Chapter 13: Protection
Operating System Concepts Essentials – 2nd Edition
Silberschatz, Galvin and Gagne ©2013
Chapter 13: Protection
 Goals of Protection
 Principles of Protection
 Domain of Protection
 Access Matrix
 Implementation of Access Matrix
 Revocation of Access Rights
 Language-Based Protection
Operating System Concepts Essentials – 2nd Edition
13.2
Silberschatz, Galvin and Gagne ©2013
Objectives
 Discuss goals and principles of protection in a
modern computer system
 Explain protection domains and access matrices
 Examine language-based protection systems
Operating System Concepts Essentials – 2nd Edition
13.3
Silberschatz, Galvin and Gagne ©2013
Goals of Protection
 In protection model, computer consists of collection
of HW and SW objects
 Each object has unique name, can only be accessed
through well-defined set of operations
 Protection problem - ensure that each object is
accessed correctly and by only allowed processes
Operating System Concepts Essentials – 2nd Edition
13.4
Silberschatz, Galvin and Gagne ©2013
Chapter 13: Protection
 Goals of Protection
 Principles of Protection
 Domain of Protection
 Access Matrix
 Implementation of Access Matrix
 Revocation of Access Rights
 Language-Based Protection
Operating System Concepts Essentials – 2nd Edition
13.5
Silberschatz, Galvin and Gagne ©2013
Principles of Protection
 Principle of least privilege

Programs, users, and systems given just enough
privileges to complete tasks

Limits damage if entity has bug or gets abused

Privileges can be static or dynamic
 domain
switching- changed by process as needed
 domain
can be user, process, procedure
 Need to know - similar concept
Operating System Concepts Essentials – 2nd Edition
13.6
Silberschatz, Galvin and Gagne ©2013
Chapter 13: Protection
 Goals of Protection
 Principles of Protection
 Domain of Protection
 Access Matrix
 Implementation of Access Matrix
 Revocation of Access Rights
 Language-Based Protection
Operating System Concepts Essentials – 2nd Edition
13.7
Silberschatz, Galvin and Gagne ©2013
Domain Structure
 Access-right - <object-name, rights-set>

rights-set := valid operations / access on object
 Domain - set of access-rights
Operating System Concepts Essentials – 2nd Edition
13.8
Silberschatz, Galvin and Gagne ©2013
Domain Implementation (UNIX)
 Domain = user-id
 Domain switch accomplished via file system

Each file has domain bit (setuid bit)
 If
file executed with setuid = 1,
–
user-id set to owner of file
–
execution completes, user-id is reset
 If
file executed with setuid = 0,
–
user-id set to current user of file
Operating System Concepts Essentials – 2nd Edition
13.9
Silberschatz, Galvin and Gagne ©2013
Domain Implementation (UNIX)
 Domain switch accomplished via passwords

su command temporarily switches to another domain
 Domain switching via commands

sudo command prefix executes specified command
in another domain
Operating System Concepts Essentials – 2nd Edition
13.10
Silberschatz, Galvin and Gagne ©2013
Chapter 13: Protection
 Goals of Protection
 Principles of Protection
 Domain of Protection
 Access Matrix
 Implementation of Access Matrix
 Revocation of Access Rights
 Language-Based Protection
Operating System Concepts Essentials – 2nd Edition
13.11
Silberschatz, Galvin and Gagne ©2013
Access Matrix
 View protection as matrix (access matrix)
 Rows represent domains
 Columns represent objects
 Access(i,j):= set of operations that a process
executing in Domaini can invoke on Objectj
Operating System Concepts Essentials – 2nd Edition
13.12
Silberschatz, Galvin and Gagne ©2013
Use of Access Matrix
 Access matrix separates mechanism from policy

Mechanism
 Operating
system provides access-matrix + rules
 Ensures
that matrix only manipulated by authorized
agents and rules are strictly enforced

Policy
 User
dictates policy
 Who
can access what object and in what mode
Operating System Concepts Essentials – 2nd Edition
13.13
Silberschatz, Galvin and Gagne ©2013
Use of Access Matrix
 If a process in Domain Di tries to do “op” on object
Oj, then “op” must be in access matrix
 User who creates object can define access column
for that object
Operating System Concepts Essentials – 2nd Edition
13.14
Silberschatz, Galvin and Gagne ©2013
Use of Access Matrix
 Can be expanded to dynamic protection

Operations to add, delete access rights

Special access rights:
 owner
 copy
of Oi
op from Oi to Oj
 control
– Di can modify Dj access rights
 transfer
– switch from domain Di to Dj

Copy and Owner applicable to an object

Control applicable to domain object
Operating System Concepts Essentials – 2nd Edition
13.15
Silberschatz, Galvin and Gagne ©2013
Access Matrix with Copy Rights
 Copy rights
Operating System Concepts Essentials – 2nd Edition
13.16

Object’s access rights
can be copied
between domains

Denoted with *
Silberschatz, Galvin and Gagne ©2013
Access Matrix With Owner Rights
 Owner rights

Add / remove
access rights of
object between
domains

E.g., object F1
owned by domain
D1
 execute
access
right removed
from Domain D3
Operating System Concepts Essentials – 2nd Edition
13.17
Silberschatz, Galvin and Gagne ©2013
Modified Access Matrix of Figure B
 Control rights

Applicable only
to Domain
objects

Can control any
entity in that
Domain

E.g., D2 controls
Domain D4
 Removes
read
access from F1
and F3 in
Domain D4
Operating System Concepts Essentials – 2nd Edition
13.18
Silberschatz, Galvin and Gagne ©2013
Chapter 13: Protection
 Goals of Protection
 Principles of Protection
 Domain of Protection
 Access Matrix
 Implementation of Access Matrix
 Revocation of Access Rights
 Language-Based Protection
Operating System Concepts Essentials – 2nd Edition
13.19
Silberschatz, Galvin and Gagne ©2013
Implementation of Access Matrix
 Generally, a sparse matrix
 Option 1 – Global table

Store ordered triples in table
 <domain,
object, rights-set>

Request operation M on object Oj within domain Di ,
search table for < Di, Oj, Rk > with M ∈ Rk

Table could be large -> won’t fit in main memory

Difficult to group objects
 E.g.,
object that all domains can read
Operating System Concepts Essentials – 2nd Edition
13.20
Silberschatz, Galvin and Gagne ©2013
Implementation of Access Matrix (Cont.)
 Option 2 – Access lists for objects

Each column implemented as access list for object

Resulting per-object list consists of ordered pairs:
<domain, rights-set>
 Defines
all domains with non-empty set of access rights
for object
 Can also define default access rights
Operating System Concepts Essentials – 2nd Edition
13.21
Silberschatz, Galvin and Gagne ©2013
Implementation of Access Matrix (Cont.)
 Option 3 – Capability list for domains

Instead of object-based, list is domain based

Capability list for domain = list of objects + allowed
operations

Object represented by name or address, called a
capability
 Basically

a pointer
Execute operation M on object Oj,
 Process
requests op, specifies capability as parameter
 Possession
of capability means access is allowed
Operating System Concepts Essentials – 2nd Edition
13.22
Silberschatz, Galvin and Gagne ©2013
Implementation of Access Matrix (Cont.)
 Option 3 – Capability list for domains

Capability list associated with domain but never
directly accessible

Rather, protected object, maintained by OS and
accessed indirectly
 Like
a “secure pointer”
Operating System Concepts Essentials – 2nd Edition
13.23
Silberschatz, Galvin and Gagne ©2013
Implementation of Access Matrix (Cont.)
 Option 4 – Lock-key

Compromise between access and capability lists

Each object has list of unique bit patterns locks)

Each domain has list of unique bit patterns (keys)

Process in a domain can only access object if domain
has key that matches one of the locks
Operating System Concepts Essentials – 2nd Edition
13.24
Silberschatz, Galvin and Gagne ©2013
Implementation of Access Matrix (Cont.)
 Each column = Access List for one object

Defines who can perform what operation, e.g.,
 Domain
1 = Read, Write
 Domain 2 = Read
 Domain 3 = Read
Operating System Concepts Essentials – 2nd Edition
13.25
Silberschatz, Galvin and Gagne ©2013
Implementation of Access Matrix (Cont.)
 Each Row = Capability List for domain

Defines what operations allowed on what objects
F1 – Read
 Object F4 – Read, Write, Execute
 Object F5 – Read, Write, Delete, Copy
 Object
Operating System Concepts Essentials – 2nd Edition
13.26
Silberschatz, Galvin and Gagne ©2013
Comparison of Implementations
 Many trade-offs to consider

Global table is simple, but can be large

Access lists correspond to needs of users
 Difficult
 Every
–
to determine set of access rights for domain
access must be checked
Many objects and access rights => slow
Operating System Concepts Essentials – 2nd Edition
13.27
Silberschatz, Galvin and Gagne ©2013
Comparison of Implementations
 Many trade-offs to consider

Capability lists useful for localizing information for a
given process
 Revocation

can be inefficient
Lock-key effective and flexible, keys can be passed
freely from domain to domain, easy revocation
Operating System Concepts Essentials – 2nd Edition
13.28
Silberschatz, Galvin and Gagne ©2013
Comparison of Implementations (Cont.)
 Most systems use combination of access lists and
capabilities

First access to object -> access list searched
 If
allowed, capability created and attached to process
–
Additional accesses need not be checked
 After
last access, capability destroyed
Operating System Concepts Essentials – 2nd Edition
13.29
Silberschatz, Galvin and Gagne ©2013
Chapter 13: Protection
 Goals of Protection
 Principles of Protection
 Domain of Protection
 Access Matrix
 Implementation of Access Matrix
 Revocation of Access Rights
 Language-Based Protection
Operating System Concepts Essentials – 2nd Edition
13.30
Silberschatz, Galvin and Gagne ©2013
Revocation of Access Rights
 Various options to remove domain access right
of an object

Immediate vs. delayed

Selective vs. general

Partial vs. total

Temporary vs. permanent
Operating System Concepts Essentials – 2nd Edition
13.31
Silberschatz, Galvin and Gagne ©2013
Revocation of Access Rights
 Access List – Delete access rights from access list

Simple – search access list and remove entry

Immediate

General or selective

Total or partial

Permanent or temporary
Operating System Concepts Essentials – 2nd Edition
13.32
Silberschatz, Galvin and Gagne ©2013
Revocation of Access Rights (Cont.)
 Capability List – Scheme required to locate
capability in system before capability can be revoked

Reacquisition – periodic delete, with require and
denial if revoked

Back-pointers – set of pointers from each object to all
capabilities of object
Operating System Concepts Essentials – 2nd Edition
13.33
Silberschatz, Galvin and Gagne ©2013
Revocation of Access Rights (Cont.)
 Capability List – Scheme required to locate
capability in system before capability can be revoked

Indirection – capability points to global table entry
which points to object – delete entry from global table

Keys – unique bits associated with capability
generated when capability created
 Master
key associated with object, key matches master
key for access
 Revocation
– create new master key
Operating System Concepts Essentials – 2nd Edition
13.34
Silberschatz, Galvin and Gagne ©2013
Chapter 13: Protection
 Goals of Protection
 Principles of Protection
 Domain of Protection
 Access Matrix
 Implementation of Access Matrix
 Revocation of Access Rights
 Language-Based Protection
Operating System Concepts Essentials – 2nd Edition
13.35
Silberschatz, Galvin and Gagne ©2013
Language-Based Protection
 Specification of protection in programming language
allows high-level description of policies for allocation
and use of resources
 Language implementation can provide software for
protection enforcement when automatic hardwaresupported checking is unavailable
 Interpret protection specifications to generate calls
on whatever protection system is provided by
hardware and operating system
Operating System Concepts Essentials – 2nd Edition
13.36
Silberschatz, Galvin and Gagne ©2013
End of Chapter 13
Operating System Concepts Essentials – 2nd Edition
Silberschatz, Galvin and Gagne ©2013