YanoSec
Progress0 of 152 lessons complete

Course / 12 Testing / Lesson 06 of 11

Shares, at a reading level

Estimated time: 14 min reading · 14 min activity

A share is a named resource offered by a file server over a network. SMB, Server Message Block, is a protocol family used for such file sharing. Seeing a share name is discoverability; having permission to read or change its contents is access.

Network file access can involve both share permissions and filesystem permissions. These cards use a deliberately simple rule: keep an action only if both allow lists include it. The intersection is the common part of two sets. This teaching rule omits real Windows precedence, group aggregation, deny entries and inheritance.

Before you begin

Estimated time
14 min reading, 14 min activity. Setup and optional practice may take longer.
Where you work
Use only the supplied North Desk fictional cards and source in a desktop or mobile browser. Keep predictions in private notes. No login attempt, recovery tool, framework module, permission change, domain setup or target connection is required. Optional later lab setup has a separate budget.
Without a lab
All evidence needed for the activity appears on this page. Copy it into notes if downloads are unavailable. Read the labeled model and predict each result; a paper trace practises the reasoning while tool operation waits for a lab. Reading needs no JavaScript. Answer checking needs JavaScript and a secure context; saving progress also needs usable browser storage.

After this lesson you can:

  • List the share allows and the filesystem allows for one fictional share.
  • Keep only an action that appears on both lists.
  • State what this simplified rule leaves out of a real Windows ACL.

01Example

Fresh intersection example, distinct from the required read/write lists.

Share allow: list, read
Filesystem allow: list
Common action: list
Read appears on only one side, so it does not survive this model.
This is a paper rule, not a full effective-access calculation.

02What the rule is allowed to say

For each proposed action, ask whether it appears on both lists. A right on one side cannot fill a missing right on the other in this simplified network model. Rights also need a stated identity; a visible share name supplies no permission by itself.

Real effective access needs more information, including deny/inherited entries, group rights, ownership and how the user connects. Share permissions apply to network sharing, not the same way to a local user opening a file on that computer. Do not apply this intersection as a universal Windows ACL algorithm.

Apply two explicitly simplified permission lists while keeping network access separate from discoverability.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

Propose listPropose read
Share allow list

Share allow: list, read

met · list appears in share allow.
Filesystem allow list

Filesystem allow: list

met · list appears in filesystem allow.
Apply the stated rule
Common action: list

list survives the explicitly simplified intersection.

This worksheet uses a simplified intersection, not a full Windows effective-access calculation.

list survives the explicitly simplified intersection.

Follow the explanation

  1. list survives the explicitly simplified intersection.
  2. read occurs on only one side. This is a paper rule, not full Windows effective access.
Read every state and value

1. list survives the explicitly simplified intersection.

Case
list
Conditions inspected
Share allow list · Filesystem allow list
Decision shown
Yes

2. read occurs on only one side. This is a paper rule, not full Windows effective access.

Case
read
Conditions inspected
Share allow list · Filesystem allow list
Decision shown
Yes
This worksheet uses a simplified intersection, not a full Windows effective-access calculation.

03Use the minutes row

Use the minutes row in the supplied table. The independent question later has a different pair of lists.

Share and filesystem allows
Label: original fictional table. No share was opened. .lab.invalid was not queried.

Simplified course rule, for this table only:
Effective network allow is the actions that appear in both the share allow list and the filesystem allow list.
This table has no deny entries. It ignores inheritance, ownership, group accumulation, and the fact that a local logon does not use the share list.

Activity row, share minutes, on files-3:
Share allow for readers: read
Filesystem allow for readers: read, write

Seeing the share name notes is not access.

Download the simplified allow table

What the simplified rule leaves out
Label: original limits. The archived Windows Server 2008 file-server page.

That page says share permissions and NTFS permissions are independent, and that the more restrictive of the two is applied to network access.
It also says share permissions do not restrict a local user of that computer.
The page is archived. It is not a current Windows build manual. A current training URL redirected away from the module, so that module body was not read.
This lesson does not quote the SMB protocol specification. SMB here means the file-sharing service that offers the share.

Not in the course rule: an explicit deny, inherited entries, the Creator Owner identity, Full Control, or taking ownership.
A real system needs those records before anyone calls the result effective access.

Download the limits of the course rule

  1. Copy the minutes share and filesystem allow lists into two columns.
  2. Locate write on the filesystem side and check for it on the share side. It is missing there.
  3. Record share-list as the missing side for that activity. Explain that an action must appear on both lists before it survives this model.
  4. Stop with the table interpretation. No real share enumeration or file opening is required.

04Optional challenge

For about twelve optional minutes, add three missing-context questions to a future access review: are there explicit deny entries, how are rights inherited/combined, and is access local or over a share? Leave the actual server unknown rather than extending the teaching rule.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Share card A: simplified fictional network rulesOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

For this card only, an action is allowed over the network only if both lists contain it. No deny, groups or inheritance are modeled.
A1 share allows list, read, write; filesystem allows read, write.
A2 share allows list, read; filesystem allows list.
A3 share allows read; filesystem allows write.
For an empty intersection use the label no common action.

Connection card B: separate same-computer caseOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Share allows read. Filesystem allows read, write.
Neri is opening the file locally on the file-server computer, not through the network share.
The course model says share permissions do not restrict this local path. No other restrictions are supplied.

06Explain the evidence and its limit

Optional self-check: explain a network intersection and why a local opening needs a different access-path reading.

Review it: name the identity and actions, preserve the model’s limits, and ask for missing deny, group and inheritance facts before claiming real effective access.

07Common mistakes

If a share’s name is treated as a read grant, locate the identity and permission entries; naming a resource does not grant it.

If the activity is answered with the later question’s lists, recopy the minutes row before intersecting.

If a real ACL is reduced to these two lists, mark the omitted deny, inheritance and group context as unresolved.

References