Bài giảng Hệ điều hành nâng cao - Chapter 14: Protection trình bày các nội dung về bảo vệ hệ thống, mục tiêu của bảo vệ, lĩnh vực bảo vệ, kiểm soát truy cập và thu hồi quyền truy cập,...Mời bạn đọc cùng tham khảo.
AMBIENT/
Chủ đề:
Nội dung Text: Bài giảng Hệ điều hành nâng cao - Chapter 14: Protection
- Chapter 14: Protection
Operating System Concepts– 8th8th Edition
Operating System Concepts – Edition 14.1 Silberschatz, Galvin and Gagne ©2009
- Chapter 14: Protection
s Goals of Protection
s Principles of Protection
s Domain of Protection
s Access Matrix
s Implementation of Access Matrix
s Access Control
s Revocation of Access Rights
s Capability-Based Systems
s Language-Based Protection
Operating System Concepts – 8th Edition 14.2 Silberschatz, Galvin and Gagne ©2009
- Objectives
s Discuss the goals and principles of protection in a modern computer system
s Explain how protection domains combined with an access matrix are used to specify the resources a
process may access
s Examine capability and language-based protection systems
Operating System Concepts – 8th Edition 14.3 Silberschatz, Galvin and Gagne ©2009
- Goals of Protection
s In one protection model, computer consists of a collection of objects, hardware or software
s Each object has a unique name and can be accessed through a well-defined set of operations
s Protection problem - ensure that each object is accessed correctly and only by those processes that are
allowed to do so
Operating System Concepts – 8th Edition 14.4 Silberschatz, Galvin and Gagne ©2009
- Principles of Protection
s Guiding principle – principle of least privilege
q Programs, users and systems should be given just enough privileges to perform their tasks
q Limits damage if entity has a bug, gets abused
q Can be static (during life of system, during life of process)
q Or dynamic (changed by process as needed) – domain switching, privilege escalation
q “Need to know” a similar concept regarding access to data
s Must consider “grain” aspect
q Rough-grained privilege management easier, simpler, but least privilege now done in large chunks
4 For example, traditional Unix processes either have abilities of the associated user, or of root
q Fine-grained management more complex, more overhead, but more protective
4 File ACL lists, RBAC
s Domain can be user, process, procedure
Operating System Concepts – 8th Edition 14.5 Silberschatz, Galvin and Gagne ©2009
- Domain Structure
s Access-right =
where rights-set is a subset of all valid operations that can be performed on the object
s Domain = set of access-rights
Operating System Concepts – 8th Edition 14.6 Silberschatz, Galvin and Gagne ©2009
- Domain Implementation (UNIX)
s Domain = user-id
s Domain switch accomplished via file system
4 Each file has associated with it a domain bit (setuid bit)
4 When file is executed and setuid = on, then user-id is set to owner of the file being executed
4 When execution completes user-id is reset
s Domain switch accomplished via passwords
q su command temporarily switches to another user’s domain when other domain’s password provided
s Domain switching via commands
q sudo command prefix executes specified command in another domain (if original domain has
privilege or password given)
Operating System Concepts – 8th Edition 14.7 Silberschatz, Galvin and Gagne ©2009
- Domain Implementation (MULTICS)
s Let Di and Dj be any two domain rings
s If j < I Di Dj
Operating System Concepts – 8th Edition 14.8 Silberschatz, Galvin and Gagne ©2009
- Multics Benefits and Limits
s Ring / hierarchical structure provided more than the basic kernel / user or root / normal user design
s Fairly complex -> more overhead
s But does not allow strict need-to-know
q Object accessible in Dj but not in Di, then j must be < i
q But then every segment accessible in Di also accessible in Dj
Operating System Concepts – 8th Edition 14.9 Silberschatz, Galvin and Gagne ©2009
- Access Matrix
s View protection as a matrix (access matrix)
s Rows represent domains
s Columns represent objects
s Access(i, j) is the set of operations that a process executing in Domaini can invoke on Objectj
Operating System Concepts – 8th Edition 14.10 Silberschatz, Galvin and Gagne ©2009
- Access Matrix
Operating System Concepts – 8th Edition 14.11 Silberschatz, Galvin and Gagne ©2009
- Use of Access Matrix
s If a process in Domain Di tries to do “op” on object Oj, then “op” must be in the access matrix
s User who creates object can define access column for that object
s Can be expanded to dynamic protection
q Operations to add, delete access rights
q Special access rights:
4 owner of Oi
4 copy op from Oi to Oj (denoted by “*”)
4 control – Di can modify Dj access rights
4 transfer – switch from domain Di to Dj
q Copy and Owner applicable to an object
q Control applicable to domain object
Operating System Concepts – 8th Edition 14.12 Silberschatz, Galvin and Gagne ©2009
- Use of Access Matrix (Cont.)
s Access matrix design separates mechanism from policy
q Mechanism
4 Operating system provides access-matrix + rules
4 If ensures that the matrix is only manipulated by authorized agents and that rules are strictly
enforced
q Policy
4 User dictates policy
4 Who can access what object and in what mode
s But doesn’t solve the general confinement problem
Operating System Concepts – 8th Edition 14.13 Silberschatz, Galvin and Gagne ©2009
- Access Matrix of Figure A
with Domains as Objects
Operating System Concepts – 8th Edition 14.14 Silberschatz, Galvin and Gagne ©2009
- Access Matrix with Copy Rights
Operating System Concepts – 8th Edition 14.15 Silberschatz, Galvin and Gagne ©2009
- Access Matrix With Owner Rights
Operating System Concepts – 8th Edition 14.16 Silberschatz, Galvin and Gagne ©2009
- Modified Access Matrix of Figure B
Operating System Concepts – 8th Edition 14.17 Silberschatz, Galvin and Gagne ©2009
- Implementation of Access Matrix
s Generally, a sparse matrix
s Option 1 – Global table
q Store ordered triples < domain, object, rights-set > in table
q A requested operation M on object Oj within domain Di -> search table for < Di, Oj, Rk >
4 with M ∈ Rk
q But table could be large -> won’t fit in main memory
q Difficult to group objects (consider an object that all domains can read)
s Option 2 – Access lists for objects
q Each column implemented as an access list for one object
q Resulting per-object list consists of ordered pairs < domain, rights-set > defining all domains with
non-empty set of access rights for the object
q Easily extended to contain default set -> If M ∈ default set, also allow access
Operating System Concepts – 8th Edition 14.18 Silberschatz, Galvin and Gagne ©2009
- s Each column = Access-control list for one object
Defines who can perform what operation
Domain 1 = Read, Write
Domain 2 = Read
Domain 3 = Read
s Each Row = Capability List (like a key)
For each domain, what operations allowed on what objects
Object F1 – Read
Object F4 – Read, Write, Execute
Object F5 – Read, Write, Delete, Copy
Operating System Concepts – 8th Edition 14.19 Silberschatz, Galvin and Gagne ©2009
- Implementation of Access Matrix (Cont.)
s Option 3 – Capability list for domains
q Instead of object-based, list is domain based
q Capability list for domain is list of objects together with operations allows on them
q Object represented by its name or address, called a capability
q Execute operation M on object Oj, process requests operation and specifies capability as parameter
4 Possession of capability means access is allowed
q Capability list associated with domain but never directly accessible by domain
4 Rather, protected object, maintained by OS and accessed indirectly
4 Like a “secure pointer”
4 Idea can be extended up to applications
s Option 4 – Lock-key
q Compromise between access lists and capability lists
q Each object has list of unique bit patterns, called locks
q Each domain as list of unique bit patterns called keys
q Process in a domain can only access object if domain has key that matches one of the locks
Operating System Concepts – 8th Edition 14.20 Silberschatz, Galvin and Gagne ©2009
Thêm vào BST
Báo xấu
Download
Vui lòng tải xuống để xem tài liệu đầy đủ
