Working with Access Control Lists (ACL)
1. Understanding ACL Concepts
| Concept | Detail |
|---|---|
| Definition | List of (principal, permission) entries attached to a resource |
| Granularity | Per-object — fine-grained |
| Best for | Document sharing, file systems |
| Vs RBAC | ACL = object-centric; RBAC = role-centric |
2. Defining ACL Entries
Example: ACL row
CREATE TABLE acls (
resource_type TEXT, resource_id BIGINT,
principal_type TEXT, -- "user" | "group"
principal_id BIGINT,
permission TEXT, -- "read" | "write" | "delete" | "share"
granted_at TIMESTAMPTZ,
PRIMARY KEY (resource_type, resource_id, principal_type, principal_id, permission)
);3. Implementing Object-Level Permissions
| Operation | Detail |
|---|---|
| Grant | INSERT ACE |
| Revoke | DELETE ACE |
| Check | Lookup (resource, principal, permission) — index for O(1) |
| List shares | WHERE resource_id matches |
4. Setting File System ACLs
| System | Tool |
|---|---|
| POSIX | setfacl -m u:alice:rwx file |
| NFSv4 | Detailed ACEs, inheritance flags |
| Windows NTFS | icacls |
| S3 | Bucket policies preferred over object ACLs |
5. Implementing Discretionary ACL
| Aspect | DAC |
|---|---|
| Owner controls | Resource owner grants/revokes access |
| Example | Google Docs sharing |
| Risk | Owner can over-share |
6. Implementing Mandatory ACL
| Aspect | MAC |
|---|---|
| Policy set by | System / security admin |
| Owner can change? | No |
| Example | SELinux, military classification (Bell-LaPadula) |
| Use | High-security environments |
7. Using ACL Inheritance
| Concept | Detail |
|---|---|
| Inheritance flag | Children inherit parent's ACEs |
| Override | Child can add explicit ACEs that supersede |
| Propagation | On parent change, recompute or store materialized path |
| Tree model | Folder → file inheritance (Drive, S3 prefix) |
8. Checking ACL Permissions
Example: Check with group expansion
SELECT 1 FROM acls
WHERE resource_type='doc' AND resource_id=$1 AND permission=$2
AND ((principal_type='user' AND principal_id=$3)
OR (principal_type='group' AND principal_id IN (
SELECT group_id FROM user_groups WHERE user_id=$3)))
LIMIT 1;9. Implementing ACL Precedence Rules
| Rule | Order |
|---|---|
| Explicit deny | Highest priority (overrides allow) |
| Explicit allow | Next |
| Inherited deny | Lower |
| Inherited allow | Lower |
| Default | Deny |
10. Managing ACL Performance
| Optimization | Detail |
|---|---|
| Indexing | (resource_id, principal_id, permission) |
| Materialized views | Expanded user→permissions per resource |
| Caching | Decision cache with invalidation on grant change |
| Sharding | By resource_id or tenant |
| Zanzibar-style | Google's relationship graph for billions of objects |