UNIX Protection Scheme
The UNIX filing system is a hierarchical structure that supports directories and a sub-directories. It uses simple commands making it easy to create and navigate within this structure. With this type of file system you can control which users have access to your files and directories, and also determines what access modes are granted. Let’s consider a system that supports 5,000 users, and only 4,990 of those users are able to access one file. I will break down the process and show you the protection scheme that would be needed in UNIX.
UNIX has three access modes read, write, and execute. The way the UNIX is set up with these access modes the user must have read access to read the file. They must have write access to modify any data within the file. Lastly you must have execute access to run the file. Every one of these access modes run separately, so just because you have the ability to write the file does not mean you have the access to be able to read the file. There is a slight difference in access modes when it comes to directories. Stallings says, “Directories are structures in a hierarchical tree. Each directory can contain files and or other directories. You have to have execute access to be able to do anything inside of a directory.” (pg. 556) If the user does not have execute power then it is simple they cannot do or have any access to anything within it. The user must have read access to list the contents of a directory. If do not have read access to a directory, but you have execute power you can still have access to an object in a directory if you know the name of it. Having write and execute access give you the ability to create and modify the object.
There are three access categories that will help give access to those we want to access certain objects. A way to control which users have which access rights, each object is given an owner and a group. An object only has one owner the one who created it. Only the super-user can change the ownership of the other objects. A group is a named collection of users. The system admin is responsible for making groups and giving assignments of its users. The object has only one group but the user can belong to multiple groups. When the user tries to access a file the system automatically places you in one of the three categories user, group, or other.an object carries three sets of access modes, one for each of the three categories. If you own the object then the user access modes controls the access rights. If you are a member of the objects group and you are not the owner, then the group access modes controls your access rights. If you do not own the object and are not a member of the group then the other access modes control your access rights. Only one category will apply to you. If you try to access an object in a mode that is not instructed for your category the system will not allow you to have access and will not try anything of the other categories. This gives a way users to have access to certain files in different ways and not allowing loop holes to find another way in.
Now that we know and understand the access modes and categories it will allow us to set up the protection scheme to have 5,000 users and only giving 4,990 of the user’s access to one file. When the super-user makes a new object, it has to be assigned a group. It then makes the group of 5,000, but we do not want to give all 5,000 of them rights to the file. The super-user then gives access modes to the 4,990 of them that they want to be able to access the file. UNIX filling system being a hierarchical structure tree makes it easy to set up protection schemes to make its guidelines of access points.

References
Stallings, W. (2015). Operating Systems: Internals and Design Principles (8th ed.). Retrieved from The University of Phoenix eBook Collection database.