Access Control Lists (ACLs) in Operating Systems - Step-by-Step Execution

Concept Flow - Access Control Lists (ACLs)

User or Process Requests Access

↓

Check ACL for Resource

↓

Match User/Group in ACL?

No→Access Denied

Yes↓

Check Permissions (Read/Write/Execute)

↓

Permission Allowed?

No→Access Denied

Yes↓

Access Granted

When a user or process tries to access a resource, the system checks the ACL for that resource. If the user or their group is listed with the needed permission, access is granted; otherwise, it is denied.

Execution Sample

Operating Systems

Resource ACL:
  UserA: read, write
  UserB: read

UserA requests write access
Check ACL for UserA
Permission write found
Access granted

This example shows how the system checks the ACL for UserA's write permission and grants access.

Analysis Table

Step	Action	User/Group Checked	Permission Needed	ACL Entry Found	Permission Allowed	Result
1	UserA requests write access	UserA	write	N/A	N/A	Continue
2	Check ACL for UserA	UserA	write	Yes	N/A	Continue
3	Check if write permission allowed	UserA	write	Yes	Yes	Access Granted
4	End	N/A	N/A	N/A	N/A	Stop

💡 Access granted because UserA has write permission in ACL

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
User/Process	None	UserA	UserA	UserA	UserA
Permission Needed	None	write	write	write	write
ACL Entry Found	None	N/A	Yes	Yes	Yes
Permission Allowed	None	N/A	N/A	Yes	Yes
Access Result	None	Pending	Pending	Granted	Granted

Key Insights - 3 Insights

Why does the system deny access if the user is not listed in the ACL?

Because the ACL explicitly controls who can access the resource. If the user or their group is not found in the ACL (see execution_table step 2), the system cannot confirm permission and denies access by default.

What happens if the user is listed but does not have the requested permission?

Even if the user is listed in the ACL, the system checks if the specific permission (read, write, execute) is allowed. If not found (see execution_table step 3), access is denied.

Can a group permission grant access if the user is not individually listed?

Yes, if the user belongs to a group listed in the ACL with the needed permission, access can be granted. This is because ACLs check both user and group entries.

Visual Quiz - 3 Questions

Look at the execution table, at which step is the ACL checked for the user?

A Step 3

B Step 1

C Step 2

D Step 4

💡 Hint

Refer to the 'Action' and 'ACL Entry Found' columns in execution_table row 2

According to the variable tracker, what is the 'Access Result' after step 3?

A Granted

B Denied

C Pending

D Unknown

💡 Hint

Check the 'Access Result' row under 'After Step 3' in variable_tracker

If UserA requested execute permission instead of write, what would change in the execution table?

A ACL Entry Found would be No at step 2

B Permission Allowed would be No at step 3

C Access Result would be Granted at step 3

D No change

💡 Hint

Consider the 'Permission Allowed' column in execution_table step 3 and the permissions listed in the ACL

Concept Snapshot

Access Control Lists (ACLs) control resource access by listing users/groups and their permissions.
When access is requested, the system checks if the user or their group is in the ACL.
If found, it verifies if the requested permission (read, write, execute) is allowed.
Access is granted only if both user/group and permission match.
Otherwise, access is denied by default.

Full Transcript

Access Control Lists (ACLs) are used by operating systems to control who can access a resource and what they can do with it. When a user or process requests access, the system looks up the ACL for that resource. It checks if the user or any group they belong to is listed. If not listed, access is denied. If listed, the system checks if the requested permission, such as read, write, or execute, is allowed. If the permission is allowed, access is granted; otherwise, it is denied. This step-by-step checking ensures secure and controlled access to resources.