1. A system for analyzing access control configurations, comprising: a processor and memory; an operating system having resources and identifications of principals, the principals having access control privileges relating to the resources, the access control privileges described by access control metadata; an access control scanner component that receives the access control metadata, uses the metadata to determine relationships between the principals and the resources, and emits access control relations information, wherein the access control scanner component includes a mechanism layer that is configured to be specific to an operating system, and emits one or more sets of permissions in relation to resources, and a policy layer that is configured be general across multiple operating systems, the policy layer receives the one or more sets of permissions and generates one or more derivation trees that each indicate a possible vulnerability based on the relationships between the principals and the resources; and an access control inference engine that receives the emitted access control relations information and an access control policy model defining desired security policies, analyzes the received information and model, and emits a vulnerability report.
1. A system for analyzing access control configurations, comprising: a processor and memory; an operating system having resources and identifications of principals, the principals having access control privileges relating to the resources, the access control privileges described by access control metadata; an access control scanner component that receives the access control metadata, uses the metadata to determine relationships between the principals and the resources, and emits access control relations information, wherein the access control scanner component includes a mechanism layer that is configured to be specific to an operating system, and emits one or more sets of permissions in relation to resources, and a policy layer that is configured be general across multiple operating systems, the policy layer receives the one or more sets of permissions and generates one or more derivation trees that each indicate a possible vulnerability based on the relationships between the principals and the resources; and an access control inference engine that receives the emitted access control relations information and an access control policy model defining desired security policies, analyzes the received information and model, and emits a vulnerability report. 2. The system of claim 1 wherein the access control relations are identified using a language with semantics that are similar to a Datalog language.