I'm learning about the Take-Grant Model and Access Control Matrix, and I have a couple of questions regarding leaking and the safety question.
These are the definitions I am using (see for example here [pdf]:)
- Leaking: Adding a generic right r where there was not one
- Safe: If a system S cannot leak right r, it is safe with respect to right r
- Safety Question: Does an algorithm exist to determine whether a protection system S is safe with respect to generic right r?
Access Control Matrix
Lets say we have an access control matrix:
S1 S2 O1 S1 o r S2 r,w,x o
- Could you say that in this matrix, the right r of S1 over O1 is leaked to S2 (because S2 can use S1 to access O1)?
- or would you need a sort of copy right, which allows actual copying of a right from one field to another? And if so, wouldn't most systems that have a copy right automatically be unsafe (see also my question regarding the take-grant model)?
- In the take-grant model, can a system only ever be safe if for every subject S1 that has right t over another subject S2 it also has all the rights S2 has over any objects and subjects?
- and if not, why not? Am I misunderstanding what leaking means?
So for example this:
would not be safe, because S1 could get right r over O1 from S2, and thus there would be a right r where there was not one before?
In this case, a safe system would need to be designed like this?:
This would seem a little odd to me, because if that was the case, the take right (or the grant right) would not make that much sense (at least if one wants to create a safe system).