Store one access matrix three ways — as an ACL (a column), as a capability list (a row) and as an authorization table of triples — and confirm they hold the same rights.

Answer

MATRIX = { "alice": {"roster.csv": "rwo", "payroll.db": "r", "audit.log": "", "deploy.sh": "rx"}, "bob": {"roster.csv": "r", "payroll.db": "rwo", "audit.log": "r", "deploy.sh": "x"}, "svc_backup": {"roster.csv": "r", "payroll.db": "r", "audit.log": "rwo", "deploy.sh": ""}, } SUBJECTS = ["alice", "bob", "svc_backup"] OBJECTS = ["roster.csv", "payroll.db", "audit.log", "deploy.sh"] def acl(obj): """One COLUMN of the matrix: who may do what to this object.""" return [(s, MATRIX[s][obj]) for s in SUBJECTS if MATRIX[s][obj]] def capabilities(sub): """One ROW of the matrix: what this subject may reach.""" return [(o, MATRIX[sub][o]) for o in OBJECTS if MATRIX[sub][o]] def auth_table(): """One entry per (subject, right, object) triple.""" return [(s, r, o) for s in SUBJECTS for o in OBJECTS for r in MATRIX[s][o]] print("ACL of payroll.db :", acl("payroll.db")) print("caps of svc_backup:", capabilities("svc_backup")) rows = auth_table() print("authorization table rows:", len(rows)) print("first row:", rows[0])

Stallings & Brown, Computer Security 5e, ch4 §4.1–§4.5