资源描述：
《中山大学软件学院操作系统概念上课课件第14章.ppt》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。
1、Chapter14:ProtectionChapter14:ProtectionGoalsofProtectionPrinciplesofProtectionDomainofProtectionAccessMatrixImplementationofAccessMatrixAccessControlRevocationofAccessRightsCapability-BasedSystemsLanguage-BasedProtectionObjectivesDiscussthegoalsandprin
2、ciplesofprotectioninamoderncomputersystemExplainhowprotectiondomainscombinedwithanaccessmatrixareusedtospecifytheresourcesaprocessmayaccessExaminecapabilityandlanguage-basedprotectionsystemsGoalsofProtectionInoneprotectionmodel,computerconsistsofacollec
3、tionofobjects,hardwareorsoftwareEachobjecthasauniquenameandcanbeaccessedthroughawell-definedsetofoperationsProtectionproblem-ensurethateachobjectisaccessedcorrectlyandonlybythoseprocessesthatareallowedtodosoPrinciplesofProtectionGuidingprinciple–princip
4、leofleastprivilegePrograms,usersandsystemsshouldbegivenjustenoughprivilegestoperformtheirtasksLimitsdamageifentityhasabug,getsabusedCanbestatic(duringlifeofsystem,duringlifeofprocess)Ordynamic(changedbyprocessasneeded)–domainswitching,privilegeescalatio
5、n“Needtoknow”asimilarconceptregardingaccesstodataMustconsider“grain”aspectRough-grainedprivilegemanagementeasier,simpler,butleastprivilegenowdoneinlargechunksForexample,traditionalUnixprocesseseitherhaveabilitiesoftheassociateduser,orofrootFine-grainedm
6、anagementmorecomplex,moreoverhead,butmoreprotectiveFileACLlists,RBACDomaincanbeuser,process,procedureDomainStructureAccess-right= whererights-setisasubsetofallvalidoperationsthatcanbeperformedontheobjectDomain=setofaccess-rightsD
7、omainImplementation(UNIX)Domain=user-idDomainswitchaccomplishedviafilesystemEachfilehasassociatedwithitadomainbit(setuidbit)Whenfileisexecutedandsetuid=on,thenuser-idissettoownerofthefilebeingexecutedWhenexecutioncompletesuser-idisresetDomainswitchaccom
8、plishedviapasswordssucommandtemporarilyswitchestoanotheruser’sdomainwhenotherdomain’spasswordprovidedDomainswitchingviacommandssudocommandprefixexecutesspecifiedcommandinanotherdomain(iforiginaldomainhasprivilegeorpasswordgiven)D
