- [Instructor] In a discretionary access
control system, resource owners have the ability
to set and modify permissions for other users
of the system.
File owners manage resource permissions
by the creation of access control lists.
An access control list is simply a table containing
user names and the permissions granted
to each user of a resource.
For example, I might own a file on a computer governed
by a discretionary access control system
and decide that I want other users to access my file.
I might grant one user the ability to edit the file
and a large group the ability to read the file.
Each one of these decisions would require an entry
in an access control list.
The NTFS file system used by Windows implements
access control lists and allows users to assign
a variety of permissions.
Full control is just what the name implies.
The user can perform any action on the file or folder.
Read permission allows the user to view
the contents of the file.
Read and execute permission goes beyond
the read permission and also allows the user
to run executable programs.
Write permission allows the user to create files
and add data to them.
Modify goes beyond write to allow the user to delete files.
It also adds read and execute permissions
not already present in the write permission group.
Let's take a look at an example.
Suppose we have a file of employee information
and want to setup access for four users.
Alice should be the owner of the file
and Bob should have full control of it.
Tracy should have read only access
and Carol should have read/write access to the file.
Let's go ahead and look at this on a real Windows server.
Here's our documents folder and it contains
an employee file.
If I right click on that file,
and then bring up the properties menu,
I see some general information about the file.
I'm interested in security settings.
So I go ahead and click on the security tab.
The first thing I want to do is set Alice
as the file owner.
I do that by clicking Advanced which opens
the file's advanced security settings.
You can see here that I currently own the file.
I click on the change icon next to the owner
entry to change it.
Alice's user name is AJones so I enter that here
and click the Check Names box.
Once that underline appears underneath it,
it means that the system has recognized
this user name.
I click okay to complete the change
and you can see that Alice now owns the file.
I also want to make Alice's life easier
so I want to give her explicit full control
permissions on the file.
I can do this back here in the permissions dialog
by clicking the Add button.
I click Select a principal, and then enter
Alice's user name again.
I want her to have full control of this file
so I check that box and then click okay.
You can now see that Alice has full control of the file.
The second user I want to have permissions is Bob.
He won't be the file owner, but he should
also have full control.
So I repeat this process using Bob's account, randrews.
I click full control and okay,
and now you can see here that Bob's account
also has full control of the file.
Tracy on the other hand should only
be able to read the file.
So let's go ahead, click the Add button,
Select a principal, and enter Tracy's user name, tsmith.
Click on Check names, we see that that user name has
indeed been validated.
So I'm going to click okay.
And then I'm going to make sure that she has
only read permission by unchecking the read
and execute that was here by default
and leaving only the read permission selected.
I click okay and we can now see that Tracy has
read permission on this file.
Finally, I want to give Carol read and write
and execute permissions.
Go ahead and click Add.
Select a principal, enter Carol's user name
which is cadams, check that name.
It gets verified.
And now I go ahead and look at the permissions here.
She has read and execute and read checked by default.
I'm just going to add the write permission
and click okay.
And then I can see that Carol's account has
the appropriate permissions.
If you look through this dialog
and then compare it to the previous slide,
you can see that we've established
the desired set of permissions.
That's the power of discretionary access control.
I didn't need to modify the file attributes
or account roles to make this work.
As the file owner or system administrator,
I have the discretion to set whatever permissions
I deem appropriate.