Safety in Access Control Matrix and Take-Grant Model

Question

I'm learning about the Take-Grant Model and Access Control Matrix, and I have a couple of questions regarding leaking and the safety question.

Definitions

These are the definitions I am using (see for example here [pdf]:)

• Leaking: Adding a generic right r where there was not one
• Safe: If a system S cannot leak right r, it is safe with respect to right r
• Safety Question: Does an algorithm exist to determine whether a protection system S is safe with respect to generic right r?

Access Control Matrix

Lets say we have an access control matrix:

    S1      S2      O1
S1  o               r
S2  r,w,x   o

• Could you say that in this matrix, the right r of S1 over O1 is leaked to S2 (because S2 can use S1 to access O1)?
• or would you need a sort of copy right, which allows actual copying of a right from one field to another? And if so, wouldn't most systems that have a copy right automatically be unsafe (see also my question regarding the take-grant model)?

Take-Grant Model

• In the take-grant model, can a system only ever be safe if for every subject S1 that has right t over another subject S2 it also has all the rights S2 has over any objects and subjects?
• and if not, why not? Am I misunderstanding what leaking means?

So for example this:

would not be safe, because S1 could get right r over O1 from S2, and thus there would be a right r where there was not one before?

In this case, a safe system would need to be designed like this?:

This would seem a little odd to me, because if that was the case, the take right (or the grant right) would not make that much sense (at least if one wants to create a safe system).

Answer 1

I'm gonna try to answer you separately:

Access Control Matrix

Q: "Could you say that in this matrix, the right r of S1 over O1 is leaked to S2 (because S2 can use S1 to access O1)?"

A: No. If you consider the execution right to behave like a take right, then yes, S1's reading rights over O1 have leaked to S2, because originally S2 had no rights over O1. But the papers i could find only showed that behavior when S2 had own rights over S1. Therefore, your example S1 rights would not leak to S2 because S2 did not have own rights over S1.

Take-Grant Model

Q: "In the take-grant model, can a system only ever be safe if for every subject S1 that has right t over another subject S2 it also has all the rights S2 has over any objects and subjects?"

A: That is correct. Remember that, according to definitions 3-1 and 3-2 in the document you linked, the security of your system is calculated on a right-by-right basis. If you convert it to a Turing Machine, your system is considered safe when, given all the possible operations, starting from an initial state s0, it is not possible to achieve a state sN where a Subject has any right that it did not have originally. To put it clearer:

Is there an arbitrary sequence of commands that adds a generic right into a cell of the access matrix where it has not been in the initial configuration?

I think that the graph you created was not very didactic. If you're willing, the second link i post here gives a better notion of the available operations and the possible resulting graphs.

The third link references the original paper that described the Take-Grant model. In this paper, they use the name "call" in one of the described commands. You should note that this operation is related to the right of creating new nodes in a graph, it is not the concept of execution right we used above, ok?

References:

https://www.cs.columbia.edu/~smb/classes/f05/l03.pdf
http://www.volkerroth.com/ss09-itsec/03.pdf
https://cs.nmt.edu/~doshin/t/s06/cs589/pub/2.JLS-TG.pdf