ACLs make it much easier to specify who has access to your files. Some programs will be unaware of ACLs, the implementation does not generally require that they do. A file's ACL may be set when it's created, if the containing directory has a default ACL.

Auditing is constantly in effect on most Trusted IRIX/CMW systems. This is not a cause for user concern, as the purpose of the audit trail is to discern intentional violations of security by malicious intruders, not to spy on legitimate users.

It is possible to grant a user certain capabilities which have formerly been researved for the Superuser. It is also possible (and in fact, required in the CMW configuration) that userid 0 (root) does not have special privilege.

It is possible (though not desirable) to create a higher MAC-labeled file in a lower MAC-labeled directory. This file, of course, would not be visible to you at a lower MAC label. Correspondingly, you would be unable to remove this file and it could consume an arbitrary amount of your disk quota until your Administrator removes or downgrades the file.

A given piece of mail is only readable if it matches your current MAC label. Mail sent to you at a higher MAC label is unreadable until you log in at that label. Indeed, because of these constraints, you would be unaware that you even had mail addressed to you at this higher MAC label. The side effect is analogous to someone placing a higher MAC-labeled file in one of your directories. This higher MAC label mail can consume an arbitrary amount of your disk resources. Mail sent to you outside your label range will not be accessible at any time.

If someone sends you mail outside of your allowed clearances, that mail is not delivered. Mail that you send will not be delivered if your current label is outside the label range of the recipient. For example, if you are logged in at system high privilege, and the recipient has only user privilege, mail sent to that user will be rejected.

One of the constraints of using a secure system is that access to information is restricted by the user's privileges. Multilevel directories (explained in the section above) are one facet of such a system.

The strictures on passwords in Trusted IRIX/CMW are not limited to the content of the password. The Administrator can set a minimum and a maximum amount of time for the use of a given password. It is quite possible that you would wish to login and be unable to do so because your password had expired if you ignored the warnings to change it.

Trusted IRIX/CMW comes equipped with a password generation program. When you attempt to change your password, this program presents you with several options for your new password. You must choose one of these passwords or choose not to change your password. This feature can be defeated by your Administrator, in which case you are free to select your own password, subject to certain triviality tests.