On safety in discretionary access control

An apparently prevailing myth is that safety is unde-cidable in Discretionary Access Control (DAC); there-fore, one needs to invent new DAC schemes in which safety analysis is decidable. In this paper, we dispel this myth. We argue that DAC should not be equated with the Harrison-Ruzzo-Ullman access matrix scheme [10], in which safety is undecidable. We present an efficient (running time cubic in its input size) algorithm for decid-ing safety in the Graham-Denning DAC scheme [8], which subsumes the DAC schemes used in the literature on com-paring DAC with other access control models. We also counter several claims made in recent work by Solworth and Sloan [27], in which the authors present a new ac-cess control scheme based on labels and relabelling and assert that it can implement the full range of DAC models. We present a precise characterization of their access con-trol scheme and show that it does not adequately capture a relatively simple DAC scheme. 1