An Operating Systems Vade Mecum

Access control 203Execute privilege might be ignored for directories.Our access rule requires that when a process opens a file, the file manager mustcheck privileges in all the directories in the path between the root of the file structure andthat file. The process must have Read (and perhaps Execute) privilege in all of them. Aswe mentioned earlier, this check might be performed only when the process first opensthe file. If permissions are later restricted somewhere in that path, the process is notprevented from continuing the access it is making.Our access rule has some strange consequences. Consider Figure 6.7. Assumethat the working directory for process X is /a/b/c/d (directory 6 in the figure). AfterX establishes this working directory, the owner changes the permissions to prevent Xfrom reading or executing /a/b (directory 3). According to the policy that was enunciatedearlier, X should not be allowed to open files 11, 12, and 13, because the path fromthe root (directory 1) to those files is no longer free of impediment. However, X canrefer to those files by giving a relative name (such as e) from the current working directory6. Since the relative name does not refer to directory 3, the file manager might allowaccess. It could still prevent access by expanding all relative names to full names. Alternatively,we can modify our access rule as follows:1a2bc4h5i9mkdj10786ef1112g133Figure 6.7 A sample directory structure