The RC 4000 system, among others, has defined a tree of processes(called a process tree)

What are the main differences between capability lists and access lists?

A Burroughs B7000/B6000 MCP file can be tagged as sensitive data. When such a file is deleted, its storage area is overwritten by some random bits. For what purpose would such a scheme be useful?

In a ring-protection system, level 0 has the greatest access to objects, and level n (where n > 0) has fewer access rights. The access rights of a program at a particular level in the ring structure are considered a set of capabilities. What is the relationship between the capabilities of a domain at level j and a domain at level i to an object (for j > i)?

The RC 4000 system, among others, has defined a tree of processes (called a process tree) such that all the descendants of a process can be given resources (objects) and access rights by their ancestors only. Thus, a descendant can never have the ability to do anything that its ancestors cannot do. The root of the tree is the operating system, which has the ability to do anything. Assume that the set of access rights is represented by an access matrix, A. A(x,y) defines the access rights of process x to object y. If x is a descendant of z, what is the relationship between A(x,y) and A(z,y) for an arbitrary object y?

What protection problems may arise if a shared stack is used for parameter passing?

Consider a computing environment where a unique number is associated with each process and each object in the system. Suppose that we allow a process with number n to access an object with number m only if n > m. What type of protection structure do we have?

Consider a computing environment where a process is given the privilege of accessing an object only n times. Suggest a scheme for implementing this policy.

If all the access rights to an object are deleted, the object can no longer be accessed. At this point, the object should also be deleted, and the space it occupies should be returned to the system. Suggest an efficient implementation of this scheme.

Why is it difficult to protect a system in which users are allowed to do their own I/O?

Capability lists are usually kept within the address space of the user. How does the system ensure that the user cannot modify the contents of the list?

Consider the ring-protection scheme in MULTICS. If we were to implement the system calls of a typical operating system and store them in a segment associated with ring 0, what should be the values stored in the ring field of the segment descriptor? What happens during a system call when a process executing in a higher-numbered ring invokes a procedure in ring 0?

The access-control matrix can be used to determine whether a process can switch from, say, domain A to domain B and enjoy the access privileges of domain B. Is this approach equivalent to including the access privileges of domain B in those of domain A?

Consider a computer system in which computer games can be played by students only between 10 P.M. and 6 A.M., by faculty members between 5 P.M. and 8 A.M., and by the computer center staff at all times. Suggest a scheme for implementing this policy efficiently.

What hardware features does a computer system need for efficient capability manipulation? Can these features be used for memory protection?

Discuss the strengths and weaknesses of implementing an access matrix using access lists that are associated with objects.

Discuss the strengths and weaknesses of implementing an access matrix using capabilities that are associated with domains.

Explain why a capability-based system such as Hydra provides greater flexibility than the ring-protection scheme in enforcing protection policies.

Discuss the need for rights amplification in Hydra. How does this practice compare with the cross-ring calls in a ring-protection scheme?

What is the need-to-know principle? Why is it important for a protection system to adhere to this principle?

Discuss which of the following systems allow module designers to enforce the need-to-know principle. a. The MULTICS ring-protection scheme b. Hydras capabilities c. JVMs stack-inspection scheme

Describe how the Java protection model would be compromised if a Java program were allowed to directly alter the annotations of its stack frame.

How are the access-matrix facility and the role-based access-control facility similar? How do they differ?

How does the principle of least privilege aid in the creation of protection systems?

How can systems that implement the principle of least privilege still have protection failures that lead to security violations?