Protection and Security

# A reference monitor. Every access is a subject, an object, and a rule --
# and the rule is checked before the operation, not after.
OWNER, GROUP, OTHER = 6, 4, 0        # mode 0640: rw- r-- ---
READ, WRITE = 4, 2

shadow = {"owner": "root", "group": "shadow", "mode": (OWNER, GROUP, OTHER)}
subjects = {
    "root":     {"uid": 0, "groups": ["root"]},
    "alice":    {"uid": 1000, "groups": ["shadow"]},   # group can read only
    "www-data": {"uid": 33, "groups": ["www-data"]},   # neither owner nor group
}

def permitted(who, obj, want):
    s = subjects[who]
    if s["uid"] == 0:
        return True, ""                              # root bypasses the check
    bits = obj["mode"][0] if who == obj["owner"] else \
           obj["mode"][1] if obj["group"] in s["groups"] else obj["mode"][2]
    if bits & want:
        return True, ""
    return False, "no write" if want == WRITE else "no read"

results = []
for who, want in (("root", WRITE), ("alice", WRITE), ("www-data", READ)):
    ok, why = permitted(who, shadow, want)
    results.append(f"{who}:" + ("allow" if ok else f"deny({why})"))

# least privilege held: the web server could not read the password file
breached = permitted("www-data", shadow, READ)[0]
print(" ".join(results) + " | least privilege "
      + ("breached" if breached else "held"))

#include <algorithm>
#include <iostream>
#include <map>
#include <string>
#include <vector>
using namespace std;
// A reference monitor. Every access is a subject, an object, and a rule --
// and the rule is checked before the operation, not after.
const int READ = 4, WRITE = 2;
struct Subject {
    int uid;
    vector<string> groups;
};
struct Object {
    string owner, group;
    int mode[3];
};
map<string, Subject> subjects = {
{
    "root", {0, {"root"}}
},
{
    "alice", {1000, {"shadow"}}
}, // group can read only
{
    "www-data", {33, {"www-data"}}
}, // neither owner nor group
};
Object shadowFile {
    "root", "shadow", {6, 4, 0}
}; // mode 0640
pair<bool, string> permitted(const string& who, const Object& obj, int want) {
    Subject s = subjects[who];
    if (s.uid == 0) return {true, ""}; // root bypasses the check
    int bits;
    if (who == obj.owner) bits = obj.mode[0];
    else if (find(s.groups.begin(), s.groups.end(), obj.group) != s.groups.end())
    bits = obj.mode[1];
    else bits = obj.mode[2];
    if (bits & want) return {true, ""};
    return {false, want == WRITE ? "no write" : "no read"};
}
int main() {
    vector<pair<string, int>> checks = {{"root", WRITE}, {"alice", WRITE}, {"www-data", READ}};
    string out;
    for (auto& c : checks) {
        auto r = permitted(c.first, shadowFile, c.second);
        out += c.first + ":" + (r.first ? "allow" : "deny(" + r.second + ")") + " ";
    }
    bool breached = permitted("www-data", shadowFile, READ).first;
    cout << out << "| least privilege " << (breached ? "breached" : "held") << "\n";
}

import java.util.List;
import java.util.Map;
class Main {
    // A reference monitor. Every access is a subject, an object, and a rule --
    // and the rule is checked before the operation, not after.
    static final int READ = 4, WRITE = 2;
    record Subject(int uid, List<String> groups) {
    }
    record Obj(String owner, String group, int[] mode) {
    }
    static Map<String, Subject> subjects = Map.of(
    "root", new Subject(0, List.of("root")),
    "alice", new Subject(1000, List.of("shadow")), // read only
    "www-data", new Subject(33, List.of("www-data"))); // neither
    static Obj shadow = new Obj("root", "shadow", new int[]{6, 4, 0}); // 0640
    static String[] permitted(String who, Obj obj, int want) {
        Subject s = subjects.get(who);
        if (s.uid() == 0) return new String[]{"true", ""}; // root bypasses
        int bits;
        if (who.equals(obj.owner())) bits = obj.mode()[0];
        else if (s.groups().contains(obj.group())) bits = obj.mode()[1];
        else bits = obj.mode()[2];
        if ((bits & want) != 0) return new String[]{"true", ""};
        return new String[]{"false", want == WRITE ? "no write" : "no read"};
    }
    public static void main(String[] args) {
        String[] who = {"root", "alice", "www-data"};
        int[] want = {WRITE, WRITE, READ};
        StringBuilder out = new StringBuilder();
        for (int i = 0; i < who.length; i++) {
            String[] r = permitted(who[i], shadow, want[i]);
            out.append(who[i]).append(":")
            .append(r[0].equals("true") ? "allow" : "deny(" + r[1] + ")").append(" ");
        }
        boolean breached = permitted("www-data", shadow, READ)[0].equals("true");
        System.out.println(out + "| least privilege " + (breached ? "breached" : "held"));
    }
}