ACL

ACL — resource yoki object uchun qaysi user, group yoki principal qanday operation bajarishi mumkinligini ko‘rsatadigan access control ro‘yxati. To‘liq nomi Access Control List. ACL file system, network qurilma, cloud storage, API, database va boshqa tizimlarda permissionlarni aniq obyekt darajasida boshqaradi.

ACL odatda resource bilan bog‘lanadi va bir nechta access entry’lardan tashkil topadi.

Access Control Entry

ACL ichidagi bitta yozuv Access Control Entry, qisqacha ACE deb ataladi.

ACE odatda quyidagilarni saqlaydi:

principal;
allow yoki deny;
permission;
scope;
inheritance;
qo‘shimcha flaglar.

Masalan:

User: Farrukh
Permission: read, write
Effect: allow

Principal

Principal access qarorida ishtirok etadigan identity:

user;
group;
service account;
application;
device;
anonymous;
authenticated users.

Group orqali ko‘p userga bir xil permission berish boshqaruvni soddalashtiradi.

Permission

Permission resource turiga qarab farq qiladi.

File uchun:

read;
write;
execute;
delete;
change permission.

Network ACL uchun:

source;
destination;
port;
protocol;
allow yoki deny.

Cloud object uchun read, upload, list yoki ownership bo‘lishi mumkin.

Allow va deny

ACL entry operationga ruxsat yoki taqiq beradi.

Bir userga group orqali allow, boshqa entry orqali deny kelishi mumkin.

Qaysi biri ustun kelishi platformaning evaluation qoidalariga bog‘liq.

Deny-overrides modeli ko‘p tizimlarda xavfsizroq, ammo har doim bir xil emas.

Default deny

ACLda aniq ruxsat bo‘lmasa operation rad etilishi mumkin.

Bu default deny tamoyili.

Ba’zi legacy tizimlar default allow bilan ishlashi ehtimoli bor.

Security-sensitive resource uchun explicit allow va minimal entry ishlatiladi.

File system ACL

Oddiy owner-group-other permission yetarli bo‘lmaganda extended ACL ishlatiladi.

Masalan:

owner to‘liq access;
accountant group read;
auditor faqat read;
boshqa userga access yo‘q.

File ko‘chirilganda yoki yangi directory yaratilganda inheritance qoidalari muhim.

Inheritance

Parent directory yoki object permissionlari child resource’larga meros bo‘lishi mumkin.

Afzalligi — ko‘p filega qo‘lda permission bermaslik.

Kamchiligi — yuqori parentdagi noto‘g‘ri allow minglab child obyektga tarqalishi mumkin.

Inherited va explicit entrylar alohida ko‘rsatiladi.

Network ACL

Router, firewall yoki cloud subnetda packetlar source, destination, port va protocol asosida tekshiriladi.

Misol:

allow tcp from app-subnet to db-subnet port 5432
deny all

Rule orderi va stateful yoki stateless xususiyat natijaga ta’sir qiladi.

Stateless ACL

Stateless network ACL har packetni alohida tekshiradi.

Requestga ruxsat berilgan bo‘lsa response direction uchun ham mos qoida kerak bo‘lishi mumkin.

Stateful firewall connection holatini saqlaydi va return trafficni avtomatik tanishi mumkin.

Object storage ACL

Bucket yoki objectga ACL orqali public yoki specific principal access berilishi mumkin.

Public read noto‘g‘ri berilsa data leak yuz beradi.

Ko‘p cloud platformalarda markaziy IAM policy ACLdan afzal yoki birga ishlatiladi.

Bir necha policy qatlamining effective permissioni tekshiriladi.

Effective permission

Userning real permissioni bir nechta manbadan kelishi mumkin:

direct ACE;
group;
inherited ACL;
role;
resource policy;
organization policy;
explicit deny.

UI’da faqat bitta entry’ga qarab xulosa qilish noto‘g‘ri.

Effective access calculation va test ishlatiladi.

ACL va RBAC

ACL resource-centric:

resource → kimga nima mumkin

RBAC identity va vazifa-centric:

user → role → permission

ACL individual exception va file kabi obyektlar uchun qulay.

RBAC ko‘p userga umumiy permissionni boshqarishda samaraliroq.

ACL va ABAC

ABAC policy atributlar asosida dinamik qaror beradi.

ACL esa oldindan yozilgan principal va permission ro‘yxatiga tayanadi.

Murakkab environment sharti ACLda juda ko‘p entry yaratishi mumkin.

Hybrid tizimlar ACL, role va policy’ni birga ishlatadi.

ACL sprawl

Har resource uchun ko‘p individual entry yaratilsa boshqarish qiyinlashadi.

Muammolar:

eski user qoladi;
duplicate entry;
noma’lum ownership;
inheritance chalkashligi;
audit murakkabligi.

Group va role orqali permissionlarni umumlashtirish yordam beradi.

Review

ACL davriy tekshiriladi:

public access;
noma’lum user;
ketgan xodim;
ortiqcha write;
explicit deny;
inheritance;
sensitive object;
dormant account.

Access review faqat policy faylini emas, effective resultni baholaydi.

Audit

Permission qo‘shish va o‘zgartirish audit qilinadi.

Kim, qachon, qaysi object va qaysi principal uchun o‘zgartirgani saqlanadi.

Sensitive bucket yoki production directory ACL o‘zgarishi alert yaratishi mumkin.

Ownership

Har resource ACL’ining business yoki technical owneri bo‘ladi. Owner kimga access kerakligini tasdiqlaydi va eski exceptionlarni olib tashlaydi. Egasiz file share yoki bucketlarda permissionlar yillar davomida kengayib borishi mumkin.

Canonical identity

ACL local username emas, barqaror identity ID bilan bog‘langan bo‘lishi afzal. User rename yoki boshqa inson ayni username’ni olganda eski permission noto‘g‘ri principalga o‘tmasligi kerak. Deleted identity entrylari cleanup qilinadi.

Backup va restore

File yoki object backupdan tiklanganda ACL ham to‘g‘ri tiklanishi kerak. Faqat content restore qilinib permission defaultga tushsa data public yoki foydalanib bo‘lmaydigan holatga kelishi mumkin. Restore testi effective accessni tekshiradi.

Bog‘liq tushunchalar

Access Control List, Access Control Entry, Permission, Principal, File permission, Network ACL, Default deny, RBAC, ABAC, IAM, Authorization