Handling permissions for virtualized file servers

Patent metadata

Field	Value
Publication number	US-12400015-B2
Application number	US-202218065524-A
Country	US
Kind code	B2
Filing date	Dec 13, 2022
Priority date	Dec 2, 2016
Publication date	Aug 26, 2025
Grant date	Aug 26, 2025

Abstract

Examples of systems described herein include a file server virtual machine of a virtualized file server configured to manage storage of a plurality of storage items. The file server virtual machine including a file system configured to receive an access request directed to a storage item of the plurality of storage items and associated with a user. The file system is further configured to retrieve an access control list having permissions information associated with the storage item, and to cache a permissions profile for the user including all permissions pertaining to the user for the storage item. The file system is further configured to determine whether the access request is permissible based on the cached permissions profile.

First claim

What is claimed is:

1. A method comprising:
hosting a file server virtual machine (FSVM) on a host machine of a plurality cluster of host machines, the FSVM configured to manage at least one storage item of a namespace presented by the FSVM, the namespace including a plurality of storage items stored in a storage pool distributed across the plurality of host machines, the plurality of storage items comprising at least one storage item stored at a host machine of the plurality of host machines and another storage item stored at another host machine of the plurality of host machines, the storage pool including local storage coupled to at least the host machine, wherein the plurality of storage items include respective access control lists (ACLs) corresponding to permissions granted to users for the plurality of storage items;
receiving, at the FSVM, an access request associated with a user and directed to the at least one storage item stored in the storage pool;
listing the at least one storage item having one or more permissions granted to the user in a directory of the namespace;
determining whether the access request directed to the at least one storage item is permissible based on the permission listing within the directory; and
if the access request is permissible, performing the access request on the at least one storage item stored in the storage pool.

2. The method of claim 1 , wherein the plurality of storage items of the namespace include folders, files, or portions thereof.

3. The method of claim 1 , further comprising using a storage map to determine whether a particular storage item is located on a particular host machine.

4. The method of claim 1 , further comprising hosting additional FSVMs on additional host machines of the plurality of host machines.

5. The method of claim 4 , wherein each of the additional FSVMs is configured to present the namespace.

6. The method of claim 1 , wherein at least one of the ACLs comprises an access control entity.

7. The method of claim 6 , wherein the access control entity specifies access rights allowed, denied, or audited.

8. The method of claim 7 , wherein the access control entity specifies a user associated with the access rights allowed, denied, or audited.

9. The method of claim 1 , wherein the access request comprises a request to list storage items.

10. The method of claim 1 , further comprising retrieving a user permission profile for multiple files in the directory.

11. The method of claim 1 , the storage pool comprising an aggregation of storage devices from the plurality of host machines.

12. The method of claim 1 , wherein the permission listing is configured to list one or more storage items that the user is permitted to access.

13. The method of claim 1 , the storage pool including local storage coupled to at least multiple ones of the plurality of host machines.

14. A system comprising:
a plurality of host machines, including a first host machine;
a storage pool comprising at least a plurality of computer-readable non-transitory storage media distributed across the plurality of host machines, the storage pool including local storage coupled to at least one of the plurality of host machines; and
a file server virtual machine (FSVM) configured to execute on the first host machine, the FSVM configured to manage at least one storage item of a namespace presented by the FSVM, the namespace including a plurality of storage items,
wherein the plurality of storage items comprise at least one storage item stored at the first host machine and another storage item stored at a second host machine of the plurality of host machines,
wherein the plurality of storage items include respective access control lists (ACLs) corresponding to permissions granted to users for the storage items,
wherein the FSVM is configured to receive an access request associated with a user and directed to the at least one storage item stored in the storage pool; and
wherein the system is configured to list the storage item having one or more permissions granted to the user in a directory of the namespace, determine whether the access request directed to the storage item is permissible based on the permission listing within the directory, and if the access request is permissible, perform the access request on the storage item stored in the storage pool.

15. The system of claim 14 , wherein the plurality of storage items of the namespace include folders, files, or portions thereof.

16. The system of claim 14 , further comprising additional FSVMs on additional host machines of the cluster-plurality of host machines.

17. The system of claim 16 , wherein each of the additional FSVMs is configured to present the namespace.

18. The system of claim 14 , wherein at least one of the ACLs comprises an access control entity.

19. The system of claim 18 , wherein the access control entity specifies access rights allowed, denied, or audited.

20. The system of claim 19 , wherein the access control entity specifies a user associated with the access rights allowed, denied, or audited.

21. The system of claim 14 , the storage pool comprising an aggregation of storage devices from the plurality of host machines.

22. The system of claim 14 , wherein the permission listing is configured to list one or more storage items that the user is permitted to access.

23. The system of claim 14 , the storage pool including local storage coupled to at least multiple ones of the plurality of host machines.

24. A method comprising:
receiving a request from a user to read a directory, wherein the directory is in a namespace presented by a file server virtual machine (FSVM) hosted on a host machine of a plurality of host machines, and wherein storage items of the directory are stored in a storage pool distributed across the plurality of host machines, and wherein the storage pool includes local storage coupled to at least one host machine of the plurality of host machines, wherein the storage items comprise at least one storage item stored at the host machine and another storage item stored at a second host machine of the plurality of host machines;
accessing permissions information associated with the user, the permissions information pertaining to multiple files in the directory; and
listing the storage items in the directory having permissions granted to the user based on the permissions information.

25. The method of claim 24 , wherein the storage items include respective access control lists (ACLs) corresponding to the permissions information.

26. The method of claim 24 , wherein the storage items of the namespace include folders, files, or portions thereof.

27. The method of claim 24 , further comprising using a storage map to determine whether a particular storage item is located on a particular host machine of the plurality of host machines.

28. The method of claim 24 , further comprising hosting additional FSVMs on additional host machines of the plurality of host machines.

29. The method of claim 28 , wherein each of the additional FSVMs is configured to present the namespace.

30. The method of claim 24 , the storage pool comprising an aggregation of storage devices from the plurality of host machines.

31. The method of claim 24 , wherein the permissions information is configured to lis

Assignees

• Nutanix Inc

Inventors

• Nair Saji Kumar Vijaya Kumari Rajendran
• Thummala Hemanth Kumar
• Tammineedi Veerraju
• Rathi Shyamsunder Prayagchand
• Naik Manoj
• Gupta Manish
• Arikatla Durga Mahesh
• Kumar Gaurav

Classifications

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F16/192

  Implementing virtual folder structures · CPC title

• G06F16/172

  Caching, prefetching or hoarding of files · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title