5. Suppose a user wishes to edit the file xyzzy in a capability-based system. How the editor cannot access any other file? Could this be done in an ACL-based system? If so not?
The solution to the given question is:
In a feature-based system , permissions are set on files for specific processes. So when a user tries to edit a file (eg xyzzy) , only that file is granted read/write permission and only that single process. Cap(process(user)) = {xyzzy.{read, write, execute}}
Since the list of possibilities is only set for certain files and not access to other files , you can be sure that your users will only have access to xyzzy files.
This cannot be done on ACL based systems. There is no way to ensure that the editor cannot access any file other than intended one. This is because permissions are granted based on user , group and entity permissions in the ACL system. Users can access different files depending on the groups in which they are listed. Even if a user is only granted access to xyzzy files , they can access some other files depending on the group's permissions.
Step by step
Solved in 2 steps
