In computer security, an access-control list (ACL) is a list of permissions[a] associated with a system resource (object or facility). An ACL specifies which users or system processes are granted access to resources, as well as what operations are allowed on given resources.[1] Each entry in a typical ACL specifies a subject and an operation. For instance,
- If a file object has an ACL that contains(Alice: read,write; Bob: read), this would give Alice permission to read and write the file and give Bob permission only to read it.
- If the Resource Access Control Facility (RACF) profile CONSOLE CLASS(TSOAUTH) has an ACL that contains(ALICE:READ), this would give ALICE permission to use the TSO CONSOLE command.
Implementations
editMany kinds of operating systems implement ACLs or have a historical implementation; the first implementation of ACLs was in the filesystem of Multics in 1965.[2][3]
Filesystem ACLs
editA filesystem ACL is a data structure (usually a table) containing entries that specify individual user or group rights to specific system objects such as programs, processes, or files. These entries are known as access-control entries (ACEs) in the Microsoft Windows NT,[4] OpenVMS, and Unix-like operating systems such as Linux, macOS, and Solaris. Each accessible object contains an identifier to its ACL. The privileges or permissions determine specific access rights, such as whether a user can read from, write to, or execute an object. In some implementations, an ACE can control whether or not a user, or group of users, may alter the ACL on an object.
One of the first operating systems to provide filesystem ACLs was Multics. PRIMOS featured ACLs at least as early as 1984.[5]
In the 1990s the ACL and role-based access control (RBAC) models were extensively tested[by whom?] and used to administer file permissions.
POSIX ACL
editPOSIX 1003.1e/1003.2c working group made an effort to standardize ACLs, resulting in what is now known as "POSIX.1e ACL" or simply "POSIX ACL".[6] The POSIX.1e/POSIX.2c drafts were withdrawn in 1997 due to participants losing interest for funding the project and turning to more powerful alternatives such as NFSv4 ACL.[7] As of December 2019[update], no live sources of the draft could be found on the Internet, but it can still be found in the Internet Archive.[8]
Most of the Unix and Unix-like operating systems (e.g. Linux since 2.5.46 or November 2002,[9] FreeBSD, or Solaris) support POSIX.1e ACLs (not necessarily draft 17). ACLs are usually stored in the extended attributes of a file on these systems.
NFSv4 ACL
editNFSv4 ACLs are much more powerful than POSIX draft ACLs. Unlike draft POSIX ACLs, NFSv4 ACLs are defined by an actually published standard, as part of the Network File System.
NFSv4 ACLs are supported by many Unix and Unix-like operating systems. Examples include AIX, FreeBSD,[10] Mac OS X beginning with version 10.4 ("Tiger"), or Solaris with ZFS filesystem,[11] support NFSv4 ACLs, which are part of the NFSv4 standard. There are two experimental implementations of NFSv4 ACLs for Linux: NFSv4 ACLs support for Ext3 filesystem[12] and the more recent Richacls, which brings NFSv4 ACLs support for Ext4 filesystem.[13] As with POSIX ACLs, NFSv4 ACLs are usually stored as extended attributes on Unix-like systems.
NFSv4 ACLs are organized nearly identically to the Windows NT ACLs used in NTFS.[14] NFSv4.1 ACLs are a superset of both NT ACLs and POSIX draft ACLs.[15] Samba supports saving the NT ACLs of SMB-shared files in many ways, one of which is as NFSv4-encoded ACLs.[16]
Active Directory ACLs
editMicrosoft's Active Directory service implements an LDAP server that stores and disseminates configuration information about users and computers in a domain.[17] Active Directory extends the LDAP specification by adding the same type of access-control list mechanism as Windows NT uses for the NTFS filesystem. Windows 2000 then extended the syntax for access-control entries such that they could not only grant or deny access to entire LDAP objects, but also to individual attributes within these objects.[18]
Networking ACLs
editOn some types of proprietary computer hardware (in particular, routers and switches), an access-control list provides rules that are applied to port numbers or IP addresses that are available on a host or other layer 3, each with a list of hosts and/or networks permitted to use the service. Although it is additionally possible to configure access-control lists based on network domain names, this is a questionable idea because individual TCP, UDP, and ICMP headers do not contain domain names. Consequently, the device enforcing the access-control list must separately resolve names to numeric addresses. This presents an additional attack surface for an attacker who is seeking to compromise security of the system which the access-control list is protecting. Both individual servers and routers can have network ACLs. Access-control lists can generally be configured to control both inbound and outbound traffic, and in this context they are similar to firewalls. Like firewalls, ACLs could be subject to security regulations and standards such as PCI DSS.
SQL implementations
editACL algorithms have been ported to SQL and to relational database systems. Many "modern" (2000s and 2010s) SQL-based systems, like enterprise resource planning and content management systems, have used ACL models in their administration modules.
Schema-indexed ACLs
editIn 2024, schema-indexed ACL models emerged as a lightweight alternative to traditional JSON-based permission storage. One notable proposal introduced the idea of storing only the indexes of allowed operations, rather than full permission trees. This technique, later formalized as **SCode ACL**, allows compact encoding of access rights (e.g., `"0 2 5"`) based on a predefined flattened schema, making it particularly efficient for use in stateless systems such as JWT tokens or session cookies. The approach gained early traction in developer communities for its minimalism and performance, and has since been adopted in both small-scale and production-grade systems.[citation needed]
Comparing with RBAC
editThe main alternative to the ACL model is the role-based access-control (RBAC) model. A "minimal RBAC model", RBACm, can be compared with an ACL mechanism, ACLg, where only groups are permitted as entries in the ACL. Barkley (1997)[19] showed that RBACm and ACLg are equivalent.
In modern SQL implementations, ACLs also manage groups and inheritance in a hierarchy of groups. So "modern ACLs" can express all that RBAC express and are notably powerful (compared to "old ACLs") in their ability to express access-control policy in terms of the way in which administrators view organizations.
For data interchange, and for "high-level comparisons", ACL data can be translated to XACML.[20]
See also
editNotes
edit- ^ E.g., File-system permissions, permission to perform specific action.
References
edit- ^ R. Shirey (August 2007). Internet Security Glossary, Version 2. doi:10.17487/RFC4949. RFC 4949. Retrieved May 19, 2023.
- ^ Richard E. Smith. Elementary Information Security. p. 150.
- ^ Daley, R. C.; Neumann, P. G. (1965). "A general-purpose file system for secondary storage". AFIPS '65 (Fall, part I): Proceedings of the November 30--December 1, 1965, fall joint computer conference, part I. ACM Press. p. 213. doi:10.1145/1463891.1463915.
- ^ "Managing Authorization and Access Control". Microsoft Learn. 2025-08-07. Retrieved 2025-08-07.
- ^ "P.S.I. Pacer Software, Inc. Gnet-II revision 3.0". Communications. Computerworld. Vol. 18, no. 21. 2025-08-07. p. 54. ISSN 0010-4841. Retrieved 2025-08-07.
The new version of Gnet-II (revision 3.0) has added a line-security mechanism which is implemented under the Primos ACL subsystem.
- ^ Grünbacher, Andreas. "POSIX Access Control Lists on Linux". Usenix. Retrieved 12 December 2019.
- ^ wurtzkurdle. "Why was POSIX.1e withdrawn?". Unix StackExchange. Retrieved 12 December 2019.
- ^ Trümper, Winfried (February 28, 1999). "Summary about Posix.1e". Archived from the original on 2025-08-07.
- ^ "Red Hat Enterprise Linux AS 3 Release Notes (x86 Edition)". Red Hat. 2003. Archived from the original on 2025-08-07. Retrieved 2025-08-07.
EA (Extended Attributes) and ACL (Access Control Lists) functionality is now available for ext3 file systems. In addition, ACL functionality is available for NFS.
- ^ "NFSv4 ACLs". FreeBSD. 2025-08-07. Retrieved 2025-08-07.
- ^ "Chapter 8 Using ACLs and Attributes to Protect ZFS Files". Oracle Corporation. 2025-08-07. Retrieved 2025-08-07.
- ^ Grünbacher, Andreas (May 2008). "Native NFSv4 ACLs on Linux". SUSE. Archived from the original on 2025-08-07. Retrieved 2025-08-07.
- ^ Grünbacher, Andreas (July–September 2010). "Richacls – Native NFSv4 ACLs on Linux". bestbits.at. Archived from the original on 2025-08-07. Retrieved 2025-08-07.
- ^ "ACLs". Linux NFS.
- ^ "Mapping Between NFSv4 and Posix Draft ACLs".
- ^ "vfs_nfs4acl_xattr(8)". Samba Manual.
- ^ "[MS-ADTS]: Active Directory Technical Specification". 7 June 2024.
- ^ Swift, Michael M. (November 2002). "Improving the granularity of access control for Windows 2000". ACM Transactions on Information and System Security. 5 (4): 398–437. doi:10.1145/581271.581273. S2CID 10702162.
- ^ J. Barkley (1997) "Comparing simple role based access control models and access control lists", In "Proceedings of the second ACM workshop on Role-based access control", pages 127-132.
- ^ G. Karjoth, A. Schade and E. Van Herreweghen (2008) "Implementing ACL-based Policies in XACML", In "2008 Annual Computer Security Applications Conference".
Further reading
edit- Rhodes, Tom. "File System Access Control Lists (ACLs)". FreeBSD Handbook. Retrieved 2025-08-07.
- Michael Fox; John Giordano; Lori Stotler; Arun Thomas (2025-08-07). "SELinux and grsecurity: A Case Study Comparing Linux Security Kernel Enhancements" (PDF). University of Virginia. Archived from the original (PDF) on 2025-08-07. Retrieved 2025-08-07.
- Hinrichs, Susan (2005). "Operating System Security". CyberSecurity Spring 2005. University of Illinois. Archived from the original on 2025-08-07. Retrieved 2025-08-07.
- Mitchell, John. "Access Control and Operating System Security" (PDF). Stanford University. Retrieved 2025-08-07.
- Clarkson, Michael. "Access Control". Cornell University. Retrieved 2025-08-07.
- Klein, Helge (2025-08-07). "Permissions: A Primer, or: DACL, SACL, Owner, SID and ACE Explained". Retrieved 2025-08-07.
- "Access Control Lists". Microsoft Learn. 2025-08-07. Retrieved 2025-08-07.
- "How Permissions Work". Microsoft Learn. 2025-08-07. Retrieved 2025-08-07.