File System Security

File permissions determine who can read and write which files, and who can change file permissions. File permissions are defined by a list of pairs, where each pair has one of the two forms:
/dir1/.../dirX/ : file_permissions
Matches any file whose absolute path begins with /dir1/.../dirX/.

/dir/.../dir/file : file_permissions
Matches exactly file /dir/.../dir/file.
For a given file, the most specific file permissions are always used. For example, if the file permissions are 
/		: A
/foo		: B
/foo/		: C
/foo/bar.c	: D
/baz            : E
then we have File permissions are a list of pairs, where the pairs have the form uid:tags or $group:tags. Here uid is a UID, $group is a group, and tags are permission tags. The uid:tags pairs always preceed the $group:tags. Permission tags are: The order of the group:tags pairs in a file permission is important. Only the first $group that matches a given UID determines that UID's rights. For example, suppose frege is a member of groups $wizard and $player, and that file permissions are 
gedeon:rwc $wizard:rw $player:r
then frege can read and write. On the other hand, if file permissions are 
gedeon:rwc $player:r $wizard:wr
then frege can only read.

NOTE: there are three exceptions. The special groups $readall, $writeall, and $changeall have permissions to read, write and change file permissions for any file, respectively.

The following efuns and applies work with file security:

int valid_read(string file, mixed uid, string s)
NOTE: Use the function readp() instead.

Argument uid can be a UID or an object. If it is an object, than that object's EUID is used. Argument s is ignored, but must be present for backward compatiblity. Argument file is an absolute file name. The function returns 1 if uid has the permission to read file.

int valid_write(string file, mixed uid, string s)
NOTE: Use the function writep() instead.

Argument uid can be a UID or an object. If it is an object, than that object's EUID is used. Argument s is ignored, but must be present for backward compatiblity. Argument file is an absolute file name. The function returns 1 if uid has the permission to write file.

int readp(string file, mixed uid)
Argument uid can be a UID or an object. If it is an object, than that object's EUID is used. Argument file is an absolute file name. The function returns 1 if uid has the permission to read file.

int writep(string file, mixed uid)
Argument uid can be a UID or an object. If it is an object, than that object's EUID is used. Argument file is an absolute file name. The function returns 1 if uid has the permission to write file.

int change_perm_p(string file, mixed uid)
Argument uid can be a UID or an object. If it is an object, than that object's EUID is used. Argument file is an absolute file name. The function returns 1 if uid has the permission to change permissions of file.

int get_perm(string file, mixed uid)
Argument uid can be a UID or an object. If it is an object, than that object's EUID is used. Argument file is an absolute file name. The return value describes the file permissions of file for uid, and it is a bitwise or of constants PERM_READ, PERM_WRITE and PERM_CHANGE. These constants are defined in the file /include/file.h, which can be included with #include <file.h>.

int set_perm(string file, list *perm)
Set permission list for file to perm. The function returns 1 on success, and 0 otherwise. It may fail because file does not exist, or because the object that called the function does not have the permission to chage permissions of file.

Argument perm is a list of pairs of the form ({ "uid", perm_bits }), or ({ "$group", perm_bits }), where perm_bits describes the new permission, and is a bitwise or of constants PERM_READ, PERM_WRITE and PERM_CHANGE. These constants are defined in the file /include/file.h, which can be included with #include <file.h>.