5.14 Windows 2k Access control

5.14 Windows 2k Access control

1. Human users make requests, but processes act on behalf of them to request to access resources

   • Users = Principal
     • When a user logs on to windows they get an accss token
       • The informaton in the token is used by any process acting on behalf of the user
         • The OS uses the token to perform an access check by comparing the info in the token with that in the security descriptor of the object
   • Process = subject
   • resource = object
     • Securable objects are files, directories, threads, printers etc
       • Security descriptors contain security information of objects
         • These include discretionary access control lists DACL
           • The DACL holds access control entries identifying principals and permisions

2. Windows uses Security Identifiers (SIDs) to identify security principals and groups

   • Each account has a SID
   • SIDs are used in access tokens, security descriptors and access control entries
   • SID format - S - V - A - a1 - a2 --- an - 1
     • S = indicates that this is a security identifier
     • V refers to the version number of the SID structure
     • A indicates the identifier authority, who issued the SID. 1 = world authority 5 = NT authority
     • a1, a2 etc indicate sub authorities, IE domains in an enterprise, some SID's do not include any sub authorities
     • 1 is the relative identifier within a domain
     • The SID of the generic group Administrators is S-1-5-32-544, for example. The 5 indicates that the group SID is issued by the NT authority; the 32 indicates that Administrators is a built-in group; finally the 544 is the relative identifier of the Administrators’ group within this domain.

3. Access tokens

   • These describe the users security context
   • Contain the following fields
     • User = Contains the SID of the user account
     • Group Contains list of the SIDs of the groups to which the user belongs
     • Owner = Contains the SID of the default owner of objects that the user creates
     • Primary Group = Contains the SID of the users primary group
     • Default DACL contains the DACL that is assigned to a new object in the absence of other access control information

4. Security descriptors

   • Associated with each securable object and is the counterpart of an access token for users
   • Every Security descriptor contains the following features
     • Control flags - provide info about the descriptor
     • Owner - SID of the objects owner
     • Primary group of the object
     • DACL - govern who and how principals can access this object
     • SACL - system ACL, used to deternime which access requests should be audited