Answer Set #6

Problem Set questions appear in black, and Answers appear in this magenta color.

1. What does the acronym ACL represent? What does an ACL do? What makes up an ACL?

• ACL = Access Control List.
• An ACL is used by Windows NT to control access to any given system object.
• An ACL is made up of one or more ACEs, or Access Control Entries.

2. With an ACE, what type of entries are typically listed first?

• No access or deny access entries are typically listed first.

3. When a user logs on to Windows NT, what are the three pieces of information needed so Windows NT can verify the request?

• Username
• Password (even if blank)
• From field. The "From" field tells Windows NT which Accounts Database to use to validate the account logon.

4. What is generated for a user by Windows NT's Win32 Winlogon upon a successful logon, and kept with the user until they log off?

• An Access Token, or Security Access Token

5. Name a couple of things that are contained within the "thing" that Windows NT constructs for a user (see question #4)?

• The user's SID, any associated Group SIDs, Privileges for the user.

6. Consider this dialog box, and its data for the following questions:

a. If Famke is only in the Actresses Group and Users Group, and wants to view the file FAMKE75.BMP, is she allowed to do this? Why or why not?

• Yes, she is allowed to view the file. Note that the Users Group isn't even addressed up above, and this doesn't change anything for Famke's request upon the file.

b. If Famke is not in any Groups, and wants to make changes to the file FAMKE75.BMP, is she allowed to do this? Why or why not?

• No, she is not allowed to make changes to the file. As Famke, and not being in any group which allows changes, she is restricted to Read only access.

c. If Famke is only in the Actresses Group, is she allowed to take ownership of the file FAMKE75.BMP? Why or why not?

• No, she isn't. As Famke, and with the Actresses Group, she doesn't have the O permission to take ownership of the file.

d. If Famke is in both the Actresses Group, the Models Group, and the Administrators Group, is she allowed to view the file FAMKE75.BMP? If she can, then explain. If she can't, also explain, and suggest how she might be able to still get access to the file.

• No, Famke isn't allowed to view the file because Famke's association with the Models Group denies her access to the file. However, and more importantly, because of her association with the Administrators Group, she can either take ownership of the file and/or change the permissions on the file to allow herself to view the file.

7. If a user's process makes a request to an object (i.e. a file object), and the request is authorized, what does Windows NT grant or give to the users process object table? How is the use of this particular item different for subsequent requests, compared to the first time the object was requested?

• A handle is granted to the user's process object table, specifying what rights the user has to the object (based upon the request the user's processes initially made to the object). For subsequent and similar requests, only the process object table needs to be checked for the adequate handle. If the request changes, then the object's ACL must then be rechecked to see if the request can be honored. If the request can be honored, a new handle is granted to the user's process object table.

8. Scenario: User FoxM is not a member of any Groups. As FoxM, he has no permissions to access a file named SCULLY.TXT. So, one day FoxM logs on and tries to access the file. Of course, he sees an "Access Denied" message on his screen. While still logged on, FoxM calls his system administrator and demands to have at least Read access to the file. Reluctantly, the system administrator grants FoxM Read access to SCULLY.TXT by adding FoxM to the X-Files Group (and the X-Files Group has Read access to SCULLY.TXT) and tells FoxM over the phone that he can now access the file for Read access. FoxM immediately tries to access SCULLY.TXT, but is denied again! Needless to say, he screams in exasperation. What happened and why couldn't FoxM access the file? What must he do to access the file?

• The system administrator added FoxM to the X-Files Group, however because FoxM did not log off, and then log back on to renew his Security Access Token, he was denied access. In order to renew his Security Access Token, FoxM must log off, then log back on -- because Security Access Tokens are only created when a user logs on.

Return to Main Index