Index > Course > 2021-02-15: Discretionary Access Control
There are a number of things due this week. There are a number of things due next week. Prof. will not tell you exactly what, or when, or where exactly to check. Good luck!
Data owners have discretion to assign/allow/restrict access to data.
MULTICS = Multiplexed Information and Computing Service. The access control system of MULTICS inspired modern access control schemes, and pioneered the idea of rings. RuBAC = Rules based access control.
Subjects request action on an object:
The owner of the file may set the access control matrix: Lookup(Subject, Object), returns the allowed actions.
An ACL is just a list. If every object needs an ACL, and every ACL is a list, well that’s pretty heavy.
An ACL is defined on the file - who has what access level.
A Capability List is defined on the subject - what things do they have access to.
Access Tokens: contain information about the user
Sceurity Descriptors: list of who can do what with the thing, how to audit attempts w/ the object. Applied to securable objects.
A successful logon creates a new access token, which is copied into every process started by that user. On the NTFS filesystem, files have a security header where the security descriptor lives.
If the Discretionary Access Control list (DACL) isn’t specified, then it fails open - everyone can access.
There are three types of access control entries (ACEs):
An explicit deny ACE overrides an explicit allow ACE. Ace’s contain a few things, including the SID it applies to. SIDs are made of a few fields.
Discussion post 1 due Saturday
Next Source Summary due Saturday