AC-03(04) Discretionary Access Control
All changes in this version
Title
Discretionary Access Control
Control
Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following:
(a) Pass the information to any other subjects or objects;
(b) Grant its privileges to other subjects;
(c) Change security attributes on subjects, objects, the system, or the system’s components;
(d) Choose the security attributes to be associated with newly created or revised objects; or
(e) Change the rules governing access control.
Discussion
When discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing the information to other subjects or objects (i.e., subjects have the discretion to pass). Discretionary access control can operate in conjunction with mandatory access control as described in [AC-3(3)](#ac-3.3) and [AC-3(15)](#ac-3.15) . A subject that is constrained in its operation by mandatory access control policies can still operate under the less rigorous constraints of discretionary access control. Therefore, while [AC-3(3)](#ac-3.3) imposes constraints that prevent a subject from passing information to another subject operating at a different impact or classification level, [AC-3(4)](#ac-3.4) permits the subject to pass the information to any subject at the same impact or classification level. The policy is bounded by the system. Once the information is passed outside of system control, additional means may be required to ensure that the constraints remain in effect. While traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this particular use of discretionary access control.
Parameters
ac-3.4_prm_1: organization-defined discretionary access control policy
ac-03.04_odp.01: discretionary access control policy
ac-03.04_odp.02: discretionary access control policy
STIG rules that implement this control 19
Application Security and Development V6R5
- APSC-DV-000470 CAT II The application must enforce organization-defined discretionary access control policies over defined subjects and objects.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-431010 CAT II Ubuntu 22.04 LTS must have the "apparmor" package installed.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100500 CAT II Ubuntu 24.04 LTS must have AppArmor installed.
Microsoft Windows 11 V2R11
- WN11-00-000070 CAT I Only accounts responsible for the administration of a system must have Administrator rights on the system.
- WN11-00-000080 CAT II Only authorized user accounts must be allowed to create or run virtual machines on Windows 11 systems.
- WN11-00-000095 CAT II Permissions for system files and directories must conform to minimum requirements.
Microsoft Windows Server 2022 V2R11
- WN22-00-000140 CAT II Windows Server 2022 permissions for the system drive root directory (usually C:\) must conform to minimum requirements.
- WN22-00-000150 CAT II Windows Server 2022 permissions for program file directories must conform to minimum requirements.
- WN22-00-000160 CAT II Windows Server 2022 permissions for the Windows installation directory must conform to minimum requirements.
Microsoft Windows Server 2025 V1R4
- WN25-00-000140 CAT II Windows Server 2025 permissions for the system drive root directory (usually C:\) must conform to minimum requirements.
- WN25-00-000150 CAT II Windows Server 2025 permissions for program file directories must conform to minimum requirements.
- WN25-00-000160 CAT II Windows Server 2025 permissions for the Windows installation directory must conform to minimum requirements.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-600500 CAT II RHEL 10 must restrict the use of the "su" command.
- RHEL-10-701070 CAT II RHEL 10 must enable kernel parameters to enforce discretionary access control (DAC) on hardlinks.
- RHEL-10-701080 CAT II RHEL 10 must enable kernel parameters to enforce discretionary access control (DAC) on symlinks.
- RHEL-10-701180 CAT II RHEL 10 must disable acquiring, saving, and processing core dumps.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-213030 CAT II RHEL 9 must enable kernel parameters to enforce discretionary access control (DAC) on hardlinks.
- RHEL-09-213035 CAT II RHEL 9 must enable kernel parameters to enforce discretionary access (DAC) control on symlinks.
- RHEL-09-432035 CAT II RHEL 9 must restrict the use of the "su" command.