Protection, Pt. 2

Question 1

Policy vs. Mechanism with a Matrix

Answer 1

Mechanism
-Operating system provides access matrix + rules
-Matrix is only manipulated by authorized users
-Rules are strictly enforced
Policy
-Users/admins dictate policy (who can access what object in what mode)

Question 2

Implementation of Access Matrix

Answer 2

• Global Table
• Access Control List
• Capability List

Question 3

Global Table

Answer 3

• The matrix is large and sparse - additional I/O
• Grouping can help reduce the size
• Repetition of access rights for defaults

Question 4

Access Control List (ACL)

Answer 4

• Each column has a list of domains that can access it and what type of access
• Can support default rights
• Difficult to determine access rights of a domain

Question 5

Capability List

Answer 5

• Each row has a list of objects and what operations are allowed on them
• Difficult to revoke capabilities of an object

Question 6

Schemes to Implement Revocation

Answer 6

• Back-pointers (pointers maintained to object with capabilities)
• Indirection (capabilities point to entry in global table)
• Reacquisition (periodically delete capability from each domain)
• Keys (objects have a master key, capabilities have a copy of the key, revocation is done by changing the master key, objects can hold multiple keys)

Question 7

Capabilities/ACL

Answer 7

• When a process tries to access object, ACL is searched
• If approved, a capability is created and attached to that process
• Subsequent accesses use the capability for faster check

Question 8

Protection in Unix

Answer 8

ACL can be long and time consuming to search, so Unix has three classes: owner, group, and universe (rwx stuff)

Question 9

Problems with rwx

Answer 9

• If you want more than three different classes, you need to do something else
• Solaris and Linux create on-demand ACL if more access classes are required

Question 10

A user in one domain may need to execute a command allowed only in ____

Answer 10

Another domain

Question 11

Temporary Domain Switching

Answer 11

• Each executable file has a setuid bit associated with it
• When setuid bit is set to 1, any user will execute the file with the same privileges as the owner of the file
• Use “s” in place of the x bit
• setgid is the same, but for groups instead of users