Protection

Goals of Protection

· Operating system consists of a collection of objects: hardware or software

· Each object has a unique name and can be accessed through a well-defined set of operations

· Protection problem - ensure that each object is accessed correctly and

only by those processes that are allowed to do so

ü Protection guiding principle – principle of least privilege:

Programs, users and systems should be given just enough privileges to perform their tasks

Domain Structure

· Access-right = <object-name, rights-set>
where rights-set is a subset of all valid operations that can be performed on the object.

· Domain = set of access-rights

Domain Implementation in UNIX

§ Domain = user-id

§ Domain switch accomplished via file system

ü Each file has associated with it a domain bit (setuid bit)

ü When file is executed and setuid is on, then user-id is set to owner of the file being executed.

ü When execution completes user-id is reset

Examples:

setuid (set user id):

Allows a user to be another user during the execution of a program.

For example:

[antares] ~> cd /usr/bin

[antares] /usr/bin> ls -l passwd

-r-sr-sr-x 1 root sys 27228 Aug 16 2007 passwd

[antares] /usr/bin> ls -l | grep sr

-r-sr-xr-x 1 root bin 31408 Jan 22 2005 login

-r-sr-sr-x 1 root sys 27228 Aug 16 2007 passwd

.........

Run passwd in one window:

[antares] ~> passwd

Run in another window:

[antares] ~> ps -a -o user,ruser,comm

USER RUSER COMMAND

root cs471w passwd

How to setuid of a program:

[antares] ~> chmod u+s program

Example:

[vega] ~/public_html/code/final-src/chap14> ls -lt

-rwxr--r-- 1 cs471w cs471w 58 2010-04-19 14:15 setuidf.c

[vega] ~/public_html/code/final-src/chap14>gcc -o setuidf setuidf.c

[vega] ~/public_html/code/final-src/chap14>ls -lt

-rwx------ 1 cs471w cs471w 5692 2010-04-19 14:21 setuidf

-rwxr--r-- 1 cs471w cs471w 58 2010-04-19 14:15 setuidf.c

[vega] ~/public_html/code/final-src/chap14>chmod a+rx setuidf

[vega] ~/public_html/code/final-src/chap14>ls -lt

-rwxr-xr-x 1 cs471w cs471w 5692 2010-04-19 14:21 setuidf

-rwxr--r-- 1 cs471w cs471w 58 2010-04-19 14:15 setuidf.c

[vega] ~/public_html/code/final-src/chap14>chmod u+s setuidf

[vega] ~/public_html/code/final-src/chap14>ls -lt

-rwsr-xr-x 1 cs471w cs471w 5692 2010-04-19 14:21 setuidf

-rwxr--r-- 1 cs471w cs471w 58 2010-04-19 14:15 setuidf.c

Access Matrix

· View protection as a matrix (access matrix)

· Rows represent domains

· Columns represent objects

· Access(i, j) is the set of operations that a process executing in Domain_i can invoke on Object_j

Use of Access Matrix

· If a process in Domain D_i tries to do “op” on object O_j then “op” must be in the access matrix

· Access matrix design: separate Mechanism from Policy:

Mechanism

It ensures that the matrix is only manipulated by authorized agents and rules are strictly enforced

Policy

User dictates policy:

Who can access what object and in what mode

Implementation of Access Matrix

· Each column = Access-control list for one object
Defines who can perform what operation.

Domain 1 = Read, Write
Domain 2 = Read
Domain 3 = Read

M

· Each Row = Capability List (like a key)
Fore each domain, what operations allowed on what objects.

Object 1 – Read

Object 4 – Read, Write, Execute

Object 5 – Read, Write, Delete, Copy

Access Matrix With Domains as Objects

transfer – switch from domain D_i to D_j