Protection and security
Introduced
Vocabulary
| English | Meaning |
|---|---|
| rings | rings |
| kernel mode | kernel mode |
| system call | system call |
| least privilege | least privilege |
Two rings, one door
- User mode runs application code; kernel mode runs the OS and may touch devices and page tables. The CPU's mode bit enforces the rings; the crossing points are system calls — the wall's only doors.
{exercise:uni-cs0706-rings}
Practice
User code reaches kernel services only through —
Difficulty 1/5 · 100 coins + a small bonus on first completion today
The mode bit walls the rings; syscalls are the only doors.
One crossing, priced
open("/notes/x")from user mode: the trap switches the mode bit, saves user registers, jumps to a fixed vector; the kernel validates the path and fills a descriptor; the mode bit flips back.- Two crossings per syscall at about 100 ns each: a program doing $10^6$ syscalls pays $0.2$ s — the reason libraries buffer and batch.
{exercise:uni-cs0706-crossing}
Practice
One syscall costs two crossings of about 100 ns; a million syscalls cost —
Difficulty 1/5 · 100 coins + a small bonus on first completion today
1e6 x 2 x 100 ns = 0.2 s — why libraries batch.
Least privilege, and the confused deputy
- Least privilege gives each process only what it needs: page tables do it per process, file permissions do it per user ($9$ bits: read/write/execute for owner/group/other), capabilities do it per object.
- A privileged printer daemon asked to print
/salary.dbuses its own authority, not the user's — the confused deputy. The fix: pass capabilities (open descriptors), not names. Validate every crossing; a smaller privileged base is a smaller target.
{exercise:uni-cs0706-least}
Practice
The confused deputy is fixed by passing —
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Capabilities (open descriptors) let the deputy use only what it was handed.