Access algorithm for VOB and view data

This algorithm tests access to a protected object for the owner, the owning group, and then all other users and groups. It grants access when the first match is made.

When a process seeks access to a protected object, the following algorithm usually determines whether access is granted:

Does the process have the user ID of the owner of the object?
- Yes: Grant or deny access according to the object’s protection mode for the Owner category.
- No: Go to Step 2.
Does the process have the group ID of the group of the object?
- Yes: Grant or deny access according to the object’s protection mode for the Group category.
- No: Go to Step 3.
Grant or deny access according to the object’s protection mode for the Other category.

If an object has no protection mode, access is granted or denied using rules that depend on the type of the object. See the descriptions in Access control for VOBs and objects they contain and Access control for views and objects they contain.

In certain cases, a process is granted access to an object only if the process has access to one or more containing objects also. For example, to create a view-private file in a dynamic view, the user must have write permission for the directory that will contain the file and for the view itself.