[Security]: limit scope of the filesystem

[wtempel]

Welcome to the forum @vk123 .

@vk123

The cryosparc instance is run by the admin user, who can see all of the data,

One should not run CryoSPARC under the root account, but concerns similar to those discussed here apply to other Linux accounts with elevated privileges.

@vk123

In the file selection dialog a user can browse to any folder on the file system and thus can bypass the access restrictions enforced by the Unix groups, because the file selection is done by the admin user.

A CryoSPARC instance should only be shared between users who trust each other and when the shared visibility of data would not be a concern. If this visibility would be a concern, one may want to host multiple CryoSPARC instances (possibly under separate Linux accounts) such that no users who should not see each other’s data would be sharing the same instance and data visibility can be restricted at the OS level.
One may host multiple CryoSPARC instances on the same host if each instance has a unique

1. and non-overlapping port range
2. database directory
3. and non-overlapping set of project directories (only a single CryoSPARC instance must be allowed to modify a project directory)
4. license key