5.16 ACE's

5.16 ACE's

1. Inheritance

   • Inheritance mask contains 5 bits
     • Inherited Ace = IA
       • Indicates if the flag was inherited from a parent container
     • Inherit Only = IO
       • Indicates the ACE does not apply to the current object
         • An ACE where the IO flag is set is used purely for controlling inheritance
     • Container Inherit = CI
       • Indicates subordinate containers will inherit this ACE
     • Object inherit = OI
       • indicates subordinate objects will inherit this ACE
     • Non propagate =NP
       • Flag indicates that the subordinate object will not propagate the inherited ACE any further
         • setting the NP Flag limits inheritance only to those sub-objects immediately subordinate to the current object

2. Ordering

   • 3 Rules Apply
     • All ACE's explicitly added by the owner of a new object are inserted before any inherited ACE's
       • The owner of an object has primary control over access to new objects
     • All access denied ACE's precede access-allowed ACE's
     • All inherited ACE's are ordered according to the level in the hierarchy from which they were inherited, with immediate parent ACE's coming 1st
   • In the course of checking the ACL is traversed from the 1st ACL to the last
     • Hence ordering of ACE's within an ACL is important

3. Permission Mask

   • Permissions are assigned to an ACE using a 32bit permission mask
     • 4 generic access rights
       • R - read
       • W - write
       • X - excecute
         • execute for programs list for directories
       • A - all