Access Control Lists (ACLs) in Operating Systems - Step-by-Step Execution

Concept Flow - Access Control Lists (ACLs)

User or Process Requests Access

↓

Check ACL for Resource

↓

Match User/Group in ACL?

No→Access Denied

Yes↓

Check Permissions (Read/Write/Execute)

↓

Permission Allowed?

No→Access Denied

Yes↓

Access Granted

When a user or process tries to access a resource, the system checks the ACL for that resource. If the user or their group is listed with the needed permission, access is granted; otherwise, it is denied.

Execution Sample

Operating Systems

Resource ACL:
  UserA: read, write
  UserB: read

UserA requests write access
Check ACL for UserA
Permission write found
Access granted

This example shows how the system checks the ACL for UserA's write permission and grants access.

Analysis Table

Step	Action	User/Group Checked	Permission Needed	ACL Entry Found	Permission Allowed	Result
1	UserA requests write access	UserA	write	N/A	N/A	Continue
2	Check ACL for UserA	UserA	write	Yes	N/A	Continue
3	Check if write permission allowed	UserA	write	Yes	Yes	Access Granted
4	End	N/A	N/A	N/A	N/A	Stop

💡 Access granted because UserA has write permission in ACL

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
User/Process	None	UserA	UserA	UserA	UserA
Permission Needed	None	write	write	write	write
ACL Entry Found	None	N/A	Yes	Yes	Yes
Permission Allowed	None	N/A	N/A	Yes	Yes
Access Result	None	Pending	Pending	Granted	Granted

Key Insights - 3 Insights

Why does the system deny access if the user is not listed in the ACL?

Because the ACL explicitly controls who can access the resource. If the user or their group is not found in the ACL (see execution_table step 2), the system cannot confirm permission and denies access by default.

What happens if the user is listed but does not have the requested permission?

Even if the user is listed in the ACL, the system checks if the specific permission (read, write, execute) is allowed. If not found (see execution_table step 3), access is denied.

Can a group permission grant access if the user is not individually listed?

Yes, if the user belongs to a group listed in the ACL with the needed permission, access can be granted. This is because ACLs check both user and group entries.

Visual Quiz - 3 Questions

Look at the execution table, at which step is the ACL checked for the user?

A Step 3

B Step 1

C Step 2

D Step 4

💡 Hint

Refer to the 'Action' and 'ACL Entry Found' columns in execution_table row 2

According to the variable tracker, what is the 'Access Result' after step 3?

A Granted

B Denied

C Pending

D Unknown

💡 Hint

Check the 'Access Result' row under 'After Step 3' in variable_tracker

If UserA requested execute permission instead of write, what would change in the execution table?

A ACL Entry Found would be No at step 2

B Permission Allowed would be No at step 3

C Access Result would be Granted at step 3

D No change

💡 Hint

Consider the 'Permission Allowed' column in execution_table step 3 and the permissions listed in the ACL

Concept Snapshot

Access Control Lists (ACLs) control resource access by listing users/groups and their permissions.
When access is requested, the system checks if the user or their group is in the ACL.
If found, it verifies if the requested permission (read, write, execute) is allowed.
Access is granted only if both user/group and permission match.
Otherwise, access is denied by default.

Full Transcript

Access Control Lists (ACLs) are used by operating systems to control who can access a resource and what they can do with it. When a user or process requests access, the system looks up the ACL for that resource. It checks if the user or any group they belong to is listed. If not listed, access is denied. If listed, the system checks if the requested permission, such as read, write, or execute, is allowed. If the permission is allowed, access is granted; otherwise, it is denied. This step-by-step checking ensures secure and controlled access to resources.

Practice

1. What is the main purpose of an Access Control List (ACL) in operating systems?

easy

A. To monitor network traffic

B. To store the content of a file securely

C. To manage system hardware devices

D. To specify which users or groups have permissions on a file or resource

Solution

1. Step 1: Understand what ACLs control

   ACLs list permissions for users or groups on files or resources.

2. Step 2: Identify the main function

   The main function is to specify who can do what on a resource.

3. Final Answer:

   To specify which users or groups have permissions on a file or resource -> Option D

4. Quick Check:

   ACL = user/group permissions [OK]

Hint: ACLs control user permissions on files/resources [OK]

Common Mistakes:

• Confusing ACL with file content storage
• Thinking ACL manages hardware
• Assuming ACL monitors network

2. Which of the following is the correct way to represent an ACL entry for a user named 'alice' with read and write permissions?

easy

A. user:alice:rwx

B. user:alice:rw

C. group:alice:rw

D. user:alice:r

Solution

1. Step 1: Identify the correct ACL entry format

   ACL entries usually specify type (user/group), name, and permissions.

2. Step 2: Match permissions to read and write only

   Read and write permissions are 'rw', execute is 'x'. So 'rw' matches read and write.

3. Final Answer:

   user:alice:rw -> Option B

4. Quick Check:

   user + alice + rw = correct ACL entry [OK]

Hint: User entries start with 'user:' and list exact permissions [OK]

Common Mistakes:

• Using 'group' instead of 'user' for a user entry
• Adding execute permission when not needed
• Listing only read permission when write is required

3. Given the following ACL entries on a file:
user:alice:rwx
group:staff:r-x
other::r--
What permissions does a user named 'bob' who belongs to the 'staff' group have?

medium

A. Read and execute only

B. Read, write, and execute

C. Read only

D. No permissions

Solution

1. Step 1: Identify bob's group membership

   Bob belongs to the 'staff' group, so group permissions apply.

2. Step 2: Check group permissions in ACL

   Group 'staff' has 'r-x' which means read and execute, no write.

3. Final Answer:

   Read and execute only -> Option A

4. Quick Check:

   Group 'staff' = r-x = read + execute [OK]

Hint: User's group permissions apply if user not listed explicitly [OK]

Common Mistakes:

• Assuming user permissions apply to bob
• Including write permission incorrectly
• Using 'other' permissions instead of group

4. A system administrator sets an ACL entry as user:bob:r but Bob reports he cannot write to the file. What is the most likely cause?

medium

A. The file is owned by another user

B. Bob is not listed in the ACL

C. The ACL entry only grants read permission, not write

D. The ACL entry syntax is incorrect

Solution

1. Step 1: Analyze the ACL entry permissions

   The entry 'user:bob:r' grants only read permission, no write.

2. Step 2: Understand why Bob cannot write

   Without write permission, Bob cannot modify the file.

3. Final Answer:

   The ACL entry only grants read permission, not write -> Option C

4. Quick Check:

   Read-only permission blocks writing [OK]

Hint: Check if write permission 'w' is included in ACL entry [OK]

Common Mistakes:

• Assuming ownership affects ACL permissions directly
• Thinking syntax error causes permission denial
• Ignoring the actual permissions granted

5. You want to allow a group named 'developers' to have read and write access to a file, but no execute permission. Which ACL entry correctly achieves this without affecting other permissions?

hard

A. group:developers:rw-

B. group:developers:rwx

C. user:developers:rw-

D. group:developers:r--

Solution

1. Step 1: Identify the correct ACL entry type

   Since 'developers' is a group, the entry must start with 'group:developers'.

2. Step 2: Set permissions to read and write only

   Read and write permissions are 'rw-', where '-' means no execute.

3. Step 3: Confirm no execute permission is given

   group:developers:rw- uses 'rw-' which excludes execute permission.

4. Final Answer:

   group:developers:rw- -> Option A

5. Quick Check:

   Group + rw- = read/write, no execute [OK]

Hint: Use 'group:name:rw-' for read/write without execute [OK]

Common Mistakes:

• Using 'user' instead of 'group' for group permissions
• Including execute permission by mistake
• Setting only read permission when write is needed