File Management
POS355
May 30, 2012

File Management
When implementing a networked information system that will support thousands of users, it is important to consider which files will need restricted access, and which will be open to all users. The purpose of this essay will explore how a Unix system configured to support five thousand users is able to allow only four thousand nine hundred ninety of those users access to a single file.
Unix File Access Control
Although Unix has evolved over the years, even the most up to date system relies quite heavily upon the originally introduced file access scheme found in the very early versions of Unix. The core of this functionality essentially states that there are three possible permissions any user can have with a single file: read, write, and execute. Permissions for each of these actions are stored with the file’s inode and granted for three groups: the file owner, member’s of the file’s group; and everyone else. All of these permissions are identified in the first nine bits of the file’s twelve protection bits.
The last three bits of the file’s protection bits indicate special behavior. The first two bits tell Unix whether to duplicate the permissions granted for the file owner, or file group, upon execution, respectively. The third bit represents a sticky bit that was originally used in early versions of Unix, but has since been decommissioned. This permission essentially told the operating system whether to keep the contents of the file in memory or not.
As we can see, simple access to a limited number of users within Unix is relatively simple. At it’s core, you simply need to ensure that a group exists with the appropriate permissions for each file, and subsequently all appropriate users are assigned to that user group. For example, a single file that has two groups of users (readers and writers) would require two separate groups, with corresponding users, be established in the system.
File Access for Owner
Managing file access gets difficult when working with a large volume of users as permissions are based upon either the file creator or the file group. In our example above, for each file that is created a new group would need to be established with corresponding members in order for non-file owners to access the file. For this week’s assignment, granting access to the four thousand nine hundred ninety users would be quite simple. The System Administrator could create a single group in which all users are a member. However, as the system grows and files multiply, user groups will significantly increase as well. This is where Access Control Lists (ACL) come in handy.
In the more recent versions of Unix, System Administrators are able to set file access control lists to grant an unlimited number of users or groups to each file. No extra configuration of the files is necessary, the System Administrator simply need to understand the setfacl command (which is distributed with FreeBSD) and how permissions are granted.
Conclusion

Granting access for a single file is relatively simple, even for a large base of users. The System Administrator can simply grant appropriate permissions at the group level for the file. Next, the Admin must create a group of users that is equal to the file’s group and assign all four thousand nine hundred ninety users to the group. This will ensure that each user will be able to access the file as needed.