\chapter{Interactively Controlled File System}

In this section we present the solution developed as a part of this thesis, named \emph{Interactively Controlled File System} (or ICFS for short).

\section{Features}

ICFS is a filesystem layer that gives user direct command over its access control. Instead of relying on static policies or rules, it prompts the user for the access control decision via graphical interface. When a process tries to open a file, an overlay is displayed, and three options are given: to deny, temporarily allow, or forever allow access to a file.

It is user-friendly and trivially easy to use. It does not introduce any new terminology or complex access control management strategies. The graphical interface is intuitive and self-explanatory. ICFS is configured on the fly: as programs request access, the user's decisions are recorded and later reused. There is no need for any configuration besides installation and choosing a directory to control. It operates on the level of individual processes and files, ensuring high granularity. 

\iffalse

At the same time, it allows for broader, more general rules, which helps to reduce the choice fatigue of the user.

\fi

It is backwards compatible: ICFS overrides the regular system call interface using FUSE framework, which means that any software that wishes to use the files ICFS protects has to respect it's policies. Its interactivity combined with the ability to only grant permissions for the lifetime of a specific process makes proxy attacks very difficult to go unnoticed.

\subsection{Access Control Model}

As promised, the access control model of ICFS is trivially simple. It features processes as it's subjects, and files as objects. Whenever a process attempts to access a filesystem object, a dialogue is displayed with three options:

\begin{itemize}
	\item \emph{Allow}, that will allow the access to the filesystem object for this process and any other process that is started with the same executable.
	\item \emph{Allow this time}, that will allow the access to the filesystem object for the runtime of the requesting process.
	\item \emph{Deny}, that will deny all access to the filesystem object.
\end{itemize}
