File permissions only protect anything at the moment a process asks to open a file, and that decision is made by the operating system, not by the policy document that set the permissions. MITRE D3FEND names this countermeasure Local File Access Mediation (D3-LFAM), synonym "Local File Access Control", and defines it as "the process of an operating system granting or denying a specific access request to a local file." It sits under the Isolate tactic as a child of System Call Filtering (D3-SCF), which D3FEND places under Access Mediation, and its digital artefact is Open File. D3FEND keeps a separate technique, Local File Permissions (D3-LFP), for defining and managing the permissions themselves; D3-LFAM is the enforcement point. This card explains how the open-time decision works on Windows and Linux, what can override it, which ATT&CK techniques D3FEND relates to it and how to show the mediation is working. It is written for endpoint, platform and identity engineers.
Key takeaways
- Policy and enforcement are separate techniques. D3-LFP sets the access control policy; D3-LFAM is the operating system applying it to each open request. See D3-LFP Local File Permissions for the policy side.
- The decision is made against the caller's identity. Windows compares the thread's access token with the file's DACL; Linux compares the process's filesystem user and group IDs and capabilities with the file mode, ACLs and any security module policy.
- Privilege bypasses mediation. Linux CAP_DAC_OVERRIDE overrides discretionary permission checks; Windows backup and restore privileges let holders read and write files regardless of the DACL. These rights belong to very few identities.
- Mediation is invisible unless audited. Windows logs file access (event 4663) only when the file's SACL asks for it; Linux needs audit rules or security module logs.
- The ATT&CK links are inferred from the parent. D3FEND's page lists the same credential dumping, server component and tool tampering techniques it lists for process isolation, via the System Call Filtering lineage.
D3-LFAM at a glance
| Attribute | Value |
|---|---|
| D3FEND ID | D3-LFAM (d3f:LocalFileAccessMediation) |
| Synonym | Local File Access Control |
| Tactic | Isolate |
| Hierarchy | Access Mediation, then System Call Filtering (D3-SCF, also labelled Mandatory Access Control and System Call Mediation), then Local File Access Mediation |
| Digital artefact | Open File (D3FEND relation: filters); Open File is a system call artefact |
| Related policy technique | Local File Permissions (D3-LFP), under Access Policy Administration |
| D3FEND reference | Microsoft: File and Folder Permissions |
| Typical implementations | Windows security reference monitor with DACLs; Linux permission checks, POSIX ACLs and Linux Security Modules (AppArmor, Landlock, SELinux) |
| Main limitation | Only as good as the permissions and identities behind it; privileged identities pass by design |
How it works
D3FEND's Open File artefact describes the moment of decision: a program initialises access to a file with the open system call, which returns a handle the process uses afterwards. Mediation happens at that point. Rights are checked when the handle is created, so revoking a permission later does not normally affect a handle that is already open.
Windows: access token against DACL
Microsoft's documentation describes the evaluation. If the object has no DACL, the system grants access. Otherwise it compares each access control entry with the SIDs in the thread's token (the impersonation token if the thread is impersonating) and stops when an access-denied entry denies any requested right, when allow entries have granted all requested rights, or when it runs out of entries, in which case access is implicitly denied. Because evaluation stops at the first decisive entry, order matters: a deny entry after a matching allow has no effect. Disabled group SIDs in the token are ignored.
Linux: mode bits, capabilities and security modules
The path_resolution(7) manual page sets out the discretionary check. The kernel picks the owner, group or other permission set by comparing the process's filesystem user and group IDs with the file, and every directory in the path must grant search (execute) permission or the lookup fails with EACCES. Two capabilities change the outcome: CAP_DAC_OVERRIDE overrides all permission checking (execute only if at least one execute bit is set) and CAP_DAC_READ_SEARCH grants read on files and read and search on directories. POSIX ACLs extend the owner, group and other model with named entries. Linux Security Modules then apply mandatory policy that even root cannot ignore, which is the System Call Filtering parent in D3FEND terms: SELinux with labels, AppArmor with path-based profiles, and Landlock, which lets an unprivileged process restrict its own file access.
| Layer | Windows | Linux | Who sets the policy |
|---|---|---|---|
| Discretionary | DACL on NTFS files and folders | Mode bits and POSIX ACLs | Resource owner or administrator |
| Mandatory or confining | Mandatory integrity levels; AppContainer file isolation | SELinux, AppArmor | Central security policy |
| Self-restriction | AppContainer for packaged apps | Landlock rulesets (for example LANDLOCK_ACCESS_FS_READ_FILE, LANDLOCK_ACCESS_FS_WRITE_FILE) | The application itself |
| Bypass rights | SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege | CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH, CAP_FOWNER | Whoever assigns privileges and capabilities |
| Audit | SACL plus Audit File System, events 4656 and 4663 | Linux audit watch rules, security module denial logs | Security operations |
Landlock documents that a process must set no_new_privs before enforcing a ruleset unless it holds CAP_SYS_ADMIN, that restrictions are inherited by child threads and processes, and that a domain can only be made stricter, never removed. Programs should query the running kernel's Landlock ABI version and drop rights it does not support. Deeper coverage of the mandatory layer is in the Reference Monitors and Mandatory Access Control Guide and the AppArmor Guide; Linux permission detail is in the Linux File Permissions, SUID and ACLs Guide.
Where identity fits
Every mediation decision is an identity decision: the token or user ID presented is the subject. Service accounts and workload identities are frequently given broad file rights or backup privileges for convenience, which turns them into bypasses of mediation. Treat file rights of non-human identities as part of entitlement review, and remove backup and restore privileges from anything that is not a backup agent. The Least Privilege Techniques Guide covers the review approach.
ATT&CK techniques D3FEND relates to D3-LFAM
Relationship type: inferred only. The D3FEND page for D3-LFAM lists the techniques below and labels them inferred and experimental (D3FEND knowledge graph 1.6.0, checked November 2026). They match the list D3FEND shows for process isolation, which suggests they come through the parent's Process relation rather than the Open File artefact. D3FEND still lists the pre-v20 Disable or Modify Tools sub-technique of Impair Defenses, revoked in ATT&CK v20; its successor T1685 is shown. Each ID was checked against ATT&CK v20.
| ATT&CK ID | Technique | Where file access mediation helps |
|---|---|---|
| T1003.001 | LSASS Memory | Limited: dump files written to disk can be confined to protected locations; the memory read itself is a process isolation matter |
| T1003.002 | Security Account Manager | Default DACLs on the SAM hive and restricted backup privilege stop ordinary accounts copying it |
| T1003.004 | LSA Secrets | Registry and file access restricted to SYSTEM |
| T1053.005 | Scheduled Task | Task definition folders writable only by administrators |
| T1505.002 | Transport Agent | Mail server agent folders and configuration writable only by the service's administrators |
| T1505.003 | Web Shell | Web roots not writable by the web server's own identity, so an exploited application cannot drop a shell |
| T1546.007 | Netsh Helper DLL | Helper DLL locations and registration restricted to administrators |
| T1685 | Disable or Modify Tools (v20 successor of the revoked Impair Defenses sub-technique) | Security agent binaries and configuration protected from modification by non-agent identities |
The right-hand column is NHI Mgmt Group's reading of how file mediation applies, not part of D3FEND. Technique detail is in T1003 OS Credential Dumping, T1505 Server Software Component Defensive Guide and T1053 Scheduled Task/Job Defensive Guide.
Implementation steps
- Pick the files that matter. Credential stores, security agent installs, web roots, scheduled task and service definitions, and directories holding secrets for workloads. Mediation effort goes where a write or read changes the attacker's position.
- Check effective access, not just the ACL. List who can read or write each target, including groups, inherited entries and privileged rights. On Windows, include holders of backup, restore and take-ownership privileges; on Linux, processes with DAC-bypass capabilities.
- Remove bypass rights from workloads. Drop CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH from containers and services that do not need them; limit Windows backup privileges to backup agents.
- Add mandatory confinement for exposed services. Put internet-facing services under an SELinux policy or AppArmor profile, or use Landlock inside the application, so a compromise of the service account still cannot reach files outside its profile. Start in permissive or complain mode, review denials, then enforce.
- Turn on targeted auditing. On Windows enable the Audit File System subcategory and add SACL entries only on the target files, filtering for write, delete, WRITE_DAC and WRITE_OWNER rights as Microsoft recommends. On Linux add audit watch rules on the same paths.
- Roll out by ring and keep rollback simple. Export current ACLs before changes (for example with icacls on Windows or getfacl on Linux), apply to a pilot group, monitor access denied errors, then expand. Restoring the export is the rollback.
How to verify it works
- Negative tests: from an approved test account with the same rights as a workload identity, attempt to read and write each protected file; each attempt should fail and, where audited, be logged.
- Audit event flow: confirm 4663 events ("An attempt was made to access an object") arrive for protected files and carry the expected process name. Microsoft recommends alerting when the process is unexpected or runs from outside standard folders.
- Mandatory policy status: confirm SELinux is enforcing and AppArmor profiles are in enforce mode on the hosts that should have them; complain mode logs but does not block.
- Drift detection: compare ACLs and modes on target files with the approved baseline on a schedule, and alert on WRITE_DAC and WRITE_OWNER use.
- Privilege inventory: list holders of backup and restore privileges and DAC-bypass capabilities each quarter; every holder needs a recorded reason.
| Metric | Example target (NHI Mgmt Group suggestion, not a standard) | Why it matters |
|---|---|---|
| Target files whose effective access matches the approved baseline | 100% | Proves the policy that mediation enforces is the intended one |
| Internet-facing services under an enforcing mandatory profile | Rising quarter on quarter towards all | Confines a compromised service account |
| Non-backup identities holding backup or restore privileges | Zero | These identities bypass file mediation by design |
| Containers granted CAP_DAC_OVERRIDE without an exception | Zero | Removes the Linux discretionary bypass |
| Negative tests passing per review cycle | 100% | Shows mediation denies what it should |
Limits, bypasses and failure patterns
- Null DACLs and over-broad groups: a file with no DACL is open to everyone on Windows, and "Everyone" or "Authenticated Users" write entries have the same effect in practice.
- Deny entries in the wrong order: a deny placed after a matching allow does nothing, which gives false confidence in hand-edited ACLs.
- Privileged identities: backup agents, deployment service accounts and root in a container pass discretionary checks. Mandatory policy and capability dropping are the answer, not more ACL entries.
- Open handles: rights are checked when a file is opened, so a process that opened a file before a permission change keeps its access until it closes the handle.
- Offline access: booting another operating system or reading a disk image bypasses the running system's mediation entirely; disk encryption covers that case.
- Complain mode left on: AppArmor and SELinux in learning modes log but never deny; pilots that never move to enforcing provide no mediation.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-3 Access Enforcement; AC-3(3) Mandatory Access Control | Enforcement of approved authorisations, the core of mediation |
| NIST SP 800-53 Rev 5 | AC-6 Least Privilege; AU-2 Event Logging; AU-12 Audit Record Generation | Narrow rights and audited access |
| NIST CSF 2.0 | PR.AA-05 | Access permissions defined, managed, enforced and reviewed with least privilege |
| MITRE ATT&CK mitigation | M1022 Restrict File and Directory Permissions | See M1022 Restrict File and Directory Permissions |
| MITRE D3FEND | Access Mediation, D3-SCF (parent), D3-LFAM; D3-LFP (policy) | Technique hierarchy |
Related countermeasures
- System Call Filtering (D3-SCF): the parent, mandatory control over system calls. See D3-SCF System Call Filtering.
- Local File Permissions (D3-LFP): defining the file access policy that this technique enforces.
- Kernel-based Process Isolation (D3-KBPI): isolates the process making the request. See D3-KBPI Kernel-based Process Isolation.
- Endpoint-based Web Server Access Mediation (D3-EBWSAM): the same mediation idea applied to web resources. See D3-EBWSAM Endpoint-based Web Server Access Mediation.
Practitioner checklist
- Keep a list of high-value files and directories and their approved effective access.
- Review effective access, including inheritance, groups and privileged rights, not only explicit entries.
- Restrict backup, restore and take-ownership privileges to the identities that need them.
- Drop DAC-bypass capabilities from containers and services by default.
- Run internet-facing services under an enforcing mandatory profile.
- Audit access to high-value files with targeted SACLs or audit watch rules, not blanket auditing.
- Export ACLs before every change so rollback is a restore.
- Run negative access tests with workload identities each review cycle.
Standards and references
- MITRE D3FEND: Local File Access Mediation (D3-LFAM)
- Microsoft Learn: How DACLs control access to an object
- Microsoft Learn: Event 4663, an attempt was made to access an object
- Linux man-pages: path_resolution(7)
- Linux kernel documentation: Landlock unprivileged access control
- Microsoft Learn: AppContainer isolation
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls (AC-3 Access Enforcement)
Related NHI Mgmt Group resources: D3-LFP Local File Permissions · Reference Monitors and Mandatory Access Control Guide · Linux File Permissions, SUID and ACLs Guide · M1022 Restrict File and Directory Permissions