LinuxQuestions.org - A question from reading a textbook

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - A question from reading a textbook (https://www.linuxquestions.org/questions/linux-security-4/a-question-from-reading-a-textbook-856843/)

A question from reading a textbook

Operating System Concepts: SILBERSCHATZ 6th ed

In the part of "Protection and Security", the first two paragraphs are as below,

Quote:

Protection mechanisms provide controlled access by limiting the types of file access permitted to users. In addition, protection must also ensure that only those processes that have gained proper authorization from the operating system can operate on memory segments, the CPU, and other resources.

Protection is provided by a mechanism that controls the access of programs, processes, or users to the resources defined by a computer system. This mechanism must provide a means for specification of the controls to be imposed, together with a means of enforcement.

It seems like the two paragraphs are not very consistent. The first paragraph seems discussing protection with proceses, while the second extends to users and programs. Is it necessary redundancy?

I have found that people who write technical books are often not very good writers.

It seems that the two quotes are very similar. I don't know why you say that they are not consistent.

Quote:

Protection mechanisms provide controlled access by limiting the types of file access permitted to users.

Quote:

In addition, protection must also ensure that only those processes that have gained proper authorization from the operating system can operate on memory segments, the CPU, and other resources.

In Linux, each process has their own memory space. Other processes' memory segments are not visible to the process, even if it tried every possible memory address. (Bugs and MMU-less platforms exist, though.)
CPU and I/O priorities are enforced by the kernel, totally invisibly to the process (other than the resulting effects). The kernel also enforces a large number of per-process limits: for example, the kernel will terminate any process which runs longer (uses more CPU time) than a set limit.

Quote:

Protection is provided by a mechanism that controls the access of programs, processes, or users to the resources defined by a computer system.

This is a repeat of the first quoted sentence, but extends the scope to cover all resources a computer system has.

Quote:

This mechanism must provide a means for specification of the controls to be imposed, together with a means of enforcement.

In Linux, this specification is done via utility programs like chmod, chown, nice, ionice, su and sudo and so on, but also via detailed configuration files in the /etc/ tree.

Hope this helps,

Nominal Animal

Super! Thank you!

Quote:

Originally Posted by Nominal Animal (Post 4228332)

One such protection mechanism in Linux is the standard Unix access control mechanism: in most file systems every file, directory, device et cetera has an owner-user, an owner-group, and a separate patterns defining the access types (read, write, execute/traverse) allowed for the owner-user, any user belonging to the owner-group, and all others.

In Linux, each process has their own memory space. Other processes' memory segments are not visible to the process, even if it tried every possible memory address. (Bugs and MMU-less platforms exist, though.)
CPU and I/O priorities are enforced by the kernel, totally invisibly to the process (other than the resulting effects). The kernel also enforces a large number of per-process limits: for example, the kernel will terminate any process which runs longer (uses more CPU time) than a set limit.

This is a repeat of the first quoted sentence, but extends the scope to cover all resources a computer system has.

In Linux, this specification is done via utility programs like chmod, chown, nice, ionice, su and sudo and so on, but also via detailed configuration files in the /etc/ tree.

Hope this helps,

Nominal Animal