Permissions : Sensible default permissions for initial groups

[jamoore]

This ticket is a part of #1434.

Previously, all groups created via bin/omero db script were created with permissions -35 (rwr---). However, system and user should be -103 (rw----). What about "user" and "guest" (if it remains)?

ola 11:06
Josh: I wiped the db and script generated for me groups where (rwr-r-)
ola 11:07 
is this correct status?
josh moore 11:08 
Ola: hmm...... i might not have modified data.vm to create private groups. what do you think should happen?
ola 11:09 
I don;t know any reason why predefined groups should be public
ola 11:09 
if security sys. required that is fine, but if not I would vote after rw----
09:42
othewise all data imported by admin is public
josh moore 11:09 
ola: definitely not required. Just a question of user expectation.
09:59
system should be rw----, yes.
10:04
agree. I was thinking more about "CHANGE_ME"
ola 11:10 
we might think about guest having rwr-r-
josh moore 11:10 
guess will never be able to import, so it's not really critical. in fact, guess may no longer need a group. i'll have to think about it.
ola 11:12 
guest - fair enough. If there is flag in vm what defines then I would reduce to rw---- and if people need they can change configuration

[jmoore]

• r6068 - Revert "ticket:1783 - Initially making all groups on db creation rw----" …
• r6064 - ticket:1783 - Initially making all groups on db creation rw----

Note: this is also related to #1784. For scripting, original files must be visible (in the current implementation).

[jmoore]

(In [6278]) see #1783 - Making CHANGE_ME private by default (again)

[jmoore]

As a part of #1794, it was decided that the "user" group would be initial used as the "common pot" of objects which are globally visible. Therefore, the default group permissions are:

• system: private, so administrators' work is not seen
• user: public, since there is special handling to make it public anyway
• guest: private, so that it doesn't show up on lists of "public" data where someone might want to login.

[jmoore]

(In [6365]) fix #1783 - initial groups

[jmoore]

(In [6374]) see #1783 - adding to SQL and fixing one mistake