5.5.2

The first two lines in the default js-io-rights.conf configuration file allow the following access rights:
-rwx /
All access to the file system is denied.
+rwx /var/run/vco
Read, write, and execute access is permitted in the /var/run/vco directory.
Rules in the js-io-rights.conf File
Orchestrator resolves access rights in the order they appear in the js-io-rights.conf file. Each line can
override the previous lines.
In the default js-io-rights.conf configuration file, the second line partially overrides the first line because
c:/orchestrator is after c:/, which allows read, write, and execute access to c:/orchestrator but denies
access to the rest of the file system under c:/.
The default configuration allows workflows and the Orchestrator API to write to the c:/orchestrator
directory, but nowhere else.
IMPORTANT You can permit access to all parts of the file system by setting +rwx / in the js-io-rights.conf
file. However, doing so represents a high security risk.
Set Server File System Access for Workflows and JavaScript
To change the parts of the server file system that workflows and the Orchestrator API can access, modify the
js-io-rights.conf configuration file. The js-io-rights.conf file is created when a workflow attempts to
access the Orchestrator server file system.
If the js-io-rights.conf file does not exist on your Windows system, you can manually create it with the
default contents. You can create manually the file only on Windows systems. For more information, see
“Manually Create the js-io-rights.conf File on Windows Systems,” on page 113.
Orchestrator has read, write, and execute rights to a folder named orchestrator, at the root of the server
system.
NOTE To locate the js-io-rights.conf on the Orchestrator Appliance, log in to the Orchestrator Appliance
Linux console as root and navigate to the /etc/vco/app-server directory.
Procedure
1 Create the c:/orchestrator folder at the root of the Orchestrator server system.
2 Navigate to the folder that contains configuration files on the Orchestrator server system.
Option Action
If you installed Orchestrator with
the vCenter Server installer
Go to
install_directory\VMware\Infrastructure\Orchestrator\app-
server\conf.
If you installed the standalone
version of Orchestrator
Go to install_directory\VMware\Orchestrator\app-server\conf.
3 Open the js-io-rights.conf configuration file in a text editor.
4 Add the necessary lines to the js-io-rights.conf file to allow or deny access to parts of the file system.
For example, the following line denies the execution rights in the c:/orchestrator/noexec directory:
-x c:/orchestrator/noexec
c:/orchestrator/exec retains execution rights, but c:/orchestrator/noexec/bar does not. Both
directories remain readable and writable.
Installing and Configuring VMware vCenter Orchestrator
112 VMware, Inc.