Chapter 17: Protection

Operating System Concepts – 10th Edition Silberschatz, Galvin and Gagne ©2018
 Chapter 17: Protection
▪ Goals of Protection
▪ Principles of Protection
▪ Protection Rings
▪ Domain of Protection
▪ Access Matrix
▪ Implementation of Access Matrix

Operating System Concepts – 10th Edition 17.2 Silberschatz, Galvin and Gagne ©2018
 Objectives
▪ Discuss the goals and principles of protection in a modern computer
system
▪ Explain how protection domains combined with an access matrix are
used to specify the resources a process may access

Operating System Concepts – 10th Edition 17.3 Silberschatz, Galvin and Gagne ©2018
 Goals of Protection
▪ In one protection model, computer consists of a collection of objects,
hardware or software
▪ Each object has a unique name and can be accessed through a well-
defined set of operations
▪ Protection problem - ensure that each object is accessed correctly
and only by those processes that are allowed to do so

Operating System Concepts – 10th Edition 17.4 Silberschatz, Galvin and Gagne ©2018
 Principles of Protection
▪ Guiding principle – principle of least privilege
• Programs, users and systems should be given just enough
privileges to perform their tasks
• Properly set permissions can limit damage if entity has a bug,
gets abused
• Can be static (during life of system, during life of process)
• Or dynamic (changed by process as needed) – domain
switching, privilege escalation
• Compartmentalization a derivative concept regarding access to
data
 Process of protecting each individual system component
through the use of specific permissions and access restrictions

Operating System Concepts – 10th Edition 17.5 Silberschatz, Galvin and Gagne ©2018
 Principles of Protection (Cont.)
▪ Must consider “grain” aspect
• Rough-grained privilege management easier, simpler, but least
privilege now done in large chunks
 For example, traditional Unix processes either have abilities of
the associated user, or of root
• Fine-grained management more complex, more overhead, but
more protective
 File ACL lists, RBAC
▪ Domain can be user, process, procedure
▪ Audit trail – recording all protection-orientated activities, important to
understanding what happened, why, and catching things that
shouldn’t
▪ No single principle is a panacea for security vulnerabilities – need
defense in depth

Operating System Concepts – 10th Edition 17.6 Silberschatz, Galvin and Gagne ©2018
 Protection Rings
▪ Components ordered by amount of privilege and protected from each
other
• For example, the kernel is in one ring and user applications in
another
• This privilege separation requires hardware support
• Gates used to transfer between levels, for example the syscall
Intel instruction
• Also traps and interrupts
• Hypervisors introduced the need for yet another ring
• ARMv7 processors added TrustZone(TZ) ring to protect crypto
functions with access via new Secure Monitor Call (SMC)
instruction
 Protecting NFC secure element and crypto keys from even the
kernel

Operating System Concepts – 10th Edition 17.7 Silberschatz, Galvin and Gagne ©2018
 Protection Rings (MULTICS)
▪ Let Di and Dj be any two domain rings
▪ If j < I  Di  Dj

Operating System Concepts – 10th Edition 17.8 Silberschatz, Galvin and Gagne ©2018
 Domain of Protection
▪ Rings of protection separate functions into domains and
order them hierarchically
▪ Computer can be treated as processes and objects
• Hardware objects (such as devices) and software
objects (such as files, programs, semaphores
▪ Process for example should only have access to objects it
currently requires to complete its task – the need-to-know
principle

Operating System Concepts – 10th Edition 17.11 Silberschatz, Galvin and Gagne ©2018
 Domain of Protection (Cont.)
▪ Implementation can be via process operating in a protection domain
• Specifies resources process may access
• Each domain specifies set of objects and types of operations on
them
• Ability to execute an operation on an object is an access right
 <object-name, rights-set>
• Domains may share access rights
• Associations can be static or dynamic
• If dynamic, processes can domain switch

Operating System Concepts – 10th Edition 17.12 Silberschatz, Galvin and Gagne ©2018
 Domain Structure
▪ Access-right = <object-name, rights-set>
where rights-set is a subset of all valid operations that can be
performed on the object
▪ Domain = set of access-rights

Operating System Concepts – 10th Edition 17.13 Silberschatz, Galvin and Gagne ©2018
 Access Matrix
▪ View protection as a matrix (access matrix)
▪ Rows represent domains
▪ Columns represent objects
▪ Access(i, j) is the set of operations that a process
executing in Domaini can invoke on Objectj

Operating System Concepts – 10th Edition 17.16 Silberschatz, Galvin and Gagne ©2018
 Use of Access Matrix
▪ If a process in Domain Di tries to do “op” on object Oj, then “op” must
be in the access matrix
▪ User who creates object can define access column for that object
▪ Can be expanded to dynamic protection
• Operations to add, delete access rights
• Special access rights:
 owner of Oi
 copy op from Oi to Oj (denoted by “*”)
 control – Di can modify Dj access rights
 transfer – switch from domain Di to Dj
• Copy and Owner applicable to an object
• Control applicable to domain object

Operating System Concepts – 10th Edition 17.17 Silberschatz, Galvin and Gagne ©2018
 Use of Access Matrix (Cont.)
▪ Access matrix design separates mechanism from policy
• Mechanism
 Operating system provides access-matrix + rules
 If ensures that the matrix is only manipulated by authorized
agents and that rules are strictly enforced
• Policy
 User dictates policy
 Who can access what object and in what mode
▪ But doesn’t solve the general confinement problem

Operating System Concepts – 10th Edition 17.18 Silberschatz, Galvin and Gagne ©2018
 Access Matrix of Figure A with
Domains as Objects

Operating System Concepts – 10th Edition 17.19 Silberschatz, Galvin and Gagne ©2018
 Access Matrix with Copy Rights

Operating System Concepts – 10th Edition 17.20 Silberschatz, Galvin and Gagne ©2018
 Access Matrix With Owner Rights

Operating System Concepts – 10th Edition 17.21 Silberschatz, Galvin and Gagne ©2018
 Modified Access Matrix of Figure B

Operating System Concepts – 10th Edition 17.22 Silberschatz, Galvin and Gagne ©2018
 Implementation of Access Matrix
▪ Generally, a sparse matrix
▪ Option 1 – Global table
• Store ordered triples <domain, object, rights-set> in
table
• A requested operation M on object Oj within domain Di -> search
table for < Di, Oj, Rk >
 with M ∈ Rk

• But table could be large -> won’t fit in main memory

• Difficult to group objects (consider an object that all domains can
read)

Operating System Concepts – 10th Edition 17.23 Silberschatz, Galvin and Gagne ©2018
 Implementation of Access Matrix (Cont.)
▪ Option 2 – Access lists for objects
• Each column implemented as an access list for one object
• Resulting per-object list consists of ordered pairs <domain,
rights-set> defining all domains with non-empty set of access
rights for the object
• Easily extended to contain default set -> If M ∈ default set, also
allow access

Operating System Concepts – 10th Edition 17.24 Silberschatz, Galvin and Gagne ©2018
 Implementation of Access Matrix (Cont.)
▪ Each column = Access-control list for one object
Defines who can perform what operation

Domain 1 = Read, Write

Domain 2 = Read
Domain 3 = Read

▪ Each Row = Capability List (like a key)

For each domain, what operations allowed on what objects
Object F1 – Read
Object F4 – Read, Write, Execute
Object F5 – Read, Write, Delete, Copy

Operating System Concepts – 10th Edition 17.25 Silberschatz, Galvin and Gagne ©2018
 Implementation of Access Matrix (Cont.)
▪ Option 3 – Capability list for domains
• Instead of object-based, list is domain based
• Capability list for domain is list of objects together with
operations allows on them
• Object represented by its name or address, called a capability
• Execute operation M on object Oj, process requests operation and
specifies capability as parameter
 Possession of capability means access is allowed
• Capability list associated with domain but never directly accessible
by domain
 Rather, protected object, maintained by OS and accessed
indirectly
 Like a “secure pointer”
 Idea can be extended up to applications

Operating System Concepts – 10th Edition 17.26 Silberschatz, Galvin and Gagne ©2018
 Implementation of Access Matrix (Cont.)
▪ Option 4 – Lock-key
• Compromise between access lists and capability lists
• Each object has list of unique bit patterns, called locks
• Each domain as list of unique bit patterns called keys
• Process in a domain can only access object if domain has key that
matches one of the locks

Operating System Concepts – 10th Edition 17.27 Silberschatz, Galvin and Gagne ©2018
 Comparison of Implementations
▪ Many trade-offs to consider
• Global table is simple, but can be large
• Access lists correspond to needs of users
 Determining set of access rights for domain non-localized so
difficult
 Every access to an object must be checked
– Many objects and access rights -> slow
• Capability lists useful for localizing information for a given process
 But revocation capabilities can be inefficient
• Lock-key effective and flexible, keys can be passed freely from
domain to domain, easy revocation

Operating System Concepts – 10th Edition 17.28 Silberschatz, Galvin and Gagne ©2018
 Comparison of Implementations (Cont.)
▪ Most systems use combination of access lists and capabilities
• First access to an object -> access list searched
 If allowed, capability created and attached to process
– Additional accesses need not be checked
 After last access, capability destroyed
 Consider file system with ACLs per file

Operating System Concepts – 10th Edition 17.29 Silberschatz, Galvin and Gagne ©2018
 End of Chapter 17

Operating System Concepts – 10th Edition Silberschatz, Galvin and Gagne ©2018