* Rights and privileges to system resources
An Access Control List or ACL (pronounced “ACK-el”) is the primary way of granting (or withholding) rights and privileges to system resources. Most of us should be familiar with ACLs even if we find actually maintaining them to be tedious in the extreme. But what about DACLs, SACLs and MACLs?
A DACL is a Discretionary Access Control List, one that is up to the system administrator to manage. The owner of the object, or the administrator thereof, can control who has what access to the object. They can even delegate the administration of the ACL.
A SACL is a System Access Control List, usually identical in structure to a DACL, except that it is not generally used to determine access to a resource, but rather to indicate auditing of the object. Whereas empty and null DACLs are very important, empty and null SACLs simply mean that you do not want to audit something. SACLs are essentially optional, and they are sparingly used in a default installation.
A MACL is a Mandatory Access Control List, one that is pre-defined and not under the control of the object owner. For instance, in a multi-level security system a user may have secret clearance. By virtue of having that clearance, the MACLs specify that the user has read-access to any object that is classified as secret or below, and has write-access to any object that is secret or above.
Any object created by the user is automatically classified as secret unless the user specifies a higher classification. The user cannot create objects classified lower than secret, nor can the user change the classification of an object. The MACL is computed, specified, and enforced by the system outside the control of the object owner. Windows, unfortunately, does not implement MACLs – but don’t you wish it did? (Note that no major operating systems implement MACLs at this time.)
I learned all this (and much more) from a fascinating paper about Windows security titled “How to Shoot Yourself in the Foot with Security, Part 2: To ACL or Not to ACL”, written by Jesper Johansson, senior security strategist at Microsoft’s Security Technology Unit.
I’ve only scratched the surface of the things he discusses, so you should read it in an attempt to fully understand access control and ACLs. As Johansson says at one point: “Many people also fail to understand that if you set incorrect ACLs there are few ways to recover. In fact, if you destroy the default DACLs on the operating system files, there is really only one guaranteed rollback tool: Format c:”!
