OS security: users, rights and isolation
Why the OS checks every request, why root is a last resort, and how processes are kept apart.
Every process runs as some user, and every file has an owner. The kernel checks one against the other on every open, read, write and execute. That check is the reason a broken program cannot simply read your documents: it has to ask, and the answer depends on who it is running as. Permissions are written in three groups of three: what the owner may do, what the group may do, and what everyone else may do.
-rw-r--r-- 1 root root 512 Jan 10 09:14 notes.txt
-rw------- 1 alice alice 512 Jan 10 09:14 diary.txt
-rwxr-xr-x 1 root root 118 Jan 10 09:14 backup.sh
who what they may do
------ -------------------------------------------
owner read and write
group read
everyone else readRead the nine characters in three groups: owner, group, everyone else. r is read, w is write, x is execute.A long job arrives first. Watch how everything behind it waits.
| Process | Arrival | Burst | State | Used |
|---|---|---|---|---|
| P1 | 0 | 6 | waiting | — |
| P2 | 1 | 4 | waiting | — |
| P3 | 2 | 2 | waiting | — |
| P4 | 3 | 1 | waiting | — |
- P1
P1 arrives with a burst of 6ms
- Avg waiting time
- 0
- Avg turnaround time
- 0
- Total time
- 0
| Algorithm | Avg waiting time | Avg turnaround time | Total time |
|---|---|---|---|
| First-Come, First-Served | 5.5 | 8.75 | 13 |
| Shortest Job First | 4 | 7.25 | 13 |
| Round-Robin | 5.75 | 9 | 13 |
Privilege escalation is the name for getting from a limited account to a more powerful one. It rarely needs a clever exploit: a script owned by root but writable by everyone, a service running as root that trusts its input, a setuid binary with a known flaw. The lesson is not about exotic bugs but about searching for that mismatch — something more privileged than it should be, handling something less trusted than it should.
Practice
A file shows the mode -rw-r--r-- and is owned by alice. Alice tries to write to it. What happens?
Hints
- Walk the permission string one character group at a time: owner, group, everyone.
- Being the owner is not a special right — the owner line is checked first.
14 XP
Put the steps in order for how a normal program reads a file it may access.
Hints
- Start from who asks and end with what the program finally gets.
- The kernel is the only one allowed to talk to the disk and the hardware.
15 XP
Match each defence with what it actually restricts.
Hints
- Match on what each measure actually restricts, not on how loud the warning sounds.
- A shorter list is safer than a longer one, even when the short one is less convenient.
15 XP