Operating Systems: Protection and Virtual Machines

Vocabulary practice flashcards covering operating system protection concepts (access matrices, capabilities, domains, least privilege) and virtualization architectures (hypervisor types, hardware assistance, Xen paravirtualization).

Protection

The operating system mechanisms that control how legitimate processes or users access system-defined resources such as files, memory segments, the CPU, and networking.

Security

The confidence that a system's integrity and data will be preserved, defending against outside, unauthorized attackers via threat prevention, authentication, and cryptography.

Need-to-Know Principle

A protection policy dictating that a process should only access the specific objects and resources it currently needs to complete its task, rather than everything it is authorized to touch.

Principle of Least Privilege

The operating system mechanism that implements the need-to-know policy by granting minimum necessary rights, limiting the blast radius of a compromised process.

Static Privilege vs. Dynamic Privilege

Static privilege keeps rights fixed for a process's entire lifetime; dynamic privilege allows a process to switch domains to gain temporary rights for a sub-task and drop them afterward.

Protection Domain

A named set of access rights that generalizes hierarchical privilege rings, allowing rights to be grouped without requiring a strict global ranking.

ARM Exception Levels (EL0–EL3)

A four-tier hardware privilege model consisting of EL0 (User mode apps), EL1 (Kernel mode OS), EL2 (Hypervisor managing kernels), and EL3 (Secure monitor / TrustZone verifying kernel integrity).

Android Request Chain to TrustZone

The execution path required to execute trusted operations: App → Framework + HAL (keystore/gatekeeper) → Vendor daemon (e.g., QSECOM) → Kernel driver (TZ driver via SVC) → TrustZone (via SMC).

setuid

A UNIX mechanism allowing an executable to run temporarily with the privileges of the file's owner (e.g., root) rather than the privileges of the executing caller.

Android Per-App UIDs

A model that isolates applications from one another by repurposing UNIX multi-user UID/GID isolation, giving each application its own UID and private directory.

Access Matrix

A protection model where rows represent domains, columns represent objects, and each entry $\text{access}(i, j)$ defines the allowed operations a domain can execute on an object.

Access Matrix Storage Schemes

The four methods used to implement an access matrix: a Global Table (flat list), Access Lists (per object), Capability Lists (per domain), and Lock-Key Schemes (matching bit strings).

Access Control List (ACL)

A column-based access matrix implementation where each object maintains a list of domains permitted to access it along with their authorized rights.

Capability List

A row-based access matrix implementation where each domain stores a protected list of objects it can access and the specific operations permitted on each.

Lock-Key Scheme

A protection scheme where objects maintain unique bit strings (locks) and domains hold bit strings (keys); access is granted only if a domain's key matches one of the object's locks.

POSIX.1e Capabilities

A mechanism that partitions monolithic root privileges into distinct, independently grantable units (e.g., CAP_NET_RAW, CAP_CHOWN, CAP_KILL) so processes can drop rights as they are no longer needed.

Darwin Entitlements

Declaratory permission key-value pairs specified in an XML property list, embedded inside a binary's cryptographic signature, and verified via string matching when attempting privileged operations.

System Integrity Protection (SIP)

A macOS protection feature that prevents even the root user from modifying core operating system files, directories, and processes.

Language-Based Protection

A model enforcing protection boundaries inside a single OS-level runtime process (such as the JVM) using type safety and call-stack inspection across diverse protection classes.

Host

The physical hardware platform that supplies underlying CPU, memory, storage, and networking resources for virtualization.

Guest

An operating system or isolated process executing inside a virtual machine environment created by a hypervisor.

Virtual Machine Manager (VMM)

A software, firmware, or hardware management layer that creates and coordinates virtual execution environments, allocating physical hardware to guest machines.

Trap-and-Emulate

A CPU virtualization technique where the guest OS executes at reduced privilege, causing sensitive instructions to trap into the hypervisor, which emulates their intended effects.

Binary Translation

A virtualization technique used on older architectures where the VMM dynamically rewrites sensitive instructions that do not trap cleanly into safe alternative instruction sequences.

Hardware Assistance

CPU hardware architectural extensions (such as Intel VT-x and AMD-V) that supply a dedicated hypervisor privilege mode so sensitive instructions trap automatically and efficiently.

Type 0 Hypervisor

A hardware- or firmware-based hypervisor implemented directly in physical hardware, offering high speed at higher cost and reduced flexibility (e.g., IBM LPARs, Oracle LDOMs).

Type 1 Hypervisor

A bare-metal hypervisor that installs directly on physical hardware and runs guest operating systems on top of itself without an underlying host OS (e.g., VMware ESX, Citrix XenServer, Hyper-V, KVM).

Type 2 Hypervisor

A hosted virtualization program running as an application on top of a standard host operating system, incurring performance overhead due to the host OS layer (e.g., VMware Workstation/Fusion, Oracle VirtualBox).

Paravirtualization

A virtualization approach where the guest OS source code is modified to cooperate directly with the hypervisor via simplified virtual device abstractions rather than pretending to provide real hardware.

Application Containment

An operating-system-level mechanism that isolates applications without running complete guest OS instances or virtualizing physical hardware (e.g., Solaris Zones, BSD Jails, IBM AIX WPARs).

Xen Ring Buffer

A circular shared-memory structure using separate producer and consumer pointers to pass asynchronous I/O requests and responses between a guest OS and Xen without requiring locks.

Live Migration

The technique of transferring an active, running virtual machine from one physical server to another with minimal interruption or downtime.

Nested Virtualization

An architectural configuration where a hypervisor runs inside a virtual machine that is itself hosted by another hypervisor.

VM Snapshot

A captured image of the complete operational state and disk contents of a virtual machine, enabling rapid point-in-time recovery and rollbacks.