jperezduerto.info
Security in depth · Unit 22 · Lesson 29 of 44
Integrity levels are another input
Explain different results for two same-user processes using a supplied integrity policy.
Helpful before thisWindows privilege escalation
After this lesson you can
- Separate discretionary permission from a mandatory no-write-up restriction.
Two inputs to one decision
Mandatory Integrity Control compares process and object integrity labels with mandatory policy. It adds restrictions alongside a discretionary access control list, or DACL. A familiar username and an allowing DACL therefore do not describe the whole access decision.
Integrity is not a quality rating for software. A high-integrity process is not necessarily well written or trustworthy. Nor does matching integrity grant access that a DACL withholds. The applicable object type, requested operation, and policy all matter.
A fictional permission packet
Both processes below belong to Dana. Assume fresh checks on ordinary file content, no privilege overrides, and no other restrictions.
| Supplied record | Value |
|---|---|
| Process Preview | Low integrity |
| Process Editor | Medium integrity |
| File label | Medium integrity |
| File mandatory policy | No write up only |
| DACL for Dana | Read and write allowed |
Preview’s write request is denied by the no-write-up rule. Editor’s ordinary read and write requests pass the supplied checks. Preview’s read is not blocked by this particular mandatory policy, and its DACL permits reading. A separate no-read-up policy would change that reasoning; none is supplied here.
Explain the limit
The review should preserve the distinction between identity and integrity rather than “fixing” the denial with an unnecessarily broad discretionary grant. More DACL authority does not satisfy the missing mandatory condition. Also avoid describing Preview as a complete sandbox: this packet covers one file and two operations, not every resource or communication channel available to the process.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Both processes have the same user identity and a file DACL allowing read/write. The file is medium integrity with no-write-up policy. Why is the low-integrity process denied writing?
Show the answer
Correct answer: The applicable integrity policy blocks writing upward despite the discretionary grant. Identity and the DACL do not remove the additional mandatory check.
Try it
- WriteWrite a two-row result table for the low- and medium-integrity processes. Record read and write outcomes, the policy explaining the difference, and one assumption that must remain true.