permissions must be set to restrict access to Bob's files—otherwise, the update daemon could directly read Bob's files and transmit them over the network. In Unix, Bob's files would be protected either by setting file permission bits to 0600 or by running the update daemon in a chroot jail. In HiStar, labels can achieve equivalent results.