Authorization Overview
An ACL contains a list of entries that specify the principals who can access an object and the operations that those principals can perform. The principals can be named explicitly or be members of a group that is identified in the ACL entry. The ACL is associated with the object it protects. The operations a principal can perform are specified by permissions.
DCE permissions can be set for the following:
· Owner, group, and other
· Specific individual principals in the local cell and in foreign cells
· Specific individual groups in the local cell and in foreign cells
· Any other principals in a specific foreign cell for whom individual permissions have not been set
· Any principals in any cell who have been authenticated by the DCE Authentication Service
· Delegate users, servers, or groups, in local or foreign cells
· Unauthorized users
ACLs also provide a masking capability and a method for integrating protections from DCE versions that are different from the current version.
File systems are frequently designed to provide access permissions for file system objects, such as files and directories. ACLs in DCE are more extensive. In DCE, many objects can have ACLs and be assigned permissions. DCE ACLs control access to objects managed by DCE components, like the Distributed File Service, the DCE Security Service, and the DCE Directory Service.
ACLs for the security service (the component that controls accounts) can, for example, authorize certain principals to change all of the information associated with an account, authorize other principals to change only a subset of the information associated with accounts, and restrict other principals from changing any of the information associated with accounts.
DCE can support particular sets of permissions that correspond to particular types of objects. For example, for containers there can be an "insert'' permission that other objects, such as principals, do not need. This extensive usage of ACLs is in contrast to that of POSIX systems, for example, where only file system objects are protected by permission bits, with a standard set of permissions (read, write, and execute) being used. The DCE control program has a command, acl permissions, that shows the permissions specific to the ACL associated with the named object.
More:
Credentials Inherited by Processes