Ambient authority


Ambient authority is a term used in the study of access control systems.
A subject, such as a computer program, is said to be using
ambient authority if it only needs to specify the names
of the involved object and the operation to be performed on them
in order for a permitted action to succeed.
In this definition,
The authority is "ambient" in the sense that it exists in a broadly
visible environment
where any subject can request it by name.
For example, suppose a C program opens a file for read access
by executing the call:
open
The desired file is designated by its name on the filesystem,
which does not by itself include authorising information, so the program
is exercising ambient authority.
When ambient authority is requested, permissions are granted or denied
based on one or more global properties of the executing program,
such as its identity or its role.
In such cases,
the management of access control is handled separately
from explicit communication
to the executing program or process,
through means such as access control lists associated with objects
or through Role-Based Access Control mechanisms.
The executing program has no means to reify the permissions
that it was granted for a specific purpose as first-class values.
So, if the program should be able to access an object when acting on
its own behalf but not when acting on behalf of one of its clients, it has no way to express
that intention. This inevitably leads to such programs
being subject to the Confused deputy problem.
The term "ambient authority" is used primarily
to contrast with capability-based security,
in which executing programs receive permissions
as they might receive data, as communicated first-class object references.
This allows them to determine where the permissions came from,
and thus avoid the Confused deputy problem. However, since there
are additional requirements for a system to be considered a capability system besides avoiding ambient authority,
"non-ambient authority system" is not just a synonym for "capability system".
Ambient authority
is the dominant form of access control
in computer systems today.
The user model of access control
as used in Unix and in Windows systems
is an ambient authority model
because programs execute
with the authorities of the user that started them.
This not only means that executing programs
are inevitably given more permissions
than they need for their task,
but that they are unable to determine
the source or the number and types of permission that they have.
A program executing under an ambient authority access control model
has little option but to designate permissions
and try to exercise them, hoping for the best.
This property requires an excess of permissions
to be granted to users or roles,
in order for programs to execute without error.