An access-control list, with respect to a computer file system, is a list of permissions associated with an object. An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects. Each entry in a typical ACL specifies a subject and an operation. For instance, if a file object has an ACL that contains, this would give Alice permission to read and write the file and Bob to only read it.
Implementations
Many kinds of operating systems implement ACLs, or have a historical implementation. The first time in the filesystem of Multics in 1965.
Filesystem ACLs
A filesystem ACL is a data structure containing entries that specify individual user or group rights to specific system objects such as programs, processes, or files. These entries are known as access-control entries in the Microsoft Windows NT, OpenVMS, Unix-like, and macOS operating systems. Each accessible object contains an identifier to its ACL. The privileges or permissions determine specific access rights, such as whether a user can read from, write to, or execute an object. In some implementations, an ACE can control whether or not a user, or group of users, may alter the ACL on an object. PRIMOS featured ACLs at least as early as 1984. In the 1990s the ACL and RBAC models were extensively tested and used to administer file permissions.
POSIX ACL
1003.1e/1003.2c working group made an effort to standardize ACLs, resulting in what is now known as "POSIX.1e ACL" or simply "POSIX ACL". The POSIX.1e/POSIX.2c drafts were withdrawn in 1997 due to participants losing interest for funding the project and turning to more powerful alternatives such as NFSv4 ACL., no live sources of the draft could be found on the Internet, but it can still be found in the Internet Archive. Most of the Unix and Unix-like operating systems support POSIX.1e ACLs. Many of them, for example AIX, FreeBSD, Mac OS X beginning with version 10.4, or Solaris with ZFS filesystem, support NFSv4 ACLs, which are part of the NFSv4 standard. There are two experimental implementations of NFSv4 ACLs for Linux: NFSv4 ACLs support for Ext3 filesystem and the more recent Richacls which brings NFSv4 ACLs support for Ext4 filesystem. ACLs are usually stored in the extended attributes of a file on these systems.
Microsoft's Active Directory Directory Service implements an LDAP server that store and disseminate configuration information about users and computers in a domain. Active Directory extends the LDAP specification by adding the same type of access-control list mechanism as Windows NT uses for the NTFS filesystem. Windows 2000 then extended the syntax for access control entries such that they could not only grant or deny access to entire LDAP objects, but also to individual attributes within these objects.
Networking ACLs
On some types of proprietary computer-hardware, an access-control list provides rules that are applied to port numbers or IP addresses that are available on a host or other layer 3, each with a list of hosts and/or networks permitted to use the service. Although it is additionally possible to configure access-control lists based on network domain names, this is a questionable idea because individual TCP, UDP, and ICMP headers do not contain domain names. Consequently, the device enforcing the access-control list must separately resolve names to numeric addresses. This presents an additional attack surface for an attacker who is seeking to compromise security of the system which the access-control list is protecting. Both individual servers as well as routers can have network ACLs. Access-control lists can generally be configured to control both inbound and outbound traffic, and in this context they are similar to firewalls. Like firewalls, ACLs could be subject to security regulations and standards such as PCI DSS.
The main alternative to the ACL model is the role-based access-control model. A "minimal RBAC model", RBACm, can be compared with an ACL mechanism, ACLg, where only groups are permitted as entries in the ACL. Barkley showed that RBACm and ACLg are equivalent. In modern SQL implementations, ACLs also manage groups and inheritance in a hierarchy of groups. So "modern ACLs" can express all that RBAC express, and are notably powerful in their ability to express access-control policy in terms of the way in which administrators view organizations. For data interchange, and for "high level comparisons", ACL data can be translated to XACML.
