Support for discretionary role based access control in ACL-oriented operating systems

‘Ilie iml~lemrlil.at,ioli of discr&ionary role-lmscd it<‘cess cY)ntrol nic~c&anisnis in standard operat,ing syst)ems like [inix suffers from t#he inahilit,y of t,hta systclii t,o allow a user t,o r&rict, his processes’ cont,rol over his own ohjtct~s. Hy cxploit,ing t,he user’s a~t‘ss right,s tro,jan horses, possibly hidden in down1oadetl (~x(~cutabI(~ corit,enl,, (‘an u~itlcrrriine t tic access c-0111.rol policy l,o perform t.heir malicious t,asks. This paper present,s an approach t.o restrict the rights of procPssr,s l)y switching bct,wccn hicrarcliically organized user drfiued subdomains with simple system calls. ‘JI~~w doniains can be used t,o implenient certain disc,rr,t iona.ry role based access control policies.