Editing Confused deputy problem (section)

== Example ==
In the original example of a confused deputy,<ref>{{cite web|title=The Confused Deputy (or why capabilities might have been invented)|url=http://www.cis.upenn.edu/~KeyKOS/ConfusedDeputy.html|url-status=dead|access-date=2003-12-31|archiveurl=https://web.archive.org/web/20031205034929/http://www.cis.upenn.edu/~KeyKOS/ConfusedDeputy.html|archivedate=2003-12-05}}</ref> there was a [[compiler]] program provided on a commercial [[Time-sharing|timesharing]] service. Users could run the compiler and optionally specify a filename where it would write debugging output, and the compiler would be able to write to that file if the user had permission to write there.

The compiler also collected statistics about language feature usage. Those statistics were stored in a file called "(SYSX)STAT", in the directory "SYSX". To make this possible, the compiler program was given permission to write to files in SYSX.

But there were other files in SYSX: in particular, the system's billing information was stored in a file "(SYSX)BILL".  A user ran the compiler and named "(SYSX)BILL" as the desired debugging output file.

This produced a confused deputy problem. The compiler made a request to the [[operating system]] to open (SYSX)BILL. Even though the user did not have access to that file, the compiler did, so the open succeeded. The compiler wrote the compilation output to the file (here "(SYSX)BILL") as normal, overwriting it, and the billing information was destroyed.

=== The confused deputy ===
In this example, the compiler program is the deputy because it is acting at the request of the user. The program is seen as 'confused' because it was tricked into overwriting the system's billing file.

Whenever a program tries to access a file, the operating system needs to know two things: which file the program is asking for, and whether the program has permission to access the file. In the example, the file is designated by its name, “(SYSX)BILL”. The program receives the file name from the user, but does not know whether the user had permission to write the file. When the program opens the file, the system uses the program's permission, not the user's. When the file name was passed from the user to the program, the permission did not go along with it; the permission was increased by the system silently and automatically.

It is not essential to the attack that the billing file be designated by a name represented as a string. The essential points are that:
* the designator for the file does not carry the full authority needed to access the file;
* the program's own permission to access the file is used implicitly.