- LPU MCA Semester 1
- CAP366
- Unit 8
CAP366 · Unit 8: Protection and disk management
Access matrix
10 practice questions · in the ETE syllabus
Key points
- Rows are domains, columns are objects
- ACL = column per object; capability list = row per domain
- Copy, owner, control and switch rights
- Transfer moves a right; limited copy removes the star
The access matrix is a model of protection. Rows are domains (a set of access rights, such as a user or process context) and columns are objects (files, devices, memory); entry access(i, j) lists the operations domain i may perform on object j.
Implementations: Access control lists (ACL) store the matrix by columns, a list of (domain, rights) attached to each object. Capability lists store it by rows, a list of objects and rights held by each domain. A global table or a lock-key scheme are other options. Because most of the matrix is empty, it is stored as a sparse structure.
Special rights extend the model: *copy () lets a right be copied to another domain in the same column (a limited copy omits the star, a transfer moves the right away from the original domain); owner lets a domain add or remove rights in that object's column; control lets a domain modify rights in another domain's row; switch** lets a process change domain, and switching can be repeated, so D1 to D2 and D2 to D3 means D1 can reach D3 in two switches.
Worked example: if the F2 column has D1 write, D2 read and D3 read and write, then D1 and D3 can write F2.
Exam trap: ACLs follow columns (objects), capability lists follow rows (domains).
Try two questions
Switch rights allow D1 to switch to D2 and D2 to switch to D3, and only D3 holds the print right on the printer. Which domains can a process starting in D1 reach?
- D2 only
- D2 and D3
- D3 only
- D1, D2 and D3
Show the answer
B. Switching is repeatable, so a process can go D1 to D2 and then to D3.
Why not A: D3 is reachable by switching again from D2.
Why not C: D2 is also reachable directly.
Why not D: D1 is the starting domain, not a destination.
What does the copy right (denoted *) on an access right allow?
- Copying the whole object to another location on the disk
- Switching a process into another domain of the system
- Copying that right to another domain in the same column
- Changing the owner of the object to another domain
Show the answer
C. A right with * can be propagated to other domains for the same object.
Why not A: Copy right applies to the access right, not the object itself.
Why not B: Switching is a separate right.
Why not D: The owner right controls ownership.