Users

We know users. We are one. We want access to what we want to access. We don't want others to access things we don't want them to. We refer to this as Access Control. Operating systems handle access control for all users and programs running on the system. The key building block that enables this control is the concept of a user account. The account can then own files, or have privileges to run programs or access resources.

User authenticate when they start using the device. They "login". Typically this is presenting a password, but could be via a biometric or another method of proving who they are. Once they have authenticated they can then access their files. If the authentication fails, then they don't have access. If they try to access something that they don't have permission to access, then they get denied.

Depending on the rules of the system, referred to as permissions (more below) a user may be able to create files or install new programs, or they may be very limited to open reading data. A typical user account, on our own computer, has quite a few permissions, and if we go to do something to the system components we may be then asked for our password again to prove that it is us attempting to make the change.

Administrator

Within most operating systems there is a super user who can access all files within the system. This user can install new programs for other users, and even delete vital system files. Our account may even be an admin account on our computer, enabling us to install or delete whatever programs we like. However, on a work machine we may find we have much more limited control. The administrator user, commonly called root in some systems. This is a default account when the operating system was installed. This account is commonly assigned as the owner of key system processes processes that run. Commonly security breaches in a system occurs when a user gains unauthorised access to the root account. Operating systems are not only central to our ability to use the hardware of the computer, but also the security of the computer itself. This will be discussed further is the Cyber Security module.

For systems to operate smoothly, it is very common for higher level access to be given to some users. They get administrator access. This is common on our personal devices, but it also true on servers. Giving full administrator access increases the level of risk to those accounts. So it is common to give them control over some sections of the machine, but not full administrator access. They may get access to install software, or possibly to modify network settings. A common way that this is implemented in Unix based machines (which includes a large portion of web servers and database servers; plus Apple devices) is through the sudo command. Users operate their own account, but when they go to attempt an action that needs higher level access, they type sudo followed by the command, they are then prompted to enter their password, and if they have the admin access the command is run.

Source: xkcd.com

Permissions

In most systems the user accounts are the corner stone of access control for files and running programs. However, the rules of who can access what are implemented in what is referred to as permissions. Files have a list of permissions on them detailing who can access them. The most common access rights we see across systems are Read (r), Write (w) and Execute (x). Commonly there are multiple sets of permissions on a file. In the picture below on the left shows the groups in the top of the picture on the right; within Unix we see three sets of rwx - one for the owner, the group and then all others. Group memberships then enables easy permission sharing for shared resources. Keeping track of permissions is vitally important, and using groups and being strict with group membership enables files to be kept safe, while also being accessible to those that need access.

Curious what the Windows permission each mean?

Full Control allows you to read, write, modify, execute, change attributes, permissions, and take ownership of the file.
Modify allows you to read, write, modify, execute, and change the file’s attributes.
Read & Execute will allow you to display the file’s data, attributes, owner, and permissions, and run the file if its a program.
Read will allow you to open the file, view its attributes, owner, and permissions.
Write will allow you to write data to the file, append to the file, and read or change its attributes.