File Management In a computer systems protection is needed for data to keep it from unauthorized access. Protection can be accomplished in many ways. For a small single user system, we might provide protection by physically removing the floppy disks and locking them in a desk drawer or file cabinet. In a multiuser system, however, other mechanisms are needed. Utilizing controlled access to limit the type of access to files is one such protection mechanism. Some of the types of controlled access are read, write, list, execute, append, delete, renaming, copying and editing. Protection mechanisms may differ depending on the type of computer system and the environment it is used in. The protection required for a library may need to be less restrictive than a system supporting a health clinic. Access control list (ACL) is a general scheme of associating specific usernames and access types for each user to files and directories. Of major concern with ACL is their length. If you allow four hundred users to read a file, you must list each user. Drawback of creating ACL is the time and effort needed to build it and the variable size of the directory entries. To counter these issues condensed version of the list using three classifications of users is recognized by many systems to associate to each file. The three classifications of users are: * Owner: The user who created the file is the owner * Group: A set of users who are sharing the file and need similar access is a group, or work group. * Universe: All other users in the system constitute the universe.
Within the UNIX system the manager or any superuser are the only ones who can create or modify groups. This preserves the tight control of permissions and access lists necessary. The file access control scheme in the UNIX system uses 12 bits per file to record permission sets. Only three fields are needed to define protection under the more restrictive permissions and access list. Each field is a collection of three bits identifying allow or deny of access. The bits represented by rwx, with r controlling read access, w controlling write access and executing being controlled by x. UNIX users is assigned a unique user identification number (user ID). Each group within the system is also assigned a number is called the group ID. The owner (user) ID, group ID and protection bits are specified by nine of the 12 protection bits. Additional special behavior is defined by the remaining three bits.
Although very functional when users and a moderate amount of groups line up with file access, it can quickly become an unwieldy mess when the number of groups and range of access rights increase.
Consider a system that supports 5,000 users. Suppose you want to allow 4,990 of those users to be able to access one file. How would you specify this protection scheme in UNIX? There are two ways possible to permit or deny users. First, creating a group called Permitted and adding the 4,990 users to this group. Then you would need to set the permission on the file authorized for the users to access to allow the group. This permission set will look like: Owner class (me) | Group class (Permitted) | Other class | rwx | r-- | --- |

The second, and maybe easier, way is to create a Deny group and set permission as appropriate to restrict the Deny group from accessing the file. This permission set will look like: Owner class (me) | Group class (Deny) | Other class | rwx | --- | r-- |
In summary many of today’s systems utilize groups and access list to provide the protection necessary for files and directories. Whether setting read, write, or execute permissions this scheme allow for tighter control of access.

References
Silberschatz, A., Galvin, P. B., Gagne, G. (2009). Operating System Concepts (8th ed.). Hoboken, NJ: John Wiley & Sons, Inc.
Stallings, W. (2012). Operating Systems: Internals and Design Principles (7th ed.). Upper Saddle River, NJ: Prentice Hall