An Operating Systems Vade Mecum

202 File Structures Chapter 6One simple form of access list is to associate one or more passwords with each file.Passwords define an access list not by explicitly naming subjects but by stipulating a criterionthat subjects must meet. For example, the Exec-8 operating system uses read andwrite passwords to restrict read and write access to files. Files without passwords arepublic.2.4 Directories and access controlSo far we have been discussing access control on a file-by-file basis. If the operating systemprovides a hierarchical directory structure, directories are themselves files. Accessrights for those directories can be used to control access to the files in the directories andallow greater use of the default mechanism outlined previously. We will adopt the followingaccess rule.Access ruleA file may be accessed by a subject only if the subject has the appropriate access rights for all the directories in the absolute name of the file. For Mary to keep outsiders from reading her thesis, she need not protect each file withinthe thesis directory separately. Instead, she can restrict that directory itself frombeing read.Directories have somewhat different operations from ordinary files. We couldinvent a new set of permission types for directories, but for the sake of uniformity, wewill use the same permissions that we use for ordinary files and give them slightly differentmeanings:Read: Determine the names of the files in the directory.Write: Modify local file names, add and delete files. However, it is not allowed toopen the directory for writing. The only way to modify the directory is by servicecalls.Append: Add new files.Execute: Open files in this directory.Delete: Remove this directory.Privilege: Modify the rights that subjects have to the directory.SetOwner: Establish which subject owns the directory.Both Delete privilege for a file and Write privilege for its directory allow a subject todelete that file. The operating system can be designed without a Delete privilege, or thefile manager can require that a subject hold both privileges before allowing it to delete afile. A process with Read but not Execute privilege over a directory can determine whatfiles are in the directory but cannot open any of those files. A process with Execute butnot Read privilege can open files in the directory if it knows their names, but it cannotdiscover their names by reading the directory. If this subtle distinction is not important,