can Linux group-rights "hide" a library?

mclien · 09-27-2011, 04:21 AM

Because my first thread
"multiple user questions"
wasn't exactly verbalized by me and therefor mainly reads about the content server, I start this new tread (hopefully better targeted to the subject):

I have a Linux only LAN. I want to have two Libraries. To the first one all users should have access, while the second one should be only accessible by some of the user (say adult books).
And this is my idea how to get it working:
-setting up two new groups: ebook, ebook18
-users: child1, child2, parent1, parent2
-adding all users in the group ebook and only parent1, parent2 in the group ebook18
-placing the libraries on a nfs share, with the above mentioned grouprights
-preventing more than one instance of calibre running inside the network by starting calibre via a script, which does some ps and grep magic. So each client can start calibre or gets an error message like "library already occupied by user x on client y"

Only question to me is, if calibre gives rwx rights only to the user or although to the group of the user. Or if its somehow configurabe (even if I have to do it on the OS site via umask).
Or is python doing the rightmanagement completly different?

EDIT:
sorry, perhaps I was to imaptient (again) and the above mentioned post eventually gets me the right way.
/EDIT

EDIT2
ths first edit isn't exacly right, so i follow this idea, too
/EDIT2

itimpi · 09-27-2011, 08:12 AM

It should certainly be possible to use Linux level access rights to control who can access a specific library. Whether the library will end up being hidden, or the user simply gets an error when trying to switch to it with insufficient rights (which I suspect is most likely) I am not sure.

You are going to have to be extremely careful in the mechanism you intend to use to stop multiple instances of Calibre running at the same time against the same library. If you get it wrong you could end up with inconsistencies between the metadata.db file for a given library and the eBook files it contains. However it may well be a workable stop-gap until Calibre is finally enhanced to allow multiple instances to run against the same database.

Note, also, if that something does go wrong and inconsistencies occur it should be possible to use the Calibre facility for rebuilding the metadata.db file for a given library from the ebooks files that are present in the library.

mclien · 09-28-2011, 02:40 AM

If the "forbiden" Library is just hidden or end in an error message is not the big point, because either way the library isn't accessable. So thats OK for me.

I agree the more difficult part is to ensure only one Calibre is accessing the library at the time.
I think I'll do it not controlling the library access, but ensure just one Calibre instance is running inside the LAN. First step ist to start the calibre via shellscript, which is started when clicking the programm (from menue and from desktop icon).
The Libraries are stored on an exported nfs dir.
The (calibre-) shell does the following on startup:
-checking if an nfs to the library dir mount exists
-if it does, finding out, which client/user compination uses it
(-perhaps sends a screen message to this user, gmessage is your friend)
-if no nfs mount exists
-mounting the nfs-dir (with success control)
-starting calibre

Now I just need a way to cleanly unmount the nfs-dir, when shutting down calibre.
or maybe I have to use an aoutomount to mount the nfs share.

EDIT
Alternativly I thought about searching for processes wit ps and grep to ensure no clibre process is running somewhere in the LAN.
/EDIT

kovidgoyal · 09-28-2011, 11:09 AM

IIRC NFS supports file locking, simply have your shellscript lock a file on the NFS share. The only problem with that is stale lockfiles will need to be cleaned by hand.

mclien · 09-29-2011, 03:20 PM

Oh thanks, nice hint.
Did some testing earlier today (with static nfs mounts). Seems that calibre isn't using the users umask (at least when set in ~/.bashrc).
I set one user to umask 0002 (which generates files with perm 775, but when starting calibre, the metadata.db and the book dirs are generated with 755.
The idea was setting up another user and give the second one write access trough the set umask.

So I still need to have a "close script" for calibre to set the permitions via chmod to 775.
Or is there a more elegant way?

09-27-2011, 04:21 AM	#1
mclien 42, the answer Posts: 124 Karma: 17798 Join Date: Sep 2011 Location: Germany Device: Pocketbook 603	can Linux group-rights "hide" a library? Because my first thread "multiple user questions" wasn't exactly verbalized by me and therefor mainly reads about the content server, I start this new tread (hopefully better targeted to the subject): I have a Linux only LAN. I want to have two Libraries. To the first one all users should have access, while the second one should be only accessible by some of the user (say adult books). And this is my idea how to get it working: -setting up two new groups: ebook, ebook18 -users: child1, child2, parent1, parent2 -adding all users in the group ebook and only parent1, parent2 in the group ebook18 -placing the libraries on a nfs share, with the above mentioned grouprights -preventing more than one instance of calibre running inside the network by starting calibre via a script, which does some ps and grep magic. So each client can start calibre or gets an error message like "library already occupied by user x on client y" Only question to me is, if calibre gives rwx rights only to the user or although to the group of the user. Or if its somehow configurabe (even if I have to do it on the OS site via umask). Or is python doing the rightmanagement completly different? EDIT: sorry, perhaps I was to imaptient (again) and the above mentioned post eventually gets me the right way. /EDIT EDIT2 ths first edit isn't exacly right, so i follow this idea, too /EDIT2 Last edited by mclien; 09-27-2011 at 05:14 AM.

09-28-2011, 02:40 AM	#3
mclien 42, the answer Posts: 124 Karma: 17798 Join Date: Sep 2011 Location: Germany Device: Pocketbook 603	If the "forbiden" Library is just hidden or end in an error message is not the big point, because either way the library isn't accessable. So thats OK for me. I agree the more difficult part is to ensure only one Calibre is accessing the library at the time. I think I'll do it not controlling the library access, but ensure just one Calibre instance is running inside the LAN. First step ist to start the calibre via shellscript, which is started when clicking the programm (from menue and from desktop icon). The Libraries are stored on an exported nfs dir. The (calibre-) shell does the following on startup: -checking if an nfs to the library dir mount exists -if it does, finding out, which client/user compination uses it (-perhaps sends a screen message to this user, gmessage is your friend) -if no nfs mount exists -mounting the nfs-dir (with success control) -starting calibre Now I just need a way to cleanly unmount the nfs-dir, when shutting down calibre. or maybe I have to use an aoutomount to mount the nfs share. EDIT Alternativly I thought about searching for processes wit ps and grep to ensure no clibre process is running somewhere in the LAN. /EDIT Last edited by mclien; 09-28-2011 at 03:15 AM.

09-29-2011, 03:20 PM	#5
mclien 42, the answer Posts: 124 Karma: 17798 Join Date: Sep 2011 Location: Germany Device: Pocketbook 603	Oh thanks, nice hint. Did some testing earlier today (with static nfs mounts). Seems that calibre isn't using the users umask (at least when set in ~/.bashrc). I set one user to umask 0002 (which generates files with perm 775, but when starting calibre, the metadata.db and the book dirs are generated with 755. The idea was setting up another user and give the second one write access trough the set umask. So I still need to have a "close script" for calibre to set the permitions via chmod to 775. Or is there a more elegant way? Last edited by mclien; 09-29-2011 at 03:23 PM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Is "dc:rights" a valid entry in an OPF file for Kindlegen?	Stodder	Kindle Formats	5	06-06-2011 06:52 PM
No data in "In Library" and "On Device" columns after upgrade	ily426	Library Management	8	04-03-2011 02:53 PM
Unutterably Silly Motiv für unsere social group "deutschsprachige User"	ravenne	Lounge	75	04-13-2009 02:48 PM
PDA247 to host group read of "The Daughters of Freya"	Alexander Turcic	Deals and Resources (No Self-Promotion or Affiliate Links)	0	03-10-2006 01:36 PM

09-27-2011, 08:12 AM	#2
itimpi Wizard Posts: 4,552 Karma: 950151 Join Date: Nov 2008 Device: Sony PRS-950, iphone/ipad (Marvin/iBooks/QuickReader)	It should certainly be possible to use Linux level access rights to control who can access a specific library. Whether the library will end up being hidden, or the user simply gets an error when trying to switch to it with insufficient rights (which I suspect is most likely) I am not sure. You are going to have to be extremely careful in the mechanism you intend to use to stop multiple instances of Calibre running at the same time against the same library. If you get it wrong you could end up with inconsistencies between the metadata.db file for a given library and the eBook files it contains. However it may well be a workable stop-gap until Calibre is finally enhanced to allow multiple instances to run against the same database. Note, also, if that something does go wrong and inconsistencies occur it should be possible to use the Calibre facility for rebuilding the metadata.db file for a given library from the ebooks files that are present in the library.

09-28-2011, 11:09 AM	#4
kovidgoyal creator of calibre Posts: 43,860 Karma: 22666666 Join Date: Oct 2006 Location: Mumbai, India Device: Various	IIRC NFS supports file locking, simply have your shellscript lock a file on the NFS share. The only problem with that is stale lockfiles will need to be cleaned by hand.

Advert

Advert