Towards analyzing complex operating system access control configurations