Access control matrices: who are the subjects: users or processes?

Question

I'm studying the basics of security in computers. The doubt I have is that the access control matrix is presented as a matrix whose rows are the subjects and the columns are the objects. Also subjects are defined both in Windows and Unix (and Multics for that matter) as processes, threads, not users, but processes.

My question is why then, when I check the Windows ACLs, I get the permissions that each user has instead of the permissions that each process under each user has.

It seems to me that more than a matrix a cube is needed, because the subject permissions, i.e. the processes permissions, are bound to the identity of the user logged in.

From what I've read it seems ambiguous: in some cases subjects are processes, and in others subjects are user accounts. Which one is the correct form?

Answer 1

Short answer: both.

My answer is based on knowledge of Unix, but as far as I know the same principle applies to Multics and Windows.

Runtime permission checks are performed by the kernel in system calls (such as the call to open a file). They are based on a matrix where the subjects are processes — the kernel determines the content of the cell for the calling process and for the object under concern (e.g. the file whose opening is requested).

The row for each process in that matrix is computed from data that is stored in a kernel data structure for that process. It is inherited from parent process to child process, all the way from login time. At login time, this data is initialized from the user database; it includes the information of which user the process is running as.

A file's access control list is stored on disk (if the file is a disk file). It could not reference processes: these have a too short lifetime — on a reboot, not information about processes would be meaningful. In access control lists stored on the filesystem, the subjects are users (and groups).

You can draw a cube, but that cube doesn't correspond to anything tangible in the operating system design. The user/object matrix corresponds to file ACLs, and the process/object matrix corresponds to runtime checks in the kernel.