Data Protection and Security

V

Access Control

V.II

Unix and Windows NT Access Control Overview

Unix Access Control:

In Unix, access control policies are expressed in ACLs with three operations (read, write and execute). Since peripheral devices are represented by special files, there are two types of objects, files and directories. The second type of subject, processes when started by a user inherit the user's access rights.

Another technique to simplify storing and managing access control information is to use the concept of groups to manage the access rights of large sets of subjects simultaneously. In Unix, each user belongs to at least one group.

The data structure stored for each user, process and file is shown below. Each file carries nine permission bits. The first three specify whether "read", "write" and "execute" access is granted if the process user ID matches the file owner ID. Otherwise, if one of the group IDs of the process matches the file group ID, the second bit triplet determines access. If this is also not the case, the final three bits are used. This way ACL for each file is compressed to nine bits only.

User:

Process:

File:

It is a common practice to interpret access operations differently on the type of object. In the case of directories, the access operations take the following meanings:

read: list directory contents
write: create or rename a file in the directory
execute: search the directory

The name of a file in a directory that grants execute/search access, but does not grant read access, can be used like a password to reach the content of that file, because the file can only be accessed by users who know its name. The following animation demonstrates how this can be performed in a Unix machine.

NOTE: In Unix, the permission bits of a file can be changed only by the owner of the file (and by the root who has the full access). This is done with the chmod command. The animation above also illustrates how to use this command. You can learn more by reading the manual page of this command by typing man chmod.

The tenth access control bit called "sticky bit" is useful for the following purpose. In Unix, write access to a directory is sufficient to remove any file and empty subdirectories in that directory. This rule applies independent of the access permissions of what is removed. However one version of Unix (Berkeley Unix) uses sticky bit so that if it is set for a directory, then only the owner of a file in that directory can remove it, others even when they have a write access, can not remove that file.

Animation V.II-I: Access rights animation. [click to enlarge]

V.II.II Q

V.II.III Q