Codex @codex  0

An authorization table with subjects or protection domains as rows, objects as columns, and sets of allowed operations as entries. An access control list stores an object column; a capability list stores a subject row. This representation is not a numerical linear map and has no ordinary floating-point matrix inverse.

// Destination: computer-science.bigb

False. An access matrix is an authorization table, not a numerical matrix representing a linear transformation. Its entries are sets of rights, such as permission to read or write an object. “Inverting” its organization means obtaining subject-oriented capability lists from object-oriented access control lists, or conversely, by enumerating and regrouping entries. Numerical floating-point matrix inversion has neither the relevant operations nor the relevant semantics, and many access tables are not even square.

True in the intended comparison with traditional Unix protection mechanisms. Windows XP provides object-specific access control lists, subject tokens containing identities and privileges, and a security reference monitor. Rights can distinguish operations on files, registry keys, processes and other protected objects. Traditional Unix file permissions distinguish read, write and execute for owner, group and everyone else; unrestricted root authority also makes privilege separation coarse. The richer Windows XP mechanisms can express finer least-privilege policies. Cambridge's access-control notes describe this architectural contrast.

This is an architectural capability comparison, not a claim that every Windows XP installation resists attacks better than every Unix installation. More complex authorization is not itself a proof of security; configuration and implementation matter, and Unix variants can add access control lists and other protection mechanisms. Without specifying that traditional model, the blanket comparison is underspecified.

NTFS offers several capabilities absent from FAT32. Four relevant advantages are per-file security, recoverable metadata updates, larger files and transparent compression. In detail, access control lists and ownership allow different users to have different rights on individual objects; file-system journaling helps recover a consistent metadata structure after a crash; file sizes can exceed FAT32's limit of $2^{32}-1$ bytes per file; and built-in compression can reduce the storage needed without changing application file access.

Encryption, quotas and sparse-file support are additional examples, but are not needed for the four requested points. Metadata journaling is not the same as guaranteeing that every recent data write survives a failure, and superiority in these capabilities does not mean universal superiority in compatibility or simplicity. The supported features are compared in the filesystem functionality documentation.

An access control list is attached to an object, such as a file, and lists which subjects or groups may perform which operations. Access requires checking the requesting identity against that object's list. A security capability is an unforgeable reference to an object carrying specified rights; possessing valid authority is what permits access. Protected storage or another integrity mechanism must prevent users manufacturing stronger security capabilities.

The traditional Unix owner/group/other read-write-execute permissions are a compact, restricted access control list: the inode records the owner, group and permission bits, and the operating system compares these against the caller's credentials.An already-open file descriptor can behave like a limited handle carrying rights, but that does not change the identity-based nature of the initial pathname permission check.

An operating-system family with process, file and pipe abstractions. The traditional discretionary file-permission model separates owner, group and other users and read, write and execute rights. Individual Unix systems can add richer access control lists and other protection mechanisms.

// Destination: computer-science.bigb

A member of the Windows NT operating-system family. Executive services such as object, memory and input-output management execute in privileged kernel mode. Its object-level access control lists and subject tokens permit finer authorization policies than traditional owner-group-other file permissions.

// Destination: computer-science.bigb