Access control matrix in Operating Systems - Step-by-Step Execution

Concept Flow - Access control matrix

Start

↓

Define Subjects

↓

Define Objects

↓

Create Matrix

↓

Assign Rights

↓

Check Access Request

↓

Allow or Deny Access

↓

End

The access control matrix starts by defining who (subjects) and what (objects) are involved, then creates a matrix assigning rights, and finally checks access requests to allow or deny actions.

Execution Sample

Operating Systems

Subjects = ['Alice', 'Bob']
Objects = ['File1', 'File2']
Matrix = {
  'Alice': {'File1': ['read', 'write'], 'File2': ['read']},
  'Bob': {'File1': ['read']}
}

This sets up an access control matrix showing which subjects have which rights on which objects.

Analysis Table

Step	Action	Subject	Object	Rights Checked	Access Decision
1	Check if Alice can write File1	Alice	File1	write	Allow
2	Check if Bob can write File1	Bob	File1	write	Deny
3	Check if Alice can read File2	Alice	File2	read	Allow
4	Check if Bob can read File2	Bob	File2	read	Deny
5	Check if Alice can execute File1	Alice	File1	execute	Deny
6	Check if Bob can read File1	Bob	File1	read	Allow
7	End of access checks	-	-	-	-

💡 All access requests checked; decisions made based on rights in the matrix.

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6	Final
Subjects	['Alice', 'Bob']	['Alice', 'Bob']	['Alice', 'Bob']	['Alice', 'Bob']	['Alice', 'Bob']	['Alice', 'Bob']	['Alice', 'Bob']	['Alice', 'Bob']
Objects	['File1', 'File2']	['File1', 'File2']	['File1', 'File2']	['File1', 'File2']	['File1', 'File2']	['File1', 'File2']	['File1', 'File2']	['File1', 'File2']
Matrix	{'Alice': {'File1': ['read', 'write'], 'File2': ['read']}, 'Bob': {'File1': ['read']}}	{...}	{...}	{...}	{...}	{...}	{...}	{...}
Access Decision	-	Allow	Deny	Allow	Deny	Deny	Allow	Completed

Key Insights - 3 Insights

Why does Bob get denied write access to File1 even though he can read it?

Because the matrix only grants Bob the 'read' right on File1, not 'write'. The execution_table rows 2 and 6 show this difference clearly.

What happens if a subject requests a right not listed in the matrix for an object?

The access is denied, as shown in step 5 where Alice requests 'execute' on File1 but only has 'read' and 'write' rights.

Are the subjects and objects changed during access checks?

No, subjects and objects remain constant throughout the process, as shown in the variable_tracker where their values do not change.

Visual Quiz - 3 Questions

Look at the execution_table at step 4. What is the access decision for Bob reading File2?

A Allow

B Not checked

C Deny

D Error

💡 Hint

Check the 'Access Decision' column in execution_table row 4.

At which step does Alice get denied access for a requested right?

A Step 3

B Step 5

C Step 1

D Step 6

💡 Hint

Look for 'Deny' in the 'Access Decision' column for Alice in execution_table.

If Bob was given 'write' rights on File1 in the matrix, what would change in the execution_table?

A Step 2 would change to Allow

B Step 4 would change to Allow

C Step 6 would change to Deny

D No changes

💡 Hint

Compare step 2 where Bob is denied write access to File1.

Concept Snapshot

Access Control Matrix:
- Rows = Subjects (users/processes)
- Columns = Objects (files/resources)
- Cells = Rights (read, write, execute)
- Check access by looking up subject-object-right
- Allow if right exists, else deny

Full Transcript

An access control matrix is a way to manage who can do what with resources. We list subjects (like Alice and Bob) and objects (like File1 and File2). Then we create a matrix that shows which rights each subject has on each object. When a subject requests access, we check the matrix. If the right is there, access is allowed; if not, it is denied. This process is shown step-by-step in the execution table, with variable states tracked to show no changes to subjects or objects during checks.

Practice

1. What does an access control matrix primarily represent in operating systems?

easy

A. Which users have what permissions on which resources

B. The order in which processes are executed

C. The memory allocation for each program

D. The list of installed software on a system

Solution

1. Step 1: Understand the purpose of access control matrix

   An access control matrix is a table that shows permissions users have on resources.

2. Step 2: Match the description to the options

   Only Which users have what permissions on which resources correctly describes permissions of users on resources.

3. Final Answer:

   Which users have what permissions on which resources -> Option A

4. Quick Check:

   Access control matrix = user permissions on resources [OK]

Hint: Think: Who can do what on which resource? [OK]

Common Mistakes:

• Confusing access control matrix with process scheduling
• Thinking it shows memory or software lists
• Mixing permissions with system hardware details

2. Which of the following correctly represents a row in an access control matrix?

easy

A. Process1 -> Memory address 0x1000

B. User1: read, write

C. File size = 1024 bytes

D. CPU usage = 50%

Solution

1. Step 1: Identify what a row in access control matrix shows

   A row lists a user and their permissions on various resources.

2. Step 2: Check which option matches this format

   User1: read, write shows a user with permissions, matching the row concept.

3. Final Answer:

   User1: read, write -> Option B

4. Quick Check:

   Row = user permissions list [OK]

Hint: Rows list users and their permissions [OK]

Common Mistakes:

• Confusing resource details with user permissions
• Mixing process or CPU info with access control
• Choosing options unrelated to permissions

3. Given the access control matrix below:

Users\Files | File1 | File2
---------|--------|-------
Alice | read | write
Bob | write | execute

What permission does Bob have on File2?

medium

A. execute

B. write

C. read

D. no permission

Solution

1. Step 1: Locate Bob's row in the matrix

   Bob's permissions are listed in the second row.

2. Step 2: Find the permission under File2 column for Bob

   Bob has 'execute' permission on File2.

3. Final Answer:

   execute -> Option A

4. Quick Check:

   Bob on File2 = execute [OK]

Hint: Find user row, then resource column [OK]

Common Mistakes:

• Mixing up rows and columns
• Choosing Alice's permissions instead of Bob's
• Assuming default permissions if not listed

4. Identify the error in this access control matrix snippet:

Users\Resources | FileA | FileB
--------------|--------|-------
Carol | read | readwriteexecute

What is wrong with this matrix?

medium

A. The matrix must list users vertically, not horizontally

B. Carol cannot have read permission

C. Multiple permissions should be separated, not combined in one cell

D. FileB should not have any permissions listed

Solution

1. Step 1: Check how permissions are listed in each cell

   Permissions should be clearly separated, usually by commas or listed distinctly.

2. Step 2: Identify if combining multiple permissions in one cell is acceptable

   Combining multiple permissions in one cell without clear separation can cause confusion.

3. Final Answer:

   Multiple permissions should be separated, not combined in one cell -> Option C

4. Quick Check:

   Permissions must be clearly separated [OK]

Hint: Permissions must be clearly separated in matrix cells [OK]

Common Mistakes:

• Thinking users must be listed horizontally
• Assuming permissions can't be combined at all
• Ignoring formatting clarity in matrix

5. You have an access control matrix with users and resources. If you want to quickly check which users can write to a resource named Report.doc, what is the best approach?

hard

A. Look across the row for Report.doc and note users with write permission

B. Check the entire matrix for any write permission

C. Check the diagonal cells only for write permission

D. Look down the column for Report.doc and note users with write permission

Solution

1. Step 1: Understand matrix layout

   Rows represent users, columns represent resources.

2. Step 2: To find users who can write to Report.doc, check the column for that resource

   Looking down the column shows which users have write permission.

3. Final Answer:

   Look down the column for Report.doc and note users with write permission -> Option D

4. Quick Check:

   Users with write on resource = column check [OK]

Hint: Check down the resource column for permissions [OK]

Common Mistakes:

• Looking across a resource row instead of column
• Checking only diagonal cells
• Scanning entire matrix unnecessarily