File Access Permissions in MS-DOS 6.22 Networks

MS-DOS 6.22 lacks a native user permission model, meaning it cannot independently enforce security restrictions, user access control lists (ACLs), or multi-user ownership on local or networked files. When accessing files over a local area network, the operating system relies entirely on redirector drivers—such as the Microsoft Network Client, LAN Manager, or Novell NetWare VLM/NETX—to pass file system requests to a remote host. The remote file server enforces the actual security policies, while MS-DOS acts purely as a client that translates local system calls and server-side permission rejections into standard DOS error codes.

The Redirector Architecture and Interrupt Interception

Under MS-DOS 6.22, local file operations execute through Interrupt 21h (DOS API). To support network drive mappings, networking suites install a terminate-and-stay-resident (TSR) program known as a Network Redirector.

The redirector hooks into the MS-DOS kernel via the DOS Redirector Interface (Interrupt 2Fh, Function 11h). When an application requests a file action on a mapped drive letter (such as X:\), the DOS kernel determines that the target drive belongs to a remote device and routes the call to Interrupt 2Fh. The redirector intercepts the standard DOS system call, packages it into a network protocol packet (such as NetBIOS Frames, SMB, or Novell's NCP), and transmits the request over the network adapter to the host server.

Server-Side Permission Enforcement

Because MS-DOS 6.22 has no internal concept of file security beyond standard FAT attributes (Read-Only, Hidden, System, and Archive), authorization occurs entirely on the remote file server (such as Windows NT, Novell NetWare, or Unix running Samba):

  1. Authentication: The user logs in via a networking client utility before mounting drives. The server verifies these credentials and attaches a security context (UID, SID, or NetWare trustee rights) to that client's network connection.
  2. Access Control Evaluation: When the MS-DOS redirector requests a file open, read, write, or delete operation, the host server checks the user's rights against the server's native file system access control lists.
  3. Execution or Rejection: If the server permits the operation, it performs the requested disk action and returns a success status back to the redirector. If the action violates server-side permissions (e.g., attempting to write to a directory where the user only has read permissions), the server returns a network protocol-level access violation.

Error Translation and Status Codes

MS-DOS cannot process complex remote access errors, such as specific missing ACL tokens or Unix permission bits. When a remote server rejects an operation, the network redirector driver intercepts the network error and maps it to a standard MS-DOS extended error code.

In the vast majority of permission conflicts, the redirector returns standard DOS Error 05h (ERROR_ACCESS_DENIED). From the perspective of the application or the user running MS-DOS 6.22, attempting to modify an unauthorized network file results in the standard prompt: Access denied.

Handling File Attributes Across the Network

MS-DOS 6.22 applications frequently inspect or modify the 8-bit FAT attribute byte. Network redirectors bridge this interface by mapping remote permissions to standard DOS attributes:

  • Read-Only Attribute: If a server's security rules forbid a user from writing to or deleting a file, the redirector frequently synthesizes the DOS Read-Only (01h) attribute flag when reporting file details back to Interrupt 21h Function 43h (Get/Set File Attributes).
  • Attribute Alterations: If a user attempts to strip the Read-Only attribute using the DOS ATTRIB -R command on a network file where they lack administrative or modify privileges, the server denies the underlying attribute update, and the DOS command fails with an access denied error.

Through this separation of duties, MS-DOS 6.22 maintains full compatibility with simple FAT-style software while fully adhering to advanced, multi-user access permissions defined by the remote host.