## Access Control
- Fundamental concept:
	- Protection System (specification)
	- Reference monitor (enforcement mechanism)
- Models:
	- Discretionary Access Control
	- Mandatory Access Control

### Definitions
- *Access Control*: Control the permissions of subjects on objects
- *Access Control Policy*: Set of rules after which access should be granted
- *Subject*: Entity performing an action (e.g., users, processes)
- *Object*: Entity on which an action is performed (e.g., resource, file)
- *Operation*: Action to be taken
- *Access control mechanism*
	- Enforces *Access Control Policy*
	- Authorize requests from subject to object
	- Enforcement levels
		- Operating System: TCB (determine security by allowed control flows)
		- Applications: Database, JVM, Browser, Python
		- Multi-layered: Virtual Machine + OS + Application
	- Important: All layers should be consistent with system security goals
- *Safety problem*:
	- Ensure that current and future protection states ensure security goals
	- Given:
		- Set of rules (policy)
		- Initial access matrix
		- Generic access right *a*
	- Task: Manipulate matrix using policy so that any subject gets *a*
	- Problem: Undecidible

![](images/enforcement-levels.png)
### Protection System
- Definition *Protection System* 
	- Define access control specification
	- Protection state 
		- Operations that subjects can perform on objects
		- e.g., State of access Matrix
	- Set of protection state operations
		- Modify protection state
		- Important for adding new subjects/objects
- Defintion *Protection Domain*
	- Set of objects and actions a process can perform
- Goals
	- Determine whether the enforcement mechanism enforces policy correctly
	- Determine whether the policy expresses effective goals


### Reference monitor
- Purpose: Access control enforcement mechanism
- Components
	- Reference monitor interface (e.g., LSM)
	- Reference validation mechanism (e.g., SELinux)
	- Policy store (e.g., policy database) **Is this the implementation???**
- *Reference monitor concept* (guarantees)
	- *This is a major focus of the course*
	- Complete Mediation
	- Tamperproof
	- Verifiable

![](images/referencemonitor.png)
#### Complete mediation
- Always be invoked for security-sensitive calls
- *Security-sensitive call*: Operation that may not be authorized for every subject
- Evaluation criteria:
	- Interface mediates all requests?
	- All resources mediated?
	- Verifiability to enforce security goals?

#### Tamperproof
- Not modifiable by untrusted entities (e.g., subjects)
- Not modifiable code/data affecting reference monitor
- Detection of tamperproofing: Integrity guarantees (e.g., Biba)
- Evaluation criteria:
	- Is reference monitor protected?
	- Is system TCB protected?

#### Verifiable
- Subject to analysis/tests
- Determine correctness of code/policy
- Test/analyse reference validation mechanism
- Evaluation criteria:
	- Is TCB code correct?
	- Enforcement of security goals of system by protection system?

### Discretionary Access Control
- Definition
	- Access is based on user's identity/groups
	- User can pass access rights to other users
- Prominent example: Lampson's Access Matrix
- Two classes:
	- Capabilities: Subject has list of objects with actions
	- Access Control List: Object has list of allowed subjects

#### Lampson's Access Matrix
- Lampson (1970)
- Matrix indicating access rights for certain operation
- Rows: Subjects (e.g, users, processes)
- Columns: Objects (e.g., resources, files)
- Cell contains information if action is allowed (authorized operations)
- Problem: Doesn't protect security goals
	- Malicious code executed by user can change permissions (i.e., change protection state)
	- e.g., change permissions

#### UNIX Access Control
- Objects: Files, sockets, etc.
- Model: Access Control List (columns of ACM)
- Additional roles
- *Discretionary protection state*:
	- Subjects may change protection state
	- e.g., add access for `others`

### Mandatory Access Control
- Definition
	- Access is based on rules
	- Rules can't be changed by user

#### Mandatory Protection System (MPS)
- Task: Define security goals/access control specification
- Modified **only** by trusted administrators
- Immutable to user-space processes
- Components
	- Mandatory protection state
	- Labeling state
	- Transition state
- Challenges:
	- How to set up a MPS?
	- How to manage a MPS? 
	- Status quO: Dynamic analysis to setup Mandatory Access Control policy (e.g., kRazor)
	- Problem:
		- This results in a functional policy
		- => Can't solve safety problem
- Stakeholders:
	- Programmers (what do they need to know?)
	- OS Distributor
	- Administrators
	- Users

![](images/mps.png)
##### Mandatory protection state
- Definition of protection state
- Immutable set of labels
- Operations that subject labels can perform on object labels
- Matrix (subject labels/object labels/operations)
- Enforce security against bad code using labels

##### Labeling state
- Immutable mapping subjects/objects to labels
- e.g., for new subjects/objects
- Example:
	- New (malicious) process wants to modify kernel memory => Deny access/map to labels which does not have this privilege

##### Transition state
- Immutable relabeling strategies/rules for subjects/object
- Examples
	- Process reads adversary-controlled object label => Remove privileges
	- Process reads adversary-controlled object label => remove write-permission for objects which can be read by higher-level privileges