defaria.com/blogs/Status/archives/week_2004_07_18.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   2    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" id="sixapart-standard">
   4 <head>
   5    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
   6    <meta name="generator" content="Movable Type 5.2.3" />
   7
   8    <link rel="stylesheet" href="http://defaria.com/blogs/Status/styles-site.css" type="text/css" />
   9    <link rel="alternate" type="application/atom+xml" title="Atom" href="http://defaria.com/blogs/Status/atom.xml" />
  10    <link rel="alternate" type="application/rss+xml" title="RSS 2.0" href="http://defaria.com/blogs/Status/index.xml"$>" />
  11
  12    <title>Status for Andrew DeFaria: July 18, 2004 - July 24, 2004 Archives</title>
  13
  14    <link rel="start" href="http://defaria.com/blogs/Status/" title="Home" />
  15    <link rel="prev" href="http://defaria.com/blogs/Status/archives/week_2004_07_11.html" title="July 11, 2004 - July 17, 2004" />
  16    <link rel="next" href="http://defaria.com/blogs/Status/archives/week_2004_07_25.html" title="July 25, 2004 - July 31, 2004" />
  17 </head>
  18 <body class="layout-one-column">
  19    <div id="container">
  20       <div id="container-inner" class="pkg">
  21
  22          <div id="banner">
  23             <div id="banner-inner" class="pkg">
  24                <h1 id="banner-header"><a href="http://defaria.com/blogs/Status/" accesskey="1">Status for Andrew DeFaria</a></h1>
  25                <h2 id="banner-description">Searchable status reports and work log</h2>
  26             </div>
  27          </div>
  28
  29          <div id="pagebody">
  30             <div id="pagebody-inner" class="pkg">
  31                <div id="alpha">
  32                   <div id="alpha-inner" class="pkg">
  33
  34                      <p class="content-nav">
  35                         <a href="http://defaria.com/blogs/Status/archives/week_2004_07_11.html">&laquo; July 11, 2004 - July 17, 2004</a> |
  36                         <a href="http://defaria.com/blogs/Status/">Main</a>
  37                         | <a href="http://defaria.com/blogs/Status/archives/week_2004_07_25.html">July 25, 2004 - July 31, 2004 &raquo;</a>
  38                      </p>
  39
  40
  41
  42
  43                      <h2 class="date-header">July 23, 2004</h2>
  44                      <a id="a000218"></a>
  45                      <div class="entry" id="entry-218">
  46                         <h3 class="entry-header">Logger/Display modules - backups</h3>
  47                         <div class="entry-content">
  48                            <div class="entry-body">
  49                               <ul>
  50
  51 <li>Attended backup meeting. It may be that we cannot use <b>diskpart</b> to break hardware mirrors! Spoke with a Rusty Young and he wants a copy of our requirements and may present us with other options like <i>Volume Shadow Copy</i>, SAN, etc.</li>
  52
  53 <li>Modified Display module to accept optional filehandle and to display errors and warnings to STDERR</li>
  54
  55 <li>Checked in initial Logger Object. Now uses Display module</li>
  56
  57 </ul>
  58
  59                               <p class="entry-footer">
  60                                  <span class="post-footers">Posted by  at 11:49 AM</span> <span class="separator">|</span> <a class="permalink" href="http://defaria.com/blogs/Status/archives/000218.html">Permalink</a>
  61
  62
  63                               </p>
  64                            </div>
  65                         </div>
  66                      </div>
  67
  68
  69
  70                      <h2 class="date-header">July 22, 2004</h2>
  71                      <a id="a000217"></a>
  72                      <div class="entry" id="entry-217">
  73                         <h3 class="entry-header">Logger</h3>
  74                         <div class="entry-content">
  75                            <div class="entry-body">
  76                               <ul>
  77
  78 <li>Worked on a Logger object</li>
  79
  80 <li>Resolved long standing <i>Compare does not work in snapshot view</i> issue. Turns out that certain vobs had forward slashes instead of backslashes in their storage paths for the vob tags. Changed to backslashes and compare works again. Strange! Bug in Rational code. Cleaned up all vob tags. View tags do not appear to be affected. May think about changing <i>tagit</i> to tag things with only backslashes...</li>
  81
  82 </ul>
  83
  84                               <p class="entry-footer">
  85                                  <span class="post-footers">Posted by  at  5:26 PM</span> <span class="separator">|</span> <a class="permalink" href="http://defaria.com/blogs/Status/archives/000217.html">Permalink</a>
  86
  87
  88                               </p>
  89                            </div>
  90                         </div>
  91                      </div>
  92
  93
  94
  95                      <h2 class="date-header">July 21, 2004</h2>
  96                      <a id="a000216"></a>
  97                      <div class="entry" id="entry-216">
  98                         <h3 class="entry-header">Mktriggers/restoring view</h3>
  99                         <div class="entry-content">
 100                            <div class="entry-body">
 101                               <ul>
 102
 103 <li>Finally got view restored. Recovered the triggers.dat file and the NoPBLs trigger</li>
 104
 105 <li>Implemented both the NoPBLs and Permissions triggers</li>
 106
 107 <li>Implemented vobsize</li>
 108
 109 </ul>
 110
 111
 112
 113                               <p class="entry-footer">
 114                                  <span class="post-footers">Posted by  at  3:15 PM</span> <span class="separator">|</span> <a class="permalink" href="http://defaria.com/blogs/Status/archives/000216.html">Permalink</a>
 115
 116
 117                               </p>
 118                            </div>
 119                         </div>
 120                      </div>
 121
 122
 123
 124                      <h2 class="date-header">July 20, 2004</h2>
 125                      <a id="a000215"></a>
 126                      <div class="entry" id="entry-215">
 127                         <h3 class="entry-header">Permissions Trigger</h3>
 128                         <div class="entry-content">
 129                            <div class="entry-body">
 130                               <p>Implemented Permissions trigger.</p>
 131
 132                               <p class="entry-footer">
 133                                  <span class="post-footers">Posted by  at  3:12 PM</span> <span class="separator">|</span> <a class="permalink" href="http://defaria.com/blogs/Status/archives/000215.html">Permalink</a>
 134
 135
 136                               </p>
 137                            </div>
 138                         </div>
 139                      </div>
 140
 141
 142
 143                      <h2 class="date-header">July 19, 2004</h2>
 144                      <a id="a000214"></a>
 145                      <div class="entry" id="entry-214">
 146                         <h3 class="entry-header">Permissions Trigger</h3>
 147                         <div class="entry-content">
 148                            <div class="entry-body">
 149                               <p>I've given the "permissions trigger" some thought and would like to formalize the requirements a bit. The new trigger will have the following characteristics:</p>
 150
 151 <ul>
 152
 153 <li>Since multiple groups will be allowed write access to the vob they will need to be added as additional groups on the vob group list. </li>
 154
 155 <li>Determination of what users get additional write capability will be on Active Directory groups. IOW you can grant write access to say the CC-PMO group but not specifically to Mike Hrenko who is a member of the CC-PMO group. Additionally CC-PMO would need to appear on the vob group list in this example.</li>
 156
 157 <li>The trigger will use CLEARCASE_PRIMARY_GROUP to determine what group the user is. This avoids having to do LDAP lookups and it's the way that Clearcase does it anyway. CLEARCASE_PRIMARY_GROUP will not be used verbatim - if it were then anybody would "fake" out the trigger by merely setting CLEARCASE_PRIMARY_GROUP. Instead "creds" will be called to ascertain the effective primary group.</li>
 158
 159 <li>A permissions element will be created that will contain a list of groups, one per line, that are allowed write access from this folder downward. The vob's initial or primary group owner (CC-TTE in the case of Core_automation) will always have write permission. Furthermore the permissions element should be secured such that only vob's primary group owner can modify it. Otherwise other groups could easily modify the permissions element thus granting write permissions to arbitrary groups.</li>
 160
 161 </ul>
 162
 163 <p>Let's see an example of how this will work and how the trigger will respond. Let's assume the following directory structure:</p>
 164
 165 <blockquote>
 166   Core_automation
 167   <blockquote>
 168     Empower <font color="#eeeeee">CC-EAG-AS, CC-EAG-ESB</font>
 169     <blockquote>
 170       Functions <font color="#eeeeee">CC-EAG-VIP</font><br>
 171       Results <font color="#eeeeee">CC-EAG-VMS</font><br>
 172       Common
 173     </blockquote>
 174   </blockquote>
 175 </blockquote>
 176
 177 <p>Further let's assume that the permissions element is at the Empower level and contains the groups CC-EAG-AS and CC-EAG-ESB. This says that those two groups (as well as CC-TTE as primary group owners of the vob) have write permission (the ability to checkout) elements from Core_automation/Empower downward. Additionally let's say that we have a permissions element at Empower/Functions that lists CC-EAG-VIP and Empower/Results has a permissions element that lists CC-EAG-VMS. The following can be said:</p>
 178
 179 <ul>
 180
 181 <li>Members of CC-EAG-AS and CC-EAG-ESB have write permissions to Empower, Empower/Functions, Empower/Results and Empower/Common. Further, if new folders are created under Empower, CC-EAG-AS and CC-EAG-ESB will have write permissions to those new folders as well (IOW the write permissions are inherited by new folders that are created)</li>
 182
 183 <li>Members of CC-EAG-VIP have write permissions to Empower/Functions and any new folders created under Functions, but they do not have write permissions to Empower/Results nor Empower/Common. Similarly CC-EAG-VMS has write permissions to Empower/Results but not to Empower/Functions nor Empower/Common</li>
 184
 185 </ul>
 186
 187 <p>The pseudo code for the trigger is roughly as follows. Note that the trigger gets fired during checkout of an element only (it is assumed if the user successfully checked out the element then, at the time, he had write permissions and should be allowed to check in the element):</p>
 188
 189 <div class="code">
 190 <pre>
 191 $vob_group_owner = GetGroupOwner (vob)
 192 $current_group   = GetCurrentGroup (CLEARCASE_PRIMARY_GROUP as per "creds")
 193
 194 if (permissions element exists in the current folder) {
 195   if (IsAMember (Parse ($permissions_element), $current_group) {
 196     &lt;<i>allow checkout</i>&gt;
 197   } else {
 198     &lt;<i>recurse to check parent folder stopping at vob root</i>&gt;
 199     &lt;<i>disallow checkout</i>&gt;
 200   }
 201 }
 202 </pre>
 203 </div>
 204
 205                               <p class="entry-footer">
 206                                  <span class="post-footers">Posted by  at  3:07 PM</span> <span class="separator">|</span> <a class="permalink" href="http://defaria.com/blogs/Status/archives/000214.html">Permalink</a>
 207
 208
 209                               </p>
 210                            </div>
 211                         </div>
 212                      </div>
 213
 214                   </div>
 215                </div>
 216             </div>
 217          </div>
 218       </div>
 219    </div>
 220 </body>
 221 </html>