Access Control

operating-systems security

Definition

Access Control

Access control is the enforcement of a security policy that determines which subjects (users, processes) may perform which operations on which objects (files, devices, resources).

Formally, an access control system consists of:

• A set of subjects $S$
• A set of objects $O$
• A set of operations (rights) $R$
• An access policy that grants or denies requests

Protection Domain

Protection Domain

A protection domain defines the set of objects a subject may access and the operations permitted on each.

A subject operates within exactly one domain at any time. The domain determines the boundaries of what the subject can do.

Domain Switching

A process may switch domains during execution. This occurs when privileges need to change, for example to access restricted resources.

Unix Domain Switching via SETUID

In Unix, a protection domain is defined by the User ID (UID) and Group ID (GID). A process switches domains by executing a file with the SETUID bit set. The process temporarily assumes the UID of the file owner, acquiring the corresponding rights.

Access Matrix

Access Matrix

The access matrix is a formal model where rows represent domains $D=\{d_1,d_2,\dots \}$ and columns represent objects $O=\{o_1,o_2,\dots \}$. Each cell $A[d_i,o_j]\subseteq R$ contains the set of access rights domain $d_i$ holds for object $o_j$.

$$A=\begin{array}{cccc}& o_1& o_2& o_3\\ d_1& \{r,w\}& \varnothing & \{x\}\\ d_2& \varnothing & \{r\}& \{r,w\}\\ d_3& \{x\}& \{r,x\}& \varnothing \end{array}$$

The matrix is typically sparse. Practical systems decompose it along one dimension.

Access Control Lists

Access Control List

An Access Control List (ACL) is a column-wise decomposition of the access matrix. Each object stores a list of $⟨\text{domain},\text{rights}⟩$ pairs.

For object $o_j$, the ACL is:

$$\text{ACL}(o_j)=\{⟨d_i,A[d_i,o_j]⟩\mid A[d_i,o_j]\ne \varnothing \}$$

Unix File ACL

A Unix file stores permissions as an ACL:

• Owner: read, write, execute
• Group: read, execute
• Others: read

Changing permissions for an object is efficient: modify only that object’s ACL.

Capability Lists

Capability List

A capability list is a row-wise decomposition of the access matrix. Each domain stores a list of $⟨\text{object},\text{rights}⟩$ pairs.

For domain $d_i$, the capability list is:

$$\text{C-list}(d_i)=\{⟨o_j,A[d_i,o_j]⟩\mid A[d_i,o_j]\ne \varnothing \}$$

File Descriptor as Capability

In Unix, a file descriptor acts as a capability. The kernel validates the descriptor on each operation; user processes cannot forge valid descriptors.

Capabilities are typically implemented as protected tokens (tickets) that cannot be forged, for example via encryption or kernel-managed references. Checking access is fast: the domain presents its capability, and the system verifies its authenticity.

Lock-Key System

Lock-Key System

In a lock-key system, each object $o_j$ has a set of locks $L_j$ (unique bit patterns), and each domain $d_i$ holds a set of keys $K_i$. Access is granted if $K_i\cap L_j\ne \varnothing$.

The lock-key mechanism provides a middle ground between ACLs and capabilities. Like capabilities, possession of a key grants authority. Like ACLs, the object maintains information (locks) about who may access it.