Access Control

Protection and the Operating System

Protection: Mechanisms that keep processes from interfering with each other or the system.
Access control: Deciding which operations subjects may perform on objects and enforcing those decisions.
Security policy: The rules that state who may do what to which resources.
Trusted computing base: The components whose failure means the security of the whole system fails.
Cooperative multitasking: Scheduling in which a program keeps the processor until it yields voluntarily.
Preemptive multitasking: Scheduling in which a hardware timer forces control back to the kernel.
Memory management unit: Hardware that translates virtual addresses and enforces memory access permissions.
Virtual address: The address a program uses, translated by hardware to a physical location.
Page table: The kernel-maintained mapping from a process’s virtual pages to physical memory.
Page fault: A processor exception caused by accessing a page that is not currently mapped or by violating its access permissions.
User mode: The processor mode in which privileged instructions and kernel memory are forbidden.
Kernel mode: The processor mode that allows the operating system to execute privileged instructions.
Privilege level: A processor mode that determines which instructions and memory a program may use.
Protection rings: Numbered processor privilege levels, with lower numbers more privileged.
Hypervisor: Software below the kernel that hosts several operating systems on one machine.
Trap: A forced transfer of control from a user process into the kernel.
System call: A deliberate request by a program for a service that only the kernel provides.
Fault: A processor exception raised when an instruction cannot complete without kernel intervention.
Hardware interrupt: A signal from a device or timer that transfers control to the kernel.
Reference monitor: The component that checks every access against the policy before allowing it.

Subjects, Objects, and the Access Matrix

Principal: An entity, such as a user, to which the system attributes actions.
Subject: An active entity, usually a process, that requests access to objects.
Object: A passive resource, such as a file or device, that subjects operate on.
Right: A permitted operation, such as read or write, on an object.
Identification: Claiming an identity, such as by typing a user name.
Authentication: Verifying that a claimed identity is genuine.
Authorization: Deciding what an authenticated identity is permitted to do.
Access matrix: A table of rights with a row per subject and a column per object.
Protection domain: The set of objects and rights available to a subject at one time.
Domain transfer: Switching a subject into a different protection domain, as a setuid program does.
Access control list: The rights for one object, stored with the object, listing who may do what.
Capability: An unforgeable token that both names an object and grants rights to it.
Capability list: The rights for one subject, stored with the subject, listing what it may access.
Confused deputy: A privileged program tricked into using its authority on behalf of a less-privileged caller.

Discretionary and Mandatory Control

Discretionary access control: A policy in which the owner of an object decides who may access it.
Mandatory access control: Organization-defined rules that the system enforces regardless of the owner’s wishes.

Unix File Permissions

Inode: The on-disk record that holds a file’s metadata, including its permission bits.
Owner: The user account recorded as a file’s owner, with authority to change its discretionary permissions.
Group: A named set of users that permission bits or rights can be granted to.
Everyone else: The permission set that applies to users who are neither owner nor group member.
Read permission: The right to view a file’s contents or list a directory’s names.
Write permission: The right to change a file or to create, delete, or rename directory entries.
Execute permission: The right to run a file as a program or to traverse a directory.
Sticky bit: A directory flag that restricts deletion and renaming to the file’s owner, the directory’s owner, or a privileged process.
Umask: A per-process value that removes permission bits from newly created files.

Users, Groups, and Root

User ID: The number by which the kernel identifies a user.
Root: The Unix user with ID 0, whose processes can bypass most discretionary permission checks.
Real user ID: The identity of the user who started a process.
Effective user ID: The identity the kernel uses when checking a process’s permissions.
Saved user ID: A copy of a privileged identity kept so a process can regain it later.
Setuid: A program-file bit that sets the executing process’s effective user ID to the file owner’s ID.
Setgid: A program-file bit that sets the executing process’s effective group ID to the file’s group ID.
Time-of-check to time-of-use: A flaw in which a resource changes between a permission check and its use.

Least Privilege and Privilege Separation

Principle of least privilege: Giving each component only the rights it needs for its task.
Privilege separation: Dividing a program so that only a small part runs with privilege.
Attack surface: The code and interfaces that an attacker can reach and attempt to exploit.

Full Access Control Lists

Access control entry: One ACL line naming a user or group and the rights granted or denied.
Extended attribute: Additional metadata attached to a file outside its contents, used for information such as ACLs.
Mask: A POSIX ACL entry that limits the permissions granted by named-user entries and all group entries.
Default ACL: A directory ACL used to determine the initial permissions of files and subdirectories created inside it.
Deny entry: An ACL entry that explicitly denies specified rights to a user or group.
Inheritance: Passing selected ACL entries from a parent directory to newly created files or subdirectories.

Multilevel Security and Bell-LaPadula

Multilevel security: Protecting information at several sensitivity levels on one system.
Bell-LaPadula model: A formal confidentiality model with no read up and no write down.
Classification: The sensitivity level assigned to an object.
Clearance: The highest classification level at which a user is authorized to operate.
Label: The level and compartments attached to a subject or object for mandatory checks.
Simple security property: No read up: a subject may read only objects at or below its level.
Star property: No write down: a subject may write only objects at or above its level.
Discretionary security property: Ordinary permissions still apply within the limits set by the labels.
Trusted subject: A program exempt from the star property so it can declassify or sanitize.
Compartment: A category of information, such as information about a specific project.
Need to know: Restricting access to information required for a person’s work, in addition to requiring the appropriate clearance.
Multilateral security: Separating information by compartment as well as by level.
Dominate: One label dominates another if its level is at least as high and its compartment set contains every compartment in the other’s.
Incomparable: Two labels of which neither dominates the other.
Lattice: The structure formed by security labels ordered by dominance, which can be represented as a directed graph.
Sensitive Compartmented Information: U.S. classified intelligence information subject to additional compartment-based access controls.

The Biba Integrity Model

Biba model: An integrity model with no write up and no read down.
Integrity level: A label ranking how trustworthy a subject or object is.
No write up: A subject may not modify objects more trusted than itself.
No read down: A subject may not read objects less trusted than itself.
Mandatory Integrity Control: The Windows mechanism that enforces Biba’s no write up on processes and objects.

The Chinese Wall Model

Chinese Wall model: A model preventing conflicts of interest by tracking what a subject has read.
Company dataset: All the information a firm holds about one client in the Chinese Wall model.
Conflict of interest class: A set of company datasets belonging to competitors.
Sanitized data: Information altered so that it cannot be traced to its source company and can be shared without creating a conflict.
Separation of duties: Requiring more than one person to complete a sensitive task.

Type Enforcement

Type enforcement: An access matrix over classes, with domains as rows and types as columns.
Domain: A class of subjects in type enforcement.
Type: A class of objects in type enforcement.
Default deny: Refusing any operation that no rule explicitly allows.
SELinux: The Linux implementation of type enforcement, layered above Unix permissions.

Role-Based Access Control

Role-based access control: Granting permissions to roles and assigning users to roles.
Role: A named set of permissions associated with a job or responsibility.
Permission: A right to perform an operation on an object.
Session: The period during which a user has some of their roles active.
Role explosion: The failure in which roles multiply until they are harder to audit than permissions.
Attribute-based access control: Rules that test attributes of the subject, object, and environment.