🎭 Access Control Models
Four models for deciding who can do what — and when⏱ ~3 min
A school has different access levels: students can enter classrooms but not the principal's office; teachers can enter their classrooms and the faculty lounge; the principal can enter everything; custodians can enter after hours. Access control systems implement these rules digitally — deciding who (subjects) can do what operations (read, write, execute, delete) on which resources (objects). The model determines the logic for making those decisions.
Four Access Control Models
| Model | Abbreviation | How Decisions Are Made | Who Controls Access | Best For |
|---|---|---|---|---|
| Role-Based Access Control | RBAC | Access granted based on job role; all Finance staff get Finance permissions | Administrator assigns roles | Large organizations; clear job hierarchies; most common in enterprise environments |
| Rule-Based Access Control | RuBAC | Access granted based on conditions: time of day, location, device type | Administrator creates rules | Adding time/location restrictions: 'Students can only access gradebook 8AM-4PM on school network' |
| Discretionary Access Control | DAC | Object owner decides who can access it; can grant permission to anyone | File/object owner | Home users; small teams; Google Docs sharing model |
| Mandatory Access Control | MAC | System-enforced levels; users cannot override; based on classification labels | System/administrator (not user) | Government/military; highest-security environments; users can't accidentally share classified data |
Bell-LaPadula Model (MAC for Confidentiality)
The Bell-LaPadula model is a specific MAC implementation focused on confidentiality — keeping secrets secret. Users and files both have security levels (Unclassified → Confidential → Secret → Top Secret). Two rules govern all access:
- •No Read Up (Simple Security Property) — you can only read data at your level or below. A Secret-cleared user CANNOT read a Top Secret document.
- •No Write Down (Star Property) — you can only write to your level or above. A Secret-cleared user CANNOT copy data into a Confidential file. This prevents accidentally 'leaking down' classified information to lower-cleared users.
- •Why No Write Down matters: if you could write down, a Secret-cleared user could paste Top Secret information into a Confidential document that Confidential-cleared users can read — leaking classified content.
- •School analogy: the principal (Top Secret) can't paste content from expulsion records (Top Secret) into the public newsletter (Unclassified) — the model blocks it at the system level.
Zero Trust Architecture
Traditional security assumed: 'if you're inside the network, you're trusted.' Zero Trust flips this: 'never trust, always verify — regardless of location.' Every access request is authenticated, authorized, and logged, even from inside the network. This is the modern architecture because remote work, cloud services, and insider threats have made the network perimeter irrelevant.
Linux File Permissions — Access Control in Practice
Linux implements DAC through the rwx permission system. Every file has an owner (User), a group (Group), and permissions for everyone else (Others). Each set can have: r (read), w (write), x (execute). Example: -rwxr-x--- means: • First character '-': regular file (d = directory) • rwx: owner can read, write, execute • r-x: group can read and execute, not write • ---: others have no access
| Permission String | File Type | Owner | Group | Others | Meaning |
|---|---|---|---|---|---|
| -rw-r--r-- | File | Read+Write | Read only | Read only | Owner can edit; everyone can read (e.g., public web page) |
| -rwxr-x--- | File | Read+Write+Execute | Read+Execute | No access | Owner runs it; group runs it; others locked out (e.g., a script) |
| drwxr-x--- | Directory | Full control | Enter+list | No access | Owner manages folder; group can browse; others cannot see inside |
| -rw------- | File | Read+Write | No access | No access | Only owner can access (e.g., private key file — must be this tight) |
A hospital uses a Mandatory Access Control system. A nurse (Confidential clearance) is treating a patient and needs to document their care. She tries to copy text from a Top Secret research protocol file to include in the patient's regular Confidential medical record. The system blocks her. She has a legitimate clinical reason. What Bell-LaPadula rule blocked her, and why does MAC enforce this even against legitimate users?