So when there's more than one way of doing something, well of course we have
to decide if you're implementing an operating system or
something like that, should I go with ACLs or should I use C-lists?
I said most operating systems use access control lists, but
some were done capability oriented or capability based.
So there must be some pros and cons.
One must have some nice things that perhaps the other one doesn't offer and
then you have to see what is more important to you and
based on that you're going to make a decision.
Let's look at couple of these possibilities.
Metrics that you perhaps can use to decide whether you want to go
with ACL or C-list based implementation access control.
The first thing we worry about is efficiency.
So in this context,
I said the couple of things when we're talking about implementation
with ACLs and C-lists, with ACL I said you have to traverse the list.
You have to go down the list looking for an Access Control Entry, or ACE, for
the user who made the request.
Traversing a list is there is some processing overhead required and
the compute time it's going to take.
Capability list I said it's a handle, shouldn't be able to forge it but
once you have it it's been propagated to you.
You present it to the system and system knows that by mere possession of
this capability, you should be able to access the resource.
So when comes to efficiency, C-Lists is faster.
We don't need to traverse anything but
ACLs have this negative thing were we have to go down the list.
So efficiency would say c-lists are better.
But let's look at another thing that's good to have, and that's accountability.
So let's say if I ask you who all have access to this sensitive file?
With ACL, what you're going to do is you're going to find the ACL,
you'll go down the access control list, and
you have every user and what kind of access they have for this file.
So information about who can access this file is available.
All of it is available in one place which is the ACL.
So ACLs are actually good when it comes to accountability because
we can go look in one place and be able to answer that question.
How about C-list?
Remember we said C-lists are stored either in objects or catalogs for
different users and so on.
So to find out who all have the capabilities, who are all the users who
hold the capability for resource, I have to look on every user backlog.
I have to look into every object that may store this capability, for example,
if you want that capability to be to be used from that particular object.
So now accountability is going to be hard because as we said we may have to
look at all of the catalogs and things like that.
So C-lists are not so great when it comes to accountability.
Revocation is essentially you give someone permission to access a resource
but in the future you don't need to share the resource with them anymore.
So at that point you will revoke their access, remove their access.
With ACL, how can we do it?
So let's say Alice decides to revoke Bob's access for file foo.
Well, it's easy.
We know that there's an ACL for foo.
And Alice makes a call to the system saying remove ops permission.
The system locates the ACL, finds the ACE for Bob and
in there removes whatever permission that's been revoked.
So the ACL revocation is actually easy.
They have this desirable positive property because we know how to go turn
of the access right in the ACE, and all the ACEs are in one place.
How about C-List?
How do we revoke with capabilities?
Well that's interesting,
it's actually hard because we know the capability sits in Bob's catalog,
and Alice can't go remove capabilities from Bob's catalog at will.
How exactly does she do it?
There are interesting ways in which you may be able to do it and
things like that.
But with C-lists actually revocation is not easy.
So if you look at accountability, of course, C-list look better.
If you look at efficiency, C-List look better.
But if you look at accountability and revocation, ACLs look better.
So there obviously these trade offs we have to worry about and
because of that I said most operating systems actually choose to go the ACL
route but we're going to see how maybe we can get the best of both worlds.