A FIREWALL MODEL OF FILE SYSTEM SECURITY