# File Access Permissions

# File Access Rights

If you are in a company with many users,
you should set file access rights.

## Information

Inherit permissions:

You should always start from the root directory, set the permissions there, enable inheritable permissions and replace permissions for all child objects.

Windows:

To change permissions: right-click on an folder, "Properties", "Security" Tab, then you should use the "Advanced" button.

There are five kinds of users:

Everyone | Artists submit and check jobs. They do not change global RR settings. (But submitter defaults settings) Note that "everyone" contains the other user types like Admin/Tech/... as well.
Admin | You need at least one user that is allowed to write/change all data, including the executables. This user is required for updates only.
rrService user | The user that was set in the workstation installer for the rrService. All Clients and the Server runs with this user account.
Tech (optional) | Technical Staff. They are allowed to change RR settings. You may use Admin users instead.
Plugin TD (optional) | If you want to allow TDs to write and modify RR plug-ins, but not the configuration of RR. You may use Admin users instead.

The access rights/permissions used in the following table are:

R(ead) | Read access (this includes the eXecute right on linux for folders, otherwise you cannot read the dir listing)
W(rite) | Write/Create/Change Access
X (execute) | Execute files (Linux and OSX only. On Windows it is the same as "Read")

## Windows / Linux

We describe two types of permission setups:

•A) The first one contains all of the five user types/groups (Windows).
It is suitable for advanced permissions that allow you to specify as many users as you want for a file permission.

•B) The second one is based on a user-group-everyone permission setup (Linux)

# A) Permissions with 5 user types/groups (Windows)

Colors:

Optional | You may or may not require to apply these access rights. Please read the description for more information.
Optional Tech / Plugin TD | If you do not have any Tech or Plugin TDs, then these settings are NOT required. Because instead of having a new user group for Tech and/or Plugin TDs, you could simply use an Admin user to change files and configurations. In this case ignore these access rights.

Folder | Permissions | Description
[RR] | Read - Everyone Write - Admins | Everyone requires to read all files. Admins change files during an update.
[RR]\ rrJobData | Write - rrService user Write - Everyone (optional, but recommended) | Job data folder. Used for html files, render log files, image caches, ... If an artists resets or deletes a job via rrControl, rrControl tries to delete the folder of that job. If rrControl can not delete the files due to a missing right, the rrServer deletes the files instead (slower).
[RR]\ sub | Write - Tech Write - rrService user (optional) | Note: This folder contains multiple subfolders and files. You can choose to allow write access to some config files or folders only. Even for artists to e.g. update their password in rrConfig/rrLogins. Optional: You may allow the rrService user to write all files. Instead of applying write access to some folders only (as stated below:)
[RR]\ sub\ cfg_global | Write - rrService user Write - Tech Write - Everyone | The rrServer requires to save config files like the client list. Write access is required for everyone who should be allowed to change rrConfig settings. You may allow write settings for some selected files only.
[RR]\ sub\ history_db | Write - rrService user | The rrServer exports deleted jobs into these databases.
[RR]\ sub\ log [RR]\ sub\ stats | Write - rrService user Write - Everyone (optional) | Contains app log files and statistic files of the rrServer and rrClients. In case that you start the rrClient in application mode (= not as background service), then everyone (who starts the rrClient) requires access to these two folders.
[RR]\ inhouse | Write - Everyone | May be used by custom scrips/jobs to create excel tables with some information/statistics. (See rrSubmitter menu Scripted Jobs)
[RR]\ sub_artists | Write - Everyone | Artists are allowed to write files in there. This folder is for •Log files of manually started apps like rrSubmitter or rrCloudManager. •userInformation.htm: Informations for users shown in rrControl and rrSubmitter, changeable via the rrControl menu. •flipbooks.txt: Commandlines for the flipbooks executed if an artist uses the "play" button. •clientgroups.ini: Config file that saves the client groups. •executables.txt: File to define the executables that should be used for displaying html files, quicktimes and folders •Config files for the default setting at the submitter. submitter_prj_[ProjectName].txt submitter_usr_[UserLoggedIn].txt submitter_mac_[MachineName].txt •rrControl UI layout presets
[RR]\ autoload | Write - Tech | Used by updater and rrServerWatch to send commands to the rrServer. e.g. Restart rrServer.
[RR]\ plugins [RR]\ plugins64 | Write - PluginTDs | Plugin files for RR applications
[RR]\ render_apps | Write - PluginTDs | This folder contains all settings for render applications. Commandlines, Submission Plugins, Render Plugins, ...
[RR]\ sub_server\ | Remove Everyone (optional) Read/Write - rrService user | In case you do not want someone else than the rrServer to read the job database, then you have to remove READ access for everyone beside the rrServer rrService user.

# B) Owner-group-everyone permission setup (Linux)

Folder | Admin user | User Group "Tech + rrService + Plugin TDs" | Everyone
[RR] | RWX | R | R
[RR]\ *.bat [RR]\ *.sh | RWX | R X | R X
[RR]\ autoload | RWX | RW | R
[RR]\ bin | RWX | R X | R X
[RR]\ inhouse | RWX | RW | RW
[RR]\ sub_artists | RWX | RWX | RWX
[RR]\ sub_server\ | RWX | RWX | (none)
[RR]\ rrJobData | RWX | RW | RW ( Write is optional, but recommended)
[RR]\ plugins [RR]\ plugins64 [RR]\ render_apps | RWX | RW | R
[RR]\ sub | RWX | RW | R

# Local Data Folder permissions

The Local Data Folder is created on every machine that runs the rrClient or rrServer

As it contains rendered images and scene files, you might want to restrict the access rights.

Only the rrClient and rrServer require to read that folder and sub-folders.
NOTE:
In case that you start the rrClient in application mode (and not as background service),

then everyone (who starts the rrClient) requires access to this folder.

Folder | rrService | Tech | Artists
C:\rrLocalData /usr/local/rrLocalData | RW |  |