Access Control Petr Ročkai User Database on UNIX • UNIX API: #include • implemented by 1 i b c • uses the system-configured user database — /etc/passwd by default — but can also be network-based [LDAP] • getpwent, getpwnam,... Access Control 2/10 December 13, 2018 ACLs on UNIX • POSIX 1003.1e: the acl_* family — never made it out of draft (withdrawn in '97) • ACL is represented by (opaque) acl_t • the data structure is quite complex — acl_entry_t, acl_permset_t, acl_perm_t Access Control 3/10 December 13, 2018 UNIX: ACLs and Files • ACL is associated with an i-node — just like normal permissions • by path: acl_set_file and acl_get_f ile • by descriptor: acl_set_f d, acl_get_f d Access Control 4/10 December 13, 2018 UNIX and Capabilities • also part of POSIX.le • manipulated using cap_* family of functions — cap_set_proc, cap_set_f ile,... • individual capabilities are system-specific — CAP_CH0WN, CAP_SYS_B00T, ... — /usr/include/linux/capability.h Access Control 5/10 December 13, 2018 Exercise: ACLs on Windows • write a C or C++ program to set ACLs on Windows • create a test directory (using the program] — allow read access for everyone — make it so that such read access is inherited — check it works in the file properties dialog Access Control 6/10 December 13, 2018 Exercise: ACLs on Windows • create 2 new files in the directory • check that they inherited the right ACE • deny access to the file content to yourself • add one ACE to first file (keeping the others) • replace the entire ACL on the second file with one ACE Access Control 7/10 December 13, 2018 Exercise: Resources • refer to MSDN • some of the functions you may want to use — GetNamedSecuritylnfo — SetNamedSecuritylnfo — SetEntriesInAcl • other useful articles — Modifying the ACLs of an Object in C++ — Access Control Lists Access Control 8/10 December 13, 2018 Homework: Invocation • write a C (or C++) program that modifies ACLs on UNIX • ./addacl directory '*.txt' userl user2 — di recto ry is a name of a directory (a path) — the *. txt is a pattern (a glob) — userl ... userN are user names Access Control 9/10 December 13, 2018 Homework: Semantics • find all matching files in the given directory (lpt) • grant read access to all the users given as arguments (2pt) • ensure pre-existing ACLs are undamaged (lpt) • comment the code and write a short report (lpt) Access Control 10/10 December 13, 2018