Permissions and Inheritance

Within the RDMS, we support four levels of permissions or user privileges to files and folders. These permissions are either automatically assigned when a file or folder enters the RDMS, or they can be defined by the user(s).

In an order of ascending privileges, these permissions are 'Null', 'Read', 'Read/Write' and 'Own'.

Please see the following table for a summary of what these different permissions allow within the RDMS:

Permission Level	Read	Modify	Create New	Delete	Share
Null
Read
Write
Own

And for a more detailed explanation of what this permissions mean:

Own: The user owns the data object (file) or the collection (folder) and has the full permission on reading, modifying (including deletion), and sharing. This permission is assigned automatically to a file a user uploads into their RDMS Home Drive, for example.

Write: The user has read and write access to the object. This permission level does not allow you to rename or delete the object.

Read: The user can only read the object or its content. This also allows to make a (editable) copy of the file/folder.

Null: The user does not have any permission on the object. One can use 'none' when removing the previously assigned permissions to a user.

Important Note

• If you remove your own permissions, you will no longer be able to restore them even if you were the original owner of the object. This worked in previous versions of IRODS, but was removed in later updates.
• While 'write' permissions allow to create new objects and modify existing ones, it does not allow for the deletion of objects nor to rename them. The reason why renaming is blocked for the write permission is because iRODS handles renaming as creating a new object with the new name and deleting the old object. As such, renaming is a sort of deletion.

Inheritance means that the permissions set on a collection/folder are also propagated to its subfolders and files. Also, with activated inheritance, newly created files and folder inherit the permission of the main folder.

By default, permission inheritance is active within the RDMS for RDMS Team Drives and RDMS Projects, but it can also be disabled on a per folder/collection basis. Users who decide to disable permission inheritance should be aware that this means that permissions on all (sub)folders and files have to be set individually.

Also, it should be noted that it is also possible to modify user permissions on specific subfolders or files when permission inheritance is activated on the main folder.