A computer system consists of a set of hardware and software objects. The protection domain is a set of pairs of objects and rights needed to access those objects.
An access matrix is a representation of protection domains. (It is more conceptual than actual however.) Each row specified the object, and a right that can be performed as defined by the OS.
This includes things such as the ability to add other rights for a different user, allowing access to an object (like a file), and defining the type of access (read, write, modify, execute, etc).
An access list (AL) associated with an object O contains entries of the form (D, rights), where rights specify what operations a process in domain D may apply to object O.
A capability list (CL) associated with a domain D contents entries of the form (O, rights), where rights specify what operations a process in domain D may apply to object O.
Notice that an AL is object-centric, and CL is domain-centric.
Before access is allowed, the object checks to see if the user is allowed access by looking up what it allows, and what domain the user is under.
Different OSes allow different types of access depending upon their needs. More security slows down a system, where less security is simpler and faster, but it may limit what can be done.
Unix is very simple in allowing a file (for example) to belong to a User, a Group, and the World. Each domain is allowed either no access, or a combination of read, write (modify), and execute access. The file owner and group can be changed during the lifetime of the file.
Windows is much more complex. It allows a file to “belong” to multiple groups by allowing multiple groups to have access. Access can be granted, or prevented, among more types of access than Unix. Additionally, multiple individuals can be granted direct access, even if they are not in one of the “special” groups.
The biggest question is what happens in Windows if a user belongs to two groups. One which is allowed access, and one which is denied?
Access Control was originally found on Access 2 Learn
