Mapping elements of $\frac {F}{\mathcal{R}_G}$ to those of $\mathcal{P}(R)$

For each program, we must be able to give a permissions set. We gather programs into equivalence classes of $\frac {F}{\mathcal{R}_G}$. Thanks to the canonical bijection between $G$ and $\frac {F}{\mathcal{R}_G}$, which maps $x \in G$ to $\bar{x} \in \frac {E}{\mathcal{R}_G}$, this amount to giving to each element of $G$ a permissions set. This permission set is a subset of $R$, which can be made by selecting rows in the table in section .

We saw in section that we can also reduce the number of rows of the table using the underlaying structure of the filesystem hierarchy.

We will carry on with the example of the figure , where $G=\{\texttt{/}, \texttt{/usr/bin/}, \texttt{/etc/}\}$. Let's define $\beta$'s graph for example as following:

$$\beta(\texttt{/})=H_{\texttt{/}} = \{\texttt{/},\texttt{/usr/}\}$$

$$\beta(\texttt{/usr/bin/})=H_{\texttt{/usr/bin/}} = \{\texttt{/},\texttt{/etc/}, \texttt{/usr/bin/lpr}\}$$

$$\beta(\texttt{/etc/})=H_{\texttt{/etc/}} = \{\texttt{/},\texttt{/usr/}, \texttt{/usr/etc/fstab}\}$$

This lead to figures , and .

Figure: From $H_{\texttt{/}}$ to the equivalence classes of $\frac {F}{\mathcal{R}_{H_{\texttt{/}}}}$.

to 1cm to 2cm $\longrightarrow$

Figure: From $H_{\texttt{/usr/bin/}}$ to the equivalence classes of $\frac {F}{\mathcal{R}_{H_{\texttt{/usr/bin/}}}}$.

to 1cm to 2cm $\longrightarrow$

Figure: From $H_{\texttt{/etc/}}$ to the equivalence classes of $\frac {F}{\mathcal{R}_{H_{\texttt{/etc/}}}}$.

to 1cm to 2cm $\longrightarrow$

When /usr/bin/vi is exec'd, it is given (in addition to its inherited capabilities) the capabilities given by

$$\begin{matrix} F & \overset{\bar{.}}{\longrightarrow} & \frac {F... ...& \texttt{/usr/bin/} & \longrightarrow & \text{capabilities set} \end{matrix}$$

If it wants to access, say, /etc/fstab, the following operations are done :

$$\begin{matrix} F & \overset{\bar{.}}{\longrightarrow} & \frac {F... ... & \texttt{/usr/bin/} & \longrightarrow & H_{\texttt{/usr/bin/}} \end{matrix}$$

Now that we obtained $H_{\texttt{/usr/bin/}}$, we can carry on :

$$\begin{matrix} F & \overset{\tilde{.}}{\longrightarrow} & \frac {... ...ightarrow} & \texttt{/etc/} & \longrightarrow & \text{permissions} \end{matrix}$$