A Formal Model for UNIX Setuid. - Timothy E. Levin; S. J. Padilla; Cynthia E. Irvine (S&P, 1989)