Explain memory and address protection in detail.

2) File Protection: 

In computer systems, alot of user’s information is stored, the objective of the operating system is to keep safe the data of the user from the improper access to the system. Protection can be provided in number of ways. For a single laptop system, we might provide protection by locking the computer in a desk drawer or file cabinet. For multi-user systems, different mechanisms are used for the protection.

Types of Access:

The files which have direct access of the any user have the need of protection. The files which are not accessible to other users doesn’t require any kind of protection. The mechanism of the protection provide the facility of the controlled access by just limiting the types of access to the file. Access can be given or not given to any user depends on several factors, one of which is the type of access required. Several different types of operations can be controlled:

• Read – Reading from a file.
• Write – Writing or rewriting the file.
• Execute – Loading the file and after loading the execution process starts.
• Append – Writing the new information to the already existing file, editing must be end at the end of the existing file.
• Delete – Deleting the file which is of no use and using its space for the another data.
• List – List the name and attributes of the file.

Operations like renaming, editing the existing file, copying; these can also be controlled. There are many protection mechanism. each of them mechanism have different advantages and disadvantages and must be appropriate for the intended application.

Access Control :

There are different methods used by different users to access any file. The general way of protection is to associate identity-dependent access with all the files and directories an list called access-control list (ACL) which specify the names of the users and the types of access associate with each of the user. The main problem with the access list is their length. If we want to allow everyone to read a file, we must list all the users with the read access. This technique has two undesirable consequences:

Constructing such a list may be tedious and unrewarding task, especially if we do not know in advance the list of the users in the system.

Previously, the entry of the any directory is of the fixed size but now it changes to the variable size which results in the complicates space management. These problems can be resolved by use of a condensed version of the access list. To condense the length of the access-control list, many systems recognize three classification of users in connection with each file:

• Owner – Owner is the user who has created the file.
• Group – A group is a set of members who has similar needs and they are sharing the same file.
• Universe – In the system, all other users are under the category called universe.

The most common recent approach is to combine access-control lists with the normal general owner, group, and universe access control scheme. For example: Solaris uses the three categories of access by default but allows access-control lists to be added to specific files and directories when more fine-grained access control is desired.

Memory and address protection stop one program from reading or changing memory that belongs to the operating system or another user. Main methods: fence, relocation, base/bounds registers, tagged architecture, segmentation and paging. File protection controls who may read, write or execute each file.

1. Memory and address protection

• Fence: a fixed address or a fence register divides memory between the OS and the user program; every user address is checked to be above the fence. Protects only the OS, and only in one direction.
• Relocation: programs are written as if starting at address 0; a relocation factor (the program's actual start address) is added to every address at run time.
• Base/bounds registers: the base register holds the lowest legal address and the bounds register the upper limit of a program. Every address must lie between them, so each user is confined to its own area. A second pair can separate code from data so code cannot be overwritten.
• Tagged architecture: every memory word carries extra tag bits stating its access rights (read-only, execute-only, etc.), checked on each access. Fine-grained but needs special hardware.
• Segmentation: the program is divided into logical segments (code, data, stack). Addresses are (segment, offset); the OS checks each segment's length and access rights, and a program cannot name a segment not in its table.
• Paging: memory is divided into equal pages and frames; a page table translates addresses, so a program can reach only the frames mapped to it. Access bits (read/write/execute) on each page add protection. Paged segmentation combines both.

2. File protection

• Types of access controlled: read, write, execute, append, delete, list.
• All-or-none / group protection: users are grouped as owner, group and others (world), and each class gets rights, e.g. UNIX rwxr-x---.
• Access control list (ACL): each file keeps a list of users and their allowed operations.
• Passwords / tokens: a password may be needed to open a file; temporary acquired permission (e.g. UNIX set-uid) lets a program run with its owner's rights.
• Per-object and per-user protection gives the finest control but is harder to manage.