Simulation Lab 13.1: Module 13 Using Discretionary Access Control

Simulation Lab 13.1: Module 13 Using Discretionary Access Control

In today’s interconnected environments, understanding how permissions are granted and revoked is essential for securing data and systems. 1: module 13 using discretionary access control** walks learners through a hands‑on scenario where they create, modify, and audit access rights using the DAC model. **Simulation lab 13.By the end of the lab, participants will be able to explain the core principles of discretionary access control, implement user‑based permissions in a controlled setting, and recognize common pitfalls that can lead to privilege escalation or data leakage No workaround needed..

Overview of the Lab

The simulation lab is designed for students and IT professionals who want to reinforce theoretical knowledge of access control mechanisms with practical experience. Module 13 focuses specifically on discretionary access control (DAC), a model where the owner of an object (file, directory, or resource) decides who may access it and what type of access (read, write, execute) is permitted Turns out it matters..

This is the bit that actually matters in practice.

Key takeaways from this lab include:

• Identifying DAC components – subjects, objects, and access control lists (ACLs).
• Configuring permissions using command‑line tools or graphical interfaces within the simulated environment.
• Auditing changes to see to it that only authorized modifications occur.
• Evaluating security implications of overly permissive or overly restrictive settings.

Prerequisites

Before launching simulation lab 13.1: module 13 using discretionary access control, ensure the following:

1. A working virtual machine or container that hosts the lab environment (typically a Linux‑based system with Samba or NFS shares).
2. Basic familiarity with file system permissions (chmod, chown, setfacl, getfacl).
3. Administrator or root access to the simulated host for initial setup.
4. A web browser or SSH client to interact with the lab’s management console.

If any of these items are missing, the lab’s preparation guide provides quick installation scripts to get you started Simple, but easy to overlook..

Step‑by‑Step Procedure

Below is the detailed workflow you will follow in the lab. Each step is numbered for clarity, and important actions are highlighted in bold.

1. Initial Exploration

• Log in to the lab host as the labuser account.
• figure out to the shared directory /srv/dac_share.
• Run ls -l to view the current ownership and permission bits.
• Note that the directory is owned by root:root with mode 755.

2. Creating a Resource Owner

• Switch to the admin account (su - admin).

• Create a new file named project_plan.txt inside the share:

  echo "Draft version 1.0" > /srv/dac_share/project_plan.txt
  

• Verify ownership with ls -l /srv/dac_share/project_plan.txt. The file should now be owned by admin:admin.

3. Setting Discretionary Permissions

• As the file owner, grant read and write access to the developers group:

  chmod 660 /srv/dac_share/project_plan.txt
  

• Alternatively, use an ACL for finer granularity:

  setfacl -m g:developers:rw /srv/dac_share/project_plan.txt
  

• Confirm the ACL with getfacl /srv/dac_share/project_plan.txt Not complicated — just consistent..

4. Testing Access from Different Subjects

• Switch to a user belonging to the developers group (su - dev1).

• Attempt to read and edit the file:

  cat /srv/dac_share/project_plan.txt
  echo "Added milestone" >> /srv/dac_share/project_plan.txt
  

• Both commands should succeed, confirming that the discretionary rule works.

• Now switch to a user not in the developers group (su - guest) Simple, but easy to overlook. Turns out it matters..

• Try the same read/write operations; they should fail with “Permission denied”.

5. Modifying Ownership and Delegating Control

• Return to the admin account and change the file’s owner to dev1:

  chown dev1:developers /srv/dac_share/project_plan.txt
  

• Observe that dev1 can now change the file’s ACLs, demonstrating the discretionary nature of the model—ownership transfers control The details matter here..

6. Auditing Changes

• Enable basic audit logging (if not already active):

  auditctl -w /srv/dac_share/project_plan.txt -p rwxa -k dac_watch
  

• Perform a few read/write actions from various accounts.

• Review the audit log with ausearch -k dac_watch or ausearch -f /srv/dac_share/project_plan.txt.

• Note the recorded UID, GID, and operation type for each event.

7. Cleaning Up

• Remove the audit rule: auditctl -W /srv/dac_share/project_plan.txt -p rwxa -k dac_watch.
• Delete the test file: rm /srv/dac_share/project_plan.txt.
• Reset any modified ACLs to the default state using setfacl -b /srv/dac_share/*.

Scientific Explanation of Discretionary Access Control

Discretionary access control is rooted in the access control matrix model, where each cell defines the rights a particular subject holds over a specific object. In DAC:

• Subjects are users or processes that initiate actions.
• Objects are files, directories, devices, or any resource needing protection.
• Access rights are typically limited to read (r), write (w), and execute (x).

The discretion aspect means that the owner of an object can unilaterally alter the ACL associated with that object. This contrasts with mandatory access control (MAC), where a central policy enforces restrictions regardless of owner preferences.

Mathematically, if we denote the set of subjects as S, objects as O, and rights as R ⊆ {r,w,x}, the DAC policy can be expressed as a function:

[

[ \pi : S \times O \rightarrow 2^R ]

Where π(s, o) returns the set of rights that subject s has over object o. The key characteristic of DAC is that for any object o, there exists at least one subject—the owner—who has the authority to modify π(s, o) for all subjects s. This is represented by an additional function:

[ \delta : O \rightarrow S ]

Where δ(o) maps each object to its owner, and only δ(o) can invoke the update operation:

[ \pi'(s, o) = \text{update}(\pi(s, o), \text{permissions}) ]

This mathematical foundation explains why transferring ownership via chown fundamentally alters the security posture of a file—the new owner gains complete discretion over access decisions Small thing, real impact..

Practical Implications and Limitations

While DAC provides flexibility and aligns with traditional Unix security models, it has inherent limitations:

• Privilege Escalation: Since owners have unrestricted control, a compromised account with file ownership can grant access to unauthorized users.
• No Centralized Policy Enforcement: Unlike MAC systems, DAC relies entirely on individual user judgment, making consistent security policies difficult to enforce across an organization.
• Coarse-Grained Controls: Traditional DAC models lack the fine-grained temporal or contextual controls found in more advanced systems.

These limitations have led to the development of hybrid approaches that combine DAC with MAC elements, such as SELinux or AppArmor, which layer additional restrictions on top of discretionary controls The details matter here. Worth knowing..

Conclusion

Discretionary Access Control remains a foundational element of modern operating system security, providing a balance between usability and protection. On top of that, through practical exercises involving ACL manipulation, ownership delegation, and audit logging, we've demonstrated how DAC operates at both the conceptual and implementation levels. Understanding this model is crucial for system administrators and security professionals, as it forms the baseline upon which more sophisticated access control mechanisms are built. As computing environments evolve, the principles of DAC continue to inform the design of security architectures, even as additional layers of mandatory controls are integrated to address its inherent limitations.

Beyond traditional Unix environments, DAC is being adapted to modern paradigms such as containerization and cloud storage. In containerized workloads, user namespaces remap host UID ranges to isolated container IDs, meaning that a change in ownership inside a container affects only the mapped identities on the host. This isolation mitigates the risk of a compromised container granting unrestricted access to host resources, provided that the runtime enforces consistent UID mapping and prevents privilege escalation across namespace boundaries.

Quick note before moving on.

Effective administration of DAC relies on a set of practical techniques. Because of that, administrators should set restrictive default permissions with umask, use setfacl to establish default ACL entries on directories, and periodically audit existing ACLs with getfacl. Even so, integrating auditd to capture permission‑related syscalls offers granular visibility, enabling detection of anomalous access patterns. Additionally, employing the principle of least privilege — assigning only the minimal rights required for a task — reduces the chance that a compromised account can use unrestricted ownership to affect other users It's one of those things that adds up..

The official docs gloss over this. That's a mistake.

Looking ahead, research into capability‑based security suggests a complementary approach where processes receive explicit rights rather than inheriting unrestricted control from ownership. Linux capabilities, for example, allow fine‑grained delegation of permissions such as raw‑io or net‑bind, limiting the impact of ownership changes. In distributed file systems and object stores, POSIX ACLs are extended through network protocols, enabling consistent policy enforcement across heterogeneous environments. As systems grow in complexity, hybrid models that combine DAC with mandatory or capability‑based mechanisms are likely to become the norm, offering both flexibility and enforced security guarantees.

Most guides skip this. Don't.

In a nutshell, Discretionary Access Control provides a flexible yet responsibility‑driven foundation for Unix‑like security. Mastery of its configuration tools, awareness of its limitations, and integration with emerging security models empower administrators to construct resilient, adaptable protection strategies that evolve with contemporary computing infrastructures The details matter here..