SlashGrid =

1
SlashGrid /grid

• Andrew McNab
• High Energy Physics
• University of Manchester
• http//www.gridpp.ac.uk/authz/

2
SlashGrid motivation

• Produced as part of EU DataGrid
• EDG uses Unix pool accounts for job execution
• user assigned to a temporary account for duration
  of the job, normal Unix permissions apply
• but all files created need to be deleted before
  pool account can be created
• SlashGrid gets round this by controlling access
  to files by Grid credential rather than Unix ID
• so SlashGrid primarily motivated by local security

3
SlashGrid implementation

• Currently Linux-specific
• uses Linux venus/coda kernel module to connect a
  client-side daemon to OS
• replacing this with nfs daemon-gtOS connector
• Daemon handles the virtual filesystems, does
  credential checking and network operations.
• SlashGrid best described as a Framework for
  Grid-aware filesystems
• provides verifying/storage of Grid credentials
• multiple filesystem types, each supported by a
  loadable .so module

4
Some plugin/filesystem types

• certfs - a robust demonstration fs
• local disk storage controlled by GACL access
  control policies, and X509, GSI or VOMS cred.
• curlfs - an example networked fs
• remote access to HTTP(S) servers
• presents local credentials (eg GSI proxy) to
  remote services when auth required
• gmapfs - an example utility fs
• populated with virtual symbolic links to augment
  pool account system

5
What SlashGrid is not

• Not a Grid filesystem
• its deliberately protocol-neutral
• its a framework for building filesystems on
• Not a monolithic system
• it lets third parties write plugins for their
  favourite file transfer protocol
• third parties may need utility filesystems that
  we cant anticipate (cf Linux /proc)
• Not a complete fs security model
• it supports one (GSI/VOMS/GACL), but can readily
  support others (eg Kerberos based)

6
Summary

• Motivated by local security
• Work done in a client-side daemon rather than
  kernel
• Daemon supports third-party plugins
• Aim for network-protocol and security-model
  neutrality
• Should be seen as a client for Grid File
  Systems rather than as A Grid File System
  itself.