Access control list




An access control list (ACL), with respect to a computer file system, is a list of permissions attached to an object. An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects.[1] Each entry in a typical ACL specifies a subject and an operation. For instance, if a file object has an ACL that contains (Alice: read,write; Bob: read), this would give Alice permission to read and write the file and Bob to only read it.




Contents






  • 1 Implementations


    • 1.1 Filesystem ACLs


    • 1.2 Networking ACLs


    • 1.3 SQL implementations




  • 2 Comparing with RBAC


  • 3 See also


  • 4 References


  • 5 Further reading





Implementations


Many kinds of systems implement ACLs, or have a historical implementation.



Filesystem ACLs


A filesystem ACL is a data structure (usually a table) containing entries that specify individual user or group rights to specific system objects such as programs, processes, or files. These entries are known as access-control entries (ACEs) in the Microsoft Windows NT,[2]OpenVMS, Unix-like, and Mac OS X operating systems. Each accessible object contains an identifier to its ACL. The privileges or permissions determine specific access rights, such as whether a user can read from, write to, or execute an object. In some implementations, an ACE can control whether or not a user, or group of users, may alter the ACL on an object.


Most of the Unix and Unix-like operating systems (e.g. Linux,[3]BSD, or Solaris) support POSIX.1e ACLs, based on an early POSIX draft that was withdrawn in 1997. Many of them, for example AIX, FreeBSD,[4]Mac OS X beginning with version 10.4 ("Tiger"), or Solaris with ZFS filesystem,[5] support NFSv4 ACLs, which are part of the NFSv4 standard. There are two experimental implementations of NFSv4 ACLs for Linux: NFSv4 ACLs support for Ext3 filesystem[6] and the more recent Richacls,[7]
which brings NFSv4 ACLs support for Ext4 filesystem.


PRIMOS featured ACLs at least as early as 1984.[8]


In the 1990s the ACL and RBAC models were extensively tested[by whom?] and used to administer file permissions.



Networking ACLs


On some types of proprietary computer-hardware (in particular routers and switches), an access control list provides rules that are applied to port numbers or IP addresses that are available on a host or other layer 3, each with a list of hosts and/or networks permitted to use the service. Although it is additionally possible to configure access control lists based on network domain names, this is a questionable idea because individual TCP, UDP, and ICMP headers do not contain domain names. Consequently, the device enforcing the access control list must separately resolve names to numeric addresses. This presents an additional attack surface for an attacker who is seeking to compromise security of the system which the access control list is protecting. Both individual servers as well as routers can have network ACLs. Access control lists can generally be configured to control both inbound and outbound traffic, and in this context they are similar to firewalls. Like firewalls, ACLs could be subject to security regulations and standards such as PCI DSS.



SQL implementations


ACL algorithms have been ported to SQL and to relational database systems. Many "modern" (2000s and 2010s) SQL-based systems, like enterprise resource planning and content management systems, have used ACL models in their administration modules.



Comparing with RBAC


The main alternative to the ACL model is the role-based access control (RBAC) model. A "minimal RBAC model", RBACm, can be compared with an ACL mechanism, ACLg, where only groups are permitted as entries in the ACL. Barkley (1997)[9] showed that RBACm and ACLg are equivalent.


In modern SQL implementations, ACL also manage groups and inheritance in a hierarchy of groups. So "modern ACLs" can express all that RBAC express, and are notably powerful (compared to "old ACLs") in their ability to express access control policy in terms of the way in which administrators view organizations.


For data interchange, and for "high level comparisons", ACL data can be translated to XACML.[10]



See also



  • Cacls

  • Capability-based security

  • C-list

  • Confused deputy problem

  • DACL


  • Role-based access control (RBAC)



References





  1. ^ .mw-parser-output cite.citation{font-style:inherit}.mw-parser-output q{quotes:"""""""'""'"}.mw-parser-output code.cs1-code{color:inherit;background:inherit;border:inherit;padding:inherit}.mw-parser-output .cs1-lock-free a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/6/65/Lock-green.svg/9px-Lock-green.svg.png")no-repeat;background-position:right .1em center}.mw-parser-output .cs1-lock-limited a,.mw-parser-output .cs1-lock-registration a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/d/d6/Lock-gray-alt-2.svg/9px-Lock-gray-alt-2.svg.png")no-repeat;background-position:right .1em center}.mw-parser-output .cs1-lock-subscription a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/a/aa/Lock-red-alt-2.svg/9px-Lock-red-alt-2.svg.png")no-repeat;background-position:right .1em center}.mw-parser-output .cs1-subscription,.mw-parser-output .cs1-registration{color:#555}.mw-parser-output .cs1-subscription span,.mw-parser-output .cs1-registration span{border-bottom:1px dotted;cursor:help}.mw-parser-output .cs1-hidden-error{display:none;font-size:100%}.mw-parser-output .cs1-visible-error{font-size:100%}.mw-parser-output .cs1-subscription,.mw-parser-output .cs1-registration,.mw-parser-output .cs1-format{font-size:95%}.mw-parser-output .cs1-kern-left,.mw-parser-output .cs1-kern-wl-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right,.mw-parser-output .cs1-kern-wl-right{padding-right:0.2em}
    RFC 4949


  2. ^ "Managing Authorization and Access Control". Microsoft Technet. 2005-11-03. Retrieved 2013-04-08.


  3. ^ "Red Hat Enterprise Linux AS 3 Release Notes (x86 Edition)". Red Hat. 2003. Retrieved 2013-04-08. EA (Extended Attributes) and ACL (Access Control Lists) functionality is now available for ext3 file systems. In addition, ACL functionality is available for NFS.


  4. ^ "NFSv4 ACLs". FreeBSD. 2011-09-12. Retrieved 2013-04-08.


  5. ^ "Chapter 8 Using ACLs and Attributes to Protect ZFS Files". Oracle Corporation. 2009-10-01. Retrieved 2013-04-08.


  6. ^ Grünbacher, Andreas (May 2008). "Native NFSv4 ACLs on Linux". SUSE. Archived from the original on 2013-06-20. Retrieved 2013-04-08.


  7. ^ Grünbacher, Andreas (July–September 2010). "Richacls - Native NFSv4 ACLs on Linux". bestbits.at. Retrieved 2013-04-08.


  8. ^
    "P.S.I. Pacer Software, Inc. Gnet-II revision 3.0". Communications. Computerworld. 18 (21). 1984-05-21. p. 54. ISSN 0010-4841. Retrieved 2017-06-30. The new version of Gnet-II (revision 3.0) has added a line-security mechanism which is implemented under the Primos ACL subsystem.


  9. ^ J. Barkley (1997) "Comparing simple role based access control models and access control lists", In "Proceedings of the second ACM workshop on Role-based access control", pages 127-132.


  10. ^ G. Karjoth, A. Schade and E. Van Herreweghen (2008) "Implementing ACL-based Policies in XACML", In "2008 Annual Computer Security Applications Conference".




Further reading


.mw-parser-output .refbegin{font-size:90%;margin-bottom:0.5em}.mw-parser-output .refbegin-hanging-indents>ul{list-style-type:none;margin-left:0}.mw-parser-output .refbegin-hanging-indents>ul>li,.mw-parser-output .refbegin-hanging-indents>dl>dd{margin-left:0;padding-left:3.2em;text-indent:-3.2em;list-style:none}.mw-parser-output .refbegin-100{font-size:100%}



  • Rhodes, Tom. "File System Access Control Lists (ACLs)". FreeBSD Handbook. Retrieved 2013-04-08.


  • Michael Fox; John Giordano; Lori Stotler; Arun Thomas (2005-08-24). "SELinux and grsecurity: A Case Study Comparing Linux Security Kernel Enhancements" (PDF). University of Virginia. Archived from the original (PDF) on 2012-02-24. Retrieved 2013-04-08.


  • Hinrichs, Susan (2005). "Operating System Security". CyberSecurity Spring 2005. University of Illinois. Retrieved 2013-04-08.


  • Mitchell, John. "Access Control and Operating System Security" (PDF). Stanford University. Retrieved 2013-04-08.


  • Clarkson, Michael. "Access Control". Cornell University. Retrieved 2013-04-08.


  • Klein, Helge (2009-03-12). "Permissions: A Primer, or: DACL, SACL, Owner, SID and ACE Explained". Retrieved 2013-04-08.


  • "Access Control Lists". MSDN Library. 2012-10-26. Retrieved 2013-04-08.


  • "How Permissions Work". Microsoft Technet. 2003-03-28. Retrieved 2013-04-08.









Comments

Post a Comment

Popular posts from this blog

Information security

Image
This article is part of a series on Information security Related security categories Internet security Cyberwarfare Computer security Mobile security Network security Threats Computer crime Vulnerability Eavesdropping Malware Spyware Ransomware Trojans Viruses Worms Rootkits Bootkits Keyloggers Screen scrapers Exploits Backdoors Logic bombs Payloads Denial of service Defenses Computer access control Application security Antivirus software Secure coding Secure by default Secure by design Secure operating systems Authentication Multi-factor authentication Authorization Data-centric security Encryption Firewall Intrusion detection system Mobile secure gateway Runtime application self-protection (RASP) v t e Information security , sometimes shortened to InfoSec , is the practice of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction of information. Th...
Read more

Lambak Kiri

Image
For Lambak Kiri public housing area, see Lambak Kiri Landless Indigenous Citizens' Housing Scheme. Village in Brunei-Muara, Brunei Lambak Kiri Village Location in Brunei Coordinates: 4°59′26″N 114°57′04″E  /  4.990472°N 114.951114°E  / 4.990472; 114.951114 Coordinates: 4°59′26″N 114°57′04″E  /  4.990472°N 114.951114°E  / 4.990472; 114.951114 Country Brunei District Brunei-Muara Mukim Berakas A Government  • Village head Hamdani Omar Postcode BB1214 Lambak Kiri is a populated place in Brunei-Muara District, Brunei. It is officially a village subdivision under Berakas A, a mukim in the district. Lambak Kiri may also refer to the greater area which includes the Lambak Kiri public housing area of the Landless Indigenous Citizens' Housing Scheme (Malay: Skim Tanah Kurnia Rakyat Jati ), although the latter is a separate subdivision. Contents 1 Name 2 Administration 3 See also 4 References Name ...
Read more

章鱼与海女图

Image
本条目 可参照英語維基百科相應條目来扩充 。 （2014/5/25） 若您熟悉来源语言和主题，请协助参考外语维基扩充条目。请勿直接提交机械翻译，也不要翻译不可靠、低品质内容。依版权协议，译文需在编辑摘要注明来源，或于讨论页顶部标记 {{Translated page}} 标签。 本条目 需要擴充。 （2013年8月15日） 请協助改善这篇條目，更進一步的信息可能會在討論頁或扩充请求中找到。请在擴充條目後將此模板移除。 《 章鱼与海女 》（日语： 蛸と海女 ／ たことあま   Tako to ama ）是一幅由日本畫家葛饰北斋创作的浮世绘，出自1814年（文化4年）出版的艳本《喜能会之故真通》（日语： 喜能会之故真通 ／ きのえのこまつ   Kinoe no Komatsu ）。畫中有兩隻章鱼以觸手攻擊一名採珠的海女，並進行擬似戀獸癖的交媾行為。作品尺寸为6½" × 8¾" （16.51 cm × 22.23 cm）。 [1] 在此之前的类似作品还有北尾重政的艳本《謡曲色番組》及勝川春潮的艳本《艳本千夜多女志》等，有被北斋作为参考的可能性。 《章鱼与海女图》有不同英文翻译，一般称The Dream of the Fisherman's Wife，又作Girl Diver and Octopi、Diver and Two Octopi，Richard Douglas Lane称其为 Girl Diver and Octopi [2] ，Mathi Forrer 称其为 Pearl Diver and Two Octopi [3] ，Danielle Talerico 称其为 Diver and Two Octopi 。 [4] 目录 1 作品介绍 1.1 画中对话 1.2 解释 2 评价 3 影响 3.1 模仿作品 4 另见 5 参考来源 6 外部連結 作品介绍 画中对话 原文 译文 大蛸： いつぞハいつぞハとねらいすましてゐたかいがあつて、けふといふけふ、とうとうとらまへたア。てもむつくりとしたいいぼぼだ。いもよりハなをこうぶつだ。サアサア、すつてすつてすいつくして...
Read more