operating system《操作系统》ch14-protection-25

Chapter14:Protection14.2Chapter14:ProtectionGoalsofProtectionPrinciplesofProtectionDomainofProtectionAccessMatrixImplementationofAccessMatrixAccessControlRevocationofAccessRightsCapability-BasedSystemsLanguage-BasedProtection14.3ObjectivesDiscussthegoalsandprinciplesofprotectioninamoderncomputersystemExplainhowprotectiondomainscombinedwithanaccessmatrixareusedtospecifytheresourcesaprocessmayaccessExaminecapabilityandlanguage-basedprotectionsystems14.4GoalsofProtectionOperatingsystemconsistsofacollectionofobjects,hardwareorsoftwareEachobjecthasauniquenameandcanbeaccessedthroughawell-definedsetofoperations.Protectionproblem-ensurethateachobjectisaccessedcorrectlyandonlybythoseprocessesthatareallowedtodoso.14.5PrinciplesofProtectionGuidingprinciple–principleofleastprivilegePrograms,usersandsystemsshouldbegivenjustenoughprivilegestoperformtheirtasks14.6DomainStructureAccess-right=object-name,rights-setwhererights-setisasubsetofallvalidoperationsthatcanbeperformedontheobject.Domain=setofaccess-rights14.7DomainImplementation(UNIX)Systemconsistsof2domains:UserSupervisorUNIXDomain=user-idDomainswitchaccomplishedviafilesystem.Eachfilehasassociatedwithitadomainbit(setuidbit).Whenfileisexecutedandsetuid=on,thenuser-idissettoownerofthefilebeingexecuted.Whenexecutioncompletesuser-idisreset.14.8DomainImplementation(MULTICS)LetDiandDjbeanytwodomainrings.IfjIDiDj14.9AccessMatrixViewprotectionasamatrix(accessmatrix)RowsrepresentdomainsColumnsrepresentobjectsAccess(i,j)isthesetofoperationsthataprocessexecutinginDomainicaninvokeonObjectj14.10AccessMatrix14.11UseofAccessMatrixIfaprocessinDomainDitriestodo“op”onobjectOj,then“op”mustbeintheaccessmatrix.Canbeexpandedtodynamicprotection.Operationstoadd,deleteaccessrights.Specialaccessrights:ownerofOicopyopfromOitoOjcontrol–DicanmodifyDjaccessrightstransfer–switchfromdomainDitoDj14.12UseofAccessMatrix(Cont.)Accessmatrixdesignseparatesmechanismfrompolicy.MechanismOperatingsystemprovidesaccess-matrix+rules.Ifensuresthatthematrixisonlymanipulatedbyauthorizedagentsandthatrulesarestrictlyenforced.PolicyUserdictatespolicy.Whocanaccesswhatobjectandinwhatmode.14.13ImplementationofAccessMatrixEachcolumn=Access-controllistforoneobjectDefineswhocanperformwhatoperation.Domain1=Read,WriteDomain2=ReadDomain3=ReadEachRow=CapabilityList(likeakey)Foreeachdomain,whatoperationsallowedonwhatobjects.Object1–ReadObject4–Read,Write,ExecuteObject5–Read,Write,Delete,Copy14.14AccessMatrixofFigureAWithDomainsasObjectsFigureB14.15AccessMatrixwithCopyRights14.16AccessMatrixWithOwnerRights14.17ModifiedAccessMatrixofFigureB14.18AccessControlProtectioncanbeappliedtonon-fileresourcesSolaris10providesrole-basedaccesscontroltoimplementleastprivilegePrivilegeisrighttoexecutesystemcalloruseanoptionwithinasystemcallCanbeassignedtoprocessesUsersassignedrolesgrantingaccesstoprivilegesandprograms14.19Role-basedAccessControlinSolaris1014.20RevocationofAccessRightsAccessList–Deleteaccessrightsfromaccesslist.SimpleImmediateCapabilityList–Schemerequiredtolocatecapabilityinthesystembeforecapabilitycanberevoked.ReacquisitionBack-pointersIndirectionKeys14.21Capability-BasedSystemsHydraFixedsetofaccessrightsknowntoandinterpretedbythesystem.Interpretationofuser-definedrightsperformedsolelybyuser'sprogram;systemprovidesaccessprotectionforuseoftheserights.CambridgeCAPSystemDatacapability-providesstandardread,write,executeofindividualstoragesegmentsassociatedwithobject.Softwarecapability-interpretationlefttothesubsystem,throughitsprotectedprocedures.14.22Language-BasedProtectionSpecificationofprotectioninaprogramminglanguageallowsthehigh-leveldescriptionofpoliciesfortheallocationanduseofresources.Languageimplementationcanprovidesoftwareforprotectionenforcementwhenautomatichardware-supportedcheckingisunavailable.Interpretprotectionspecificationstogeneratecallsonwhateverprotectionsystemisprovidedbythehardwareandtheoperatingsystem.14.23ProtectioninJava2ProtectionishandledbytheJavaVirtualMachine(JVM)AclassisassignedaprotectiondomainwhenitisloadedbytheJVM.Theprotectiondomainindicateswhatoperationstheclasscan(andcannot)perform.Ifalibrarymethodisinvokedthatperformsaprivilegedoperation,thestackisinspectedtoensuretheoperationcanbeperformedbythelibrary.14.24StackInspectionEndofChapter14