DCAC is a practical OS-level access control system that supports application-defined principals. It allows normal users to perform administrative operations within their privilege, enabling isolation and privilege separation for applications. It does not require centralized policy specification or management, giving applications freedom to manage their principals while the policies are still enforced by the OS. DCAC uses hierarchically-named attributes as a generic framework for user-defined policies such as groups defined by normal users.
DCAC also supports NFSv3.
For more information, please see the USENIX ATC 2014 paper:
Application-Defined Decentralized Access Control
Yuanzhong Xu ([email protected]) Alan M. Dunn ([email protected]) Owen S. Hofmann ([email protected]) Michael Z. Lee ([email protected]) Syed Akbar Mehdi ([email protected]) Emmett Witchel ([email protected])