In contrast to the DAC model, which is oriented around objects, the AzMan RBAC model attempts to orient the common administrative experience around user roles. Rather than assigning permissions to objects, an AzMan RBAC framework enables applications to present administrators with a management experience more aligned with the organizational structure of a company. AzMan RBAC provides a central object—a role—that a user is assigned to perform a particular job or application function. Ideally, an RBAC application is designed such that the administrator requires less knowledge of the object storage structure. This approach can be used if the RBAC application provides a simplifying abstraction into resource collections referred to as scopes.
Can someone please explain to me how this is any different at all from user/group ACLs?
Say I want managers to have read access to /mnt/network_performance_reports, sysadmins to have full read/write access, and everyone else to have no access.
I would think that (on Linux with POSIX ACLs, I don't really know Windows) I could
- set a default ACL on /mnt so everything under it is effectively chmod 0700 (directories) or 0600 (files).
- create a sysadmins group and set up a read/write default ACL for sysadmins
- create a managers group and set up a read-only default ACL for managers
That's not exactly easy to manage (not centralized, blech!) but it does the same thing, doesn't it? I don't think I'm quite understanding the concept.
When people talk about RBAC in operating systems, are they effectively talking about a layer of abstraction on top of MAC/DAC systems to make management of those easier for large organizations? Or are they talking about something that is different internally; i.e. is associated with completely different methods and data structures in the the OS kernel?