Subject, object, operation and permission
From Erights
(Relationship with the same notions defined in the standard literature was clarified.) |
|||
| Line 1: | Line 1: | ||
| + | We use the terms '''subject''', '''object''', '''operation''' and '''permission''' consistently with a standard access control literature. | ||
| + | |||
== Definition == | == Definition == | ||
| Line 13: | Line 15: | ||
== See also == | == See also == | ||
| - | + | These are standard notions and they are defined in various other places: | |
| + | * in the [http://www.amazon.com/Operating-Systems-Implementation-Prentice-Software/dp/0131429388/ref=sr_1_14?ie=UTF8&s=books&qid=1245137182&sr=8-14 MINIX Book] (Section 5.5) | ||
| + | * [http://en.wikipedia.org/wiki/Subject_(access_control)#Computer_security in Wikipedia]. | ||
| - | + | == Notes == | |
People (outside capability community) often confuse the following two terms: | People (outside capability community) often confuse the following two terms: | ||
Revision as of 06:11, 20 June 2009
We use the terms subject, object, operation and permission consistently with a standard access control literature.
Definition
From a security point of view, we recognize subjects and objects
Subjects are active entities (e.g. UNIX processes) with some behavior. Subjects can designate objects and try to perform some supported operations with them.
What kind of operations can be performed with an object depends on its type.
In general, the set of existing objects and subjects changes over time.
Permissions is a relation that defines which operations on what objects are permitted for particular subjects. One way how to capture permissions is the protection matrix.
See also
These are standard notions and they are defined in various other places:
- in the MINIX Book (Section 5.5)
- in Wikipedia.
Notes
People (outside capability community) often confuse the following two terms:
- permissions (defined in this article)
- and authority.
Real security audit cannot be performed without determining the authority of particular subjects.
