Syracuse University Lecture Notes for CIS/CSE 785: Computer Security
Access Control
(1) Overview of Access Control
What is access control
¾ The ability to allow only authorized users, programs or processes system or resource
access
¾ The granting or denying, according to a particular security model, of certain permissions
to access a resource
¾ An entire set of procedures performed by hardware, software and administrators, to
monitor access, identify users requesting access, record access attempts, and grant or
deny access based on pre-established rules.
¾ Access control is the heart of security
Access Control Models (based on how security policies are managed)
¾ Discretionary Access Control (DAC)
¾ Mandatory Access Control (MAC)
¾ Role-Based Access Control (RBAC): will discuss this later.
DAC: Discretionary Access Control
¾ Definition: An individual user can set an access control mechanism to allow or deny
access to an object.
¾ Relies on the object owner to control access.
¾ DAC is widely implemented in most operating systems, and we are quite familiar with it.
¾ Strength of DAC:
Flexibility: a key reason why it is widely known and implemented in mainstream
operating systems.
¾ Limitation of DAC:
Global policy: DAC let users to decide the access control policies on their data,
regardless of whether those policies are consistent with the global policies. Therefore,
if there is a global policy, DAC has trouble to ensure consistency.
Information flow: information can be copied from one object to another, so access to
a copy is possible even if the owner of the original does not provide access to the
original copy. This has been a major concern for military.
Malicious software: DAC policies can be easily changed by owner, so a malicious
program (e.g., a downloaded untrustworthy program) running by the owner can
change DAC policies on behalf of the owner.
Flawed software: Similarly to the previous item, flawed software can be “instructed”
by attackers to change its DAC policies.
MAC: Mandatory Access Control
¾ Definition: A system-wide policy decrees who is allowed to have access; individual user
cannot alter that access.
¾ Relies on the system to control access.
¾ Examples:
The law allows a court to access driving records without the owners' permission.
¾ Traditional MAC mechanisms have been tightly coupled to a few security models.
Wenliang Du Access Control: Page 1 of 3 2/28/2007
Syracuse University Lecture Notes for CIS/CSE 785: Computer Security
¾ Recently, systems supporting flexible security models start to appear (e.g., SELinux,
Trusted Solaris, TrustedBSD, etc.)
(2) Access Control Methods
Access Control Matrices
¾ Disadvantage:
In a large system, the matrix will be enormous in size and mostly sparse.
Access Control List
¾ The column of access control matrix.
¾ Advantage:
Easy to determine who can access a given object.
Easy to revoke all access to an object
¾ Disadvantage:
Difficult to know the access right of a given subject.
Difficult to revoke a user's right on all objects.
¾ Used by most mainstream operating systems.
Capability List
¾ The row of access control matrix.
¾ A capability can be thought of as a pair (x, r) where x is the name of an object and r is a
set of privileges or rights.
¾ Advantage:
Easy to know the access right of a given subject.
Easy to revoke a user’s access right on all objects.
¾ Disadvantage:
Difficult to know who can access a given object.
Difficult to revoke all access right to an object.
¾ A number of capability-based computer systems were developed, but have not proven to
be commercially successful.
Wenliang Du Access Control: Page 2 of 3 2/28/2007
Syracuse University Lecture Notes for CIS/CSE 785: Computer Security
(3) Access Control List Examples
UNIX ACL
¾ Abbreviations of Access Control Lists:
Three classes: owner, group, other users
Suffer from a loss of granularity
¾ Full Access Control Lists
¾ Abbreviations of ACLs are ignored when root is the subject, but the full-blown ACL
apply even to root (In Solaris).
Windows NT
¾ Generic rights: No access, Read, Change, Full control.
¾ Built-in Groups (each has different privileges)
Everyone: all users
Interactive: users logged on locally
Network: users logged on over the network
System: the operating system
Creator / Owner: creator or owner of a file or a resource
How is the ACL implemented in Minix?
¾ Where to store the access control list? (Must be in a safe place)
¾ ACL is saved in the I-node data structure in Minix (in i_mode).
¾ I-node data structure:
EXTERN struct inode {
mode_t i_mode; /* file type, protection, etc. */ /* 16 bits */
nlink_t i_nlinks; /* how many links to this file */
uid_t i_uid; /* user id of the file's owner */
gid_t i_gid; /* group number */
off_t i_size; /* current file size in bytes */
time_t i_atime; /* time of last access (V2 only) */
time_t i_mtime; /* when was file data last changed */
time_t i_ctime; /* when was inode itself changed (V2 only)*/
zone_t i_zone[10]; /* zone numbers for direct, ind, and dbl ind */
…
} inode[NR_INODES];
Wenliang Du Access Control: Page 3 of 3 2/28/2007