The Lifecycle of an Access Request

In this lesson, you will learn how an access request travels from your command line down into the kernel to reach a final security verdict.

When you attempt to access a file—such as running cat /etc/shadow—the request initiates a fascinating journey through the kernel’s architecture. This process ensures that every bit of data is protected by the system's security policies before it is ever returned to the user.

1. The User Space Trigger

Everything starts in User Space when a process makes a system call, such as open(). At this moment, the process provides the path to the file it wants to access.

2. The Virtual File System (VFS) Layer

The request enters the VFS, which acts as the kernel's "traffic controller." Because Linux supports many different filesystems (ext4, XFS, NFS), the VFS provides a unified interface so the system doesn't need to know the specifics of the storage format yet. It translates your open() call into a standard operation directed at the specific file object (the inode).

3. The Security Module Hook

Before the VFS actually interacts with the underlying filesystem driver, it pauses to consult the Linux Security Module (LSM) framework (like SELinux or AppArmor). This is the "Security Checkpoint." The kernel triggers a hook—a function that asks the security module: "Does this specific user have permission to perform this action on this specific object?"

/* Simplified conceptual flow */
int vfs_open(const struct path *path, struct file *file) {
    // 1. Security check initiated by LSM hook
    error = security_file_open(file, mask);
    
    // 2. If error is 0, proceed to filesystem driver
    if (!error)
        return do_dentry_open(file, path->dentry, ...);
    
    return error; // Access Denied
}

4. The Verdict

• If approved: The kernel grants the process a file descriptor, allowing data to flow from the storage device back to the user.
• If denied: The security module returns an error (like -EACCES), and the VFS stops the request immediately, ensuring no unauthorized data ever reaches the requesting process.

Key Takeaway: An access request is a regulated journey where the VFS handles the logistics of the file, but the LSM provides the final authority before any data is revealed.