System and methods for live masking file system access control entries

One or more non-transitory tangible computer-readable storage media storing computer-executable instructions for performing a computer process on a computing system, the computer process comprising:

• obtaining a first access control list data structure corresponding to a data object, the first access control list having one or more access control entries defining file permission bits for the data object;
• receiving a first change mode operating system command for the data object, wherein the first change mode operating system command reduces at least a first set of access permissions for the data object;
• in response to the first change mode operating system command, generating a second access control list for the data object by modifying the one or more access control entries of the first access control list based on the first change mode command, wherein said modifying includes retaining an original unmodified copy of the access control entries within the first access control list;
• receiving a request associated with a first user to access the data object;
• in response to the request, determining whether or not to provide access to the data object based on the modified access control entries of the first access control list, corresponding to the reduced first set of access permissions for the data object;
• receiving a second change mode operating system command for the data object, wherein the second change mode operating system command is less restrictive than the first change mode operating system command with respect to the first set of access permissions for the data object;
• and
• in response to the second change mode operating system command, generating a third access control list for the data object by modifying the second access control list based on the second change mode operating system command corresponding to the less restrictive first set of access permissions for the data object, wherein generating the third access control list for the data object comprises:
• retrieving the original unmodified copy of the access control entries within the first access control list;
• and
• determining values for the third access control list based in part on the original unmodified copy of the access control entries within the first access control list.

A system comprising:

• a storage layer storing a file system object having an access control list data structure with one or more access control entries defining file permission bits for the file system object;
• and
• an interface layer comprising:
• a processing unit comprising one or more processors;
• and
• one or more storage devices in communication with the processing unit, storing thereon sets of instructions which, when executed by the processing unit, cause the system:
• receive a first change mode operating system command for the file system object, wherein the first change mode operating system command reduces at least a first set of access rights to the file system object;
• in response to the first change mode operating system command, modify a first set of the access control entries corresponding to the first set of access rights to the file system object, wherein said modifying includes retaining an original unmodified copy of the first set of access control entries;
• receive a request associated with a first user to access the file system object;
• in response to the request, determine whether or not to provide access to the file system object based on the modified first set of access control entries corresponding to the to the first set of access rights;
• receive a second change mode operating system command for the file system object, wherein the second change mode operating system command is less restrictive than the first change mode operating system command with respect to the first set of access rights to the file system object;
• and
• in response to the second change mode operating system command, perform a second modification of the first set of the access control entries corresponding to the less restrictive first set of access rights to the file system object, wherein performing said second modification of the first set of the access control entries comprises:
• retrieving the original unmodified copy of the first set of access control entries;
• and
• determining values for the second modification of the first set of the access control entries based in part on the original unmodified copy of the first set of access control entries.