Class Codes: G06F 17/30132 Caching or prefetching or hoarding of files caching for data retrieval from the Internet G06F17/30902; caching for peripheral storage systems, e.g. disk cache G06F12/0866; network-specific arrangements or communication protocols for caching H04L67/2842
• CPC Class Codes: G06F 17/30235 Implementing virtual folder structures
• CPC Class Codes: G06F 2009/45579 I/O management, e.g. providing access to device drivers or storage
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Examples of systems described herein include a file server virtual machine of a virtualized file server configured to manage storage of a plurality of storage items. The file server virtual machine including a file system configured to receive an access request directed to a storage item of the plurality of storage items and associated with a user. The file system is further configured to retrieve an access control list having permissions information associated with the storage item, and to cache a permissions profile for the user including all permissions pertaining to the user for the storage item. The file system is further configured to determine whether the access request is permissible based on the cached permissions profile.

Claims

1. A system comprising:

a file server virtual machine of a virtualized file server configured to manage storage of a plurality of storage items, wherein the file server virtual machine comprises a file system configured to receive an access request directed to a storage item of the plurality of storage items and associated with a user, wherein the file system is further configured to retrieve an access control list having permissions information associated with the storage item, wherein the file system is configured to cache a permissions profile for the user including all permissions pertaining to the user for the storage item, wherein the file system is further configured to determine whether the access request is permissible based on the cached permissions profile.

2. The system of claim 1, wherein the file server virtual machine is configured to cache the permissions profile as bitmask.

3. The system of claim 1, wherein the bitmask is a four kilobyte bitmask.

4. The system of claim 1, wherein the access request if a first access request, wherein the file system is further configured to receive a second access request directed to the storage item of the plurality of storage items and associated with the user, wherein the file system is configured to determine whether the second access request is permissible based on the cached permissions profile.

5. The system of claim 4, wherein the first access request is a different access type than the second access request.

6. The system of claim 1, wherein the file system is further configured to clear the cached permissions profile after a set period of time.

7. The system of claim 1, wherein the file system is further configured to clear the cached permissions profile in response to termination of a session associated with the user.

8. The system of claim 1, wherein the file system is further configured to retrieve the access control list from a metadata database configured to store metadata associated with the plurality of storage items.

9. A method comprising:

receiving, at a file system of a file server virtual machine, an access request associated with a user and directed to a storage item of a plurality of storage items managed by a virtualized file server;

retrieving an access control list having permissions information associated with the storage item;

caching a permissions profile for the user including all permissions pertaining to the user for the storage item; and

determining whether the access request is permissible based on the cached permissions profile.

10. The method of claim 9, further comprising forming a bitmask to cache as the permissions profile.

11. The method of claim 9, wherein the access request if a first access request, wherein the method further comprises:

receiving a second access request directed to the storage item of the plurality of storage items and associated with the user; and

determining whether the second access request is permissible based on the cached permissions profile.

12. The method of claim 9, further comprising, in response to receiving access requests from a plurality of users related to a particular access type for the storage item over a specific period of time, caching all permissions for the particular access type for the storage item.

13. The method of claim 9, further comprising clearing the cached permissions profile after a set period of time.

14. The method of claim 9, further comprising clearing the cached permissions profile in response to termination of a session associated with the user.

15. A method comprising:

receiving, at a distributed data coordinator of a file server virtual machine, a request to create an access control list entry in a metadata database for a new storage item in a directory managed by a virtualized file server, wherein the access control list comprises permissions information associated with the new storage item;

retrieving a parent directory access control list associated with the directory; and

in response to a determination that the access control list matches the parent directory access control list, inserting a pointer to the parent directory access control list for the access control list entry for the new storage item.

16. The method of claim 15, further comprising, in response to a determination that the access control list is different than the parent directory access control list, including the access control list in the access control list entry for the new storage item.

17. The method of claim 15, further comprising comparing the access control list to the parent directory access control list.

18. The method of claim 15, further comprising, in response to receiving a request for permissions information for the directory including the new file, following the pointer to the parent directory access control list to evaluate the permissions information associated with the new storage item.

19. The method of claim 18, further comprising, in response to receiving the request for permissions information for the directory:

caching the parent directory access control list; and

using the cached parent directory access control list to evaluate the permissions information associated with the new storage item.

20. The method of claim 15, wherein the new storage item is a file or a folder.