An Operating Systems Vade Mecum

Access control 201selfgroupworldHelenTroyread, writeno accessno accessreadThe file manager permits any access that is allowed by at least one entry in the object’saccess list. (Actually, Multics denies access if the first applicable entry on the list deniesit, even if a later one allows it.)Whenever a subject creates a new object, it is necessary to initialize the access list.The subject might be required to provide an access list at the time the object is created.Alternatively, a default access list may be supplied by the file manager in the hope that itwill be adequate for most objects. For example,selfgroupworldread, writereadno accessis a reasonable default setting. The default may be customized if each user indicateswhat privileges are not to be granted automatically to other subjects. For example, thedefault setting just shown could be represented as follows:selfgroupworldunlimiteddeny: write, append, execute, deletedeny: read, write, append, execute, deleteIf Mary is more trusting, she could change this customization as follows:selfgroupworldunlimiteddeny: append, execute, deletedeny: write, append, execute, deleteWhen a process creates a file on behalf of Mary, it can specify what permissions to grantto each class of subjects. The file manager will then reduce these permissions in accordancewith the customized default. It also provides a service call that allows Mary tomodify the access list, possibly to add a special entry for her professor or remove Readaccess from the world. Such a service call may look like this:ChangePrivileges(file name, new permissions). This call establishes the permissionson the given file. The format of the ‘‘new permissions’’ parameterdepends on the particular operating system. Typically, this parameter is a string ofbits. Each bit position indicates some form of access privilege for some user class.If the bit is on, the privilege is granted. This call fails if the caller does not havethe Privilege privilege for this file or if the file does not exist.