Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Coming from a Linux background, I'm used to a file having an owner, and a owning group. Access permissions can be set separately for owner, group, and others, and that's it.

Now on (NT-based) Windows, it's a bit different, because Windows uses ACLs. That means instead of having three lists of permissions (owner, group, rest), I can have as many lists of permissions as I want.

So far, this makes sense. However, why does Windows still have the notion of a file owner? To me it seems that with ACLs, a "file owner" is no longer needed, because all access can be configured via ACLs.

So why does modern Windows still use file ownership? Where does it make a difference who owns a file? As long as two files have the same ACLs, file ownership should not matter - or does it?

share|improve this question
    
Mostly applied for networking... locals use UAC –  ppumkin Dec 19 '11 at 10:31
3  
@ppumkin: Windows UAC is only in addition to the ACL system. –  grawity Dec 19 '11 at 15:22
    
@ppumkin: Turn off UAC and then try to overwrite files in System32. ACLs will stop you cold. –  surfasb Dec 19 '11 at 21:40

3 Answers 3

up vote 9 down vote accepted

First of all, Linux does have ACLs – POSIX ACLs, which allow setting the permission bits for any number of users and groups. (Patches for RichACL, ACLs very similar to NFSv4 and WinNT, have been submitted repeatedly, but not merged yet.)

Ownership can be used as a sort of safety escape – the owner can always change the object's ACLs, even if the change would be denied otherwise, for example, if someone accidentally removed all ACL entries or denied all changes to everyone. (On Linux only the owner can change a file's ACLs, since there is no separate "change ACLs" permission.)

Another use of file ownership, on both Windows NT and Linux, is for determining whose quota should the file be counted on, if disk quotas are in use.

share|improve this answer
3  
+1 for mentioning disk quotas. –  surfasb Dec 19 '11 at 21:43

There is a big difference if you look at it from an administrator's perspective.

On Linux root can do everything directly - the account as implicitly all permissions on all objects in the file-system and beyond.

On Windows an administrator does not have permissions to do everything by default - only if you are owner of the object (file, folder registry entry,...) you want to change.

Take for example a folder an administrator needs to change the file permissions. If the admin doesn't have the permission to change the security settings of the folder he needs to take over ownership of the folder before being able to access/change it.

Update:

This feature is important because in an ACL controlled environment there may be the case that a file has an empty ACL which means that no-one has access (default deny principle). In such a case taking over ownership is the only way to get access or to delete the file.

share|improve this answer
1  
Does that mean only the owner of a file can change its permissions? Or why is it that an Administrator can take ownership of a file, but cannot change permissions directly? –  sleske Dec 19 '11 at 13:40
    
See my updated answer. –  Robert Dec 19 '11 at 14:48
    
@sleske: Yes, the owner of an object can always change its permissions. –  surfasb Dec 19 '11 at 21:42

The object owner always can change the ACLs.

share|improve this answer
    
How do you change the ACL though? –  Simon Sheehan Dec 19 '11 at 20:40
    
Using the security tab in properties. –  kinokijuf Dec 20 '11 at 17:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.