Permission

Formally, permissions are entries in Lampson's access matrix (1971): subjects as rows, objects as columns, rights in the cells. Real systems store the matrix sparsely, either by column as access control lists attached to objects, or by row as capabilities held by subjects. Unix and Windows are ACL-based for files; file descriptors and Windows handles behave like capabilities once obtained, since rights are checked at open time and cached in the handle.

Classic Unix permissions are 12 mode bits: read, write and execute for owner, group and others, plus setuid (4000), setgid (2000) and the sticky bit (1000). Directory semantics differ from files: r lists names, x allows traversal, and w on a directory allows creating and deleting entries regardless of the files' own permissions, which is why world-writable directories like /tmp need the sticky bit (mode 1777). The umask (commonly 022 or 027) removes bits from newly created files. POSIX ACLs add named users and groups with a mask entry, and Linux capabilities split root's power into units such as CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN and CAP_DAC_OVERRIDE, so a program can hold only what it needs. Setuid-root binaries remain a steady source of local privilege escalation because any bug in them runs with full rights.

Windows associates each securable object with a security descriptor containing an owner SID and a discretionary ACL of access control entries. The access check compares the ACEs with the SIDs in the caller's access token, evaluating them in order; canonical ordering puts explicit deny before explicit allow before inherited entries, and an object with a NULL DACL grants everyone full access while an empty DACL grants no one anything. Inheritance propagates ACEs down folder trees. For network shares the effective access is the more restrictive of share and NTFS permissions. Separately, user rights (privileges) such as SeDebugPrivilege, SeBackupPrivilege and SeImpersonatePrivilege bypass object ACLs entirely; the last is behind the "Potato" family of escalations from service accounts to SYSTEM. Mandatory integrity levels (Low, Medium, High, System) add a no-write-up rule on top of the DACL.

Discretionary access control lets owners grant rights at will; mandatory access control (SELinux, AppArmor, Windows integrity levels) enforces a system policy that owners cannot override. Higher-level models such as RBAC and ABAC (NIST SP 800-162) decide which permissions an account should have, but they are ultimately enforced as low-level permissions like these. The operational problems are privilege creep, where people accumulate rights across role changes, over-broad grants such as Everyone or Authenticated Users on shares, and permissions that are never reviewed. ISO/IEC 27001:2022 addresses this in Annex A 5.15 (access control), 5.18 (access rights) and 8.2 (privileged access rights), and least privilege, together with periodic access reviews, remains the governing principle.