Discretionary access control

In computer security, discretionary access control (DAC) is a kind of access control defined by the Trusted Computer System Evaluation Criteria[1] "as a means of restricting access to objects based on the identity of subjects and/or groups to which they belong. The controls are discretionary in the sense that a subject with a certain access permission is capable of passing that permission (perhaps indirectly) on to any other subject (unless restrained by mandatory access control)".

Discretionary access control is commonly discussed in contrast to mandatory access control (MAC, sometimes termed non-discretionary access control). Occasionally a system as a whole is said to have "discretionary" or "purely discretionary" access control as a way of saying that the system lacks mandatory access control. On the other hand, systems can be said to implement both MAC and DAC simultaneously, where DAC refers to one category of access controls that subjects can transfer among each other, and MAC refers to a second category of access controls that imposes constraints upon the first.

Contents

Implementations

The meaning of the term in practice is not as clear-cut as the definition given in the TCSEC standard, because TCSEC definition of DAC does not impose implementation concept. Because of this, there are at least two implementations: with owner (as widespread example) and with capabilities (as upcoming).[2]

With owner

The term DAC is commonly used in contexts that assume that every object has an owner that controls the permissions to access the object, probably because many systems do implement DAC using the concept of an owner. But the TCSEC definition does not say anything about owners, so technically an access control system doesn't have to have a concept of owner to meet the TCSEC definition of DAC.

Users (owners) have under this DAC implementation the ability to make policy decisions and/or assign security attributes. A straightforward example is the Unix file mode which represent write, read, and execute in each of the 3 bits for each of User, Group and Others. (It is prepended by another byte that indicates additional characteristics).

With capabilities

As another example, capability systems are sometimes described as providing discretionary controls because they permit subjects to transfer their access to other subjects, even though capability-based security is fundamentally not about restricting access "based on the identity of subjects" (capability systems do not, in general, allow permissions to be passed "to any other subject"; the subject wanting to pass its permissions must first have access to the receiving subject, and subjects do not generally have access to all subjects in the system).

See also

References

  1. ^ Trusted Computer System Evaluation Criteria. United States Department of Defense. December 1985. DoD Standard 5200.28-STD. http://www.radium.ncsc.mil/tpep/library/rainbow/5200.28-STD.html. 
  2. ^ http://fedoraproject.org/wiki/Features/RemoveSETUID – Fedora 15 set to remove SETUID in favor of (Linux kernel) capabilities

Wikimedia Foundation. 2010.

Look at other dictionaries:

  • Discretionary Access Control — (DAC) oder Benutzerbestimmbare Zugriffskontrolle ist ein Sicherheitskonzept für IT Systeme. Hierbei wird die Entscheidung, ob auf eine Ressource zugegriffen werden darf, allein auf der Basis der Identität des Akteurs getroffen. Das heißt, die… …   Deutsch Wikipedia

  • Discretionary access control — Contrôle d accès discrétionnaire Le Contrôle d accès discrétionnaire (DAC pour Discretionary access control) est un genre de contrôle d accès, défini par le Trusted Computer System Evaluation Criteria (TCSEC) comme « des moyens de limiter l… …   Wikipédia en Français

  • Discretionary Access Control List —    Abbreviated DACL. In Microsoft Windows NT, a list of user and group accounts that have permission to access an object s services. The DACL has as many Access Control Entries as there are user or group accounts with access to the object …   Dictionary of networking

  • Дискреционное управление доступом Discretionary access control — 24. Дискреционное управление доступом Разграничение доступа между поименованными субъектами и поименованными объектами. Субъект с определенным правом доступа может передать это право любому другому субъекту Источник: Руководящий документ. Защита… …   Словарь-справочник терминов нормативно-технической документации

  • Access control — is the ability to permit or deny the use of a particular resource by a particular entity. Access control mechanisms can be used in managing physical resources (such as a movie theater, to which only ticketholders should be admitted), logical… …   Wikipedia

  • Access control list — In computer security, an access control list (ACL) is a list of permissions attached to an object. The list specifies who or what is allowed to access the object and what operations are allowed to be performed on the object. In a typical ACL,… …   Wikipedia

  • Access Control List — Muster einer ACL Eine Access Control List, auch ACL, deutsch Zugriffssteuerungsliste, ist eine Software Technik, mit der Betriebssysteme und Anwendungsprogramme Zugriffe auf Daten und Funktionen eingrenzen können. Eine ACL legt fest, welcher… …   Deutsch Wikipedia

  • Mandatory access control — In computer security, mandatory access control (MAC) refers to a type of access control by which the operating system constrains the ability of a subject or initiator to access or generally perform some sort of operation on an object or target.… …   Wikipedia

  • Mandatory Access Control — (MAC) („zwingend erforderliche Zugangskontrolle“) ist ein Oberbegriff für Konzepte zur Kontrolle und Steuerung von Zugriffsrechten, vor allem auf IT Systemen. Die Entscheidungen über Zugriffsberechtigungen werden nicht nur auf der Basis der… …   Deutsch Wikipedia

  • Mandatory Access Control — Contrôle d accès obligatoire Le Mandatory access control (MAC) ou contrôle d accès obligatoire est une méthode de gestion des droits des utilisateurs pour l usage de systèmes d information. Il existe d autres méthodes telles que : le… …   Wikipédia en Français


Share the article and excerpts

Direct link
Do a right-click on the link above
and select “Copy Link”

We are using cookies for the best presentation of our site. Continuing to use this site, you agree with this.