5. Chapter 5: Distributed Operating System

5.3. Protection

  • Protect from illegitimate accesses for resources.
  • Threats may come from maliciously contrived code. 
  • Example:
    • Consider a file – two operations: read and write
    • Ensure that each of the file’s two operations can be performed only by clients with the right to perform it. 
    • Example: Smith: read and right, Jones: read.
      • Illegitimate access – Jones managed to perform a write operation on the file. 
      • A complete solution in a distributed system requires cryptographic techniques. 
  • Threats may also come from misbehaving client sidesteps the operation that a resource exports. 
    • Example: Smith or Jones managed to execute an operation that was neither read nor write. 
    • Smith managed to access the file pointer directly and construct a setFilePointerRandomly operation, that sets the file pointer to a random number.
  • To protect resources from illegitimate invocations: use type-safe programming language such as Sing# (extension of C#) or Modula-3. 
  • In type-safe languages, no module may access a target module unless it has a reference to it – it cannot make up a pointer to it. 
  • Employ hardware support to protect modules from one another at the level of individual invocations, regardless of the language in which they are written – kernel.
  • Kernels and protection
    • The kernel is a program that is remains loaded from system initialization 
    • Its code is executed with complete access privileges for the physical resources on its host computer. 
    • It can control memory management unit and set the processor registers so that no other code may access the machine’s physical resources except in acceptable ways. 
  • Kernels and protection
    • A kernel process executes with the processor in supervisor (privileged) mode.
    • The kernel arranges that other processes execute in user (unprivileged) mode. 
    • The kernel sets up address spaces to protect itself and other processes from the accesses of an aberrant process.
      • Address space – a collection of ranges of virtual memory locations with memory access rights applies such as read-only or read-write. 
      • A process cannot access memory outside its address space. 
      • The kernel provide processes with their required virtual memory layout. 
      • When a process executed application code, it executes in a distinct user-level address space for that application.
      • When the same process executes kernel code, it executes in the kernel’s address space. 
      • The process can safely transfer from a user-level address space to the kernel’s address space via an operation such as an interrupt or a system call trap. 
  • Example of interrupt or a system call trap execution
    • Implemented by a machine-level TRAP instruction.
    • Puts the processor into supervisor mode and switches to the kernel address space. 
    • The hardware forces the processor to execute a kernel-supplied handler function, in order that no process may gain illicit control of the hardware. 
  • However, switching between address spaces may take many processor cycles, and a system call trap is a more expensive operation than a simple procedure or method call.