Access control matrix in Operating Systems - Full Explanation

Introduction

Imagine you have a big office with many rooms and many employees. You need a clear way to decide who can enter which room and what they can do there. Access control matrix helps solve this problem by organizing permissions between users and resources.

Explanation

Structure of Access Control Matrix

The access control matrix is like a table where each row represents a user or subject, and each column represents a resource or object. The cells in the table show what actions a user can perform on a resource, such as read, write, or execute.

The matrix clearly maps users to their allowed actions on resources.

Subjects and Objects

Subjects are active entities like users or processes that request access. Objects are passive entities like files, devices, or databases that need protection. The matrix connects subjects to objects with specific permissions.

Subjects request access, and objects are the protected resources.

Permissions or Rights

Permissions define what actions a subject can perform on an object. Common permissions include read, write, and execute. The matrix stores these permissions in each cell to control access precisely.

Permissions specify allowed actions between subjects and objects.

Implementation Approaches

The access control matrix can be implemented in two main ways: access control lists (ACLs) and capability lists. ACLs list permissions per object, while capability lists list permissions per subject. Both represent the same information differently.

ACLs and capability lists are two ways to realize the matrix.

Real World Analogy

Think of a hotel with many rooms and guests. Each guest has a key card that opens certain rooms. The hotel manager keeps a chart showing which guest can enter which room and what they can do inside, like use the minibar or access the safe.

Structure of Access Control Matrix → The hotel manager's chart showing guests (users) and rooms (resources) with allowed actions.

Subjects and Objects → Guests as subjects who want access, and rooms as objects to be protected.

Permissions or Rights → Key card permissions like opening the door or using the minibar.

Implementation Approaches → Different ways the hotel tracks access: a list per room (ACL) or a list per guest (capability list).

Diagram

Diagram

┌─────────────┬─────────────┬─────────────┬─────────────┐
│             │ File A      │ File B      │ Printer     │
├─────────────┼─────────────┼─────────────┼─────────────┤
│ User 1      │ read, write │ read        │ execute     │
├─────────────┼─────────────┼─────────────┼─────────────┤
│ User 2      │ read        │             │ execute     │
├─────────────┼─────────────┼─────────────┼─────────────┤
│ User 3      │             │ write       │             │
└─────────────┴─────────────┴─────────────┴─────────────┘

This diagram shows a table where users are rows, resources are columns, and each cell lists the permissions users have on resources.

Key Facts

Access Control Matrix → A table mapping subjects to objects with their allowed permissions.

Subject → An active entity like a user or process requesting access.

Object → A resource like a file or device that needs protection.

Permission → An allowed action such as read, write, or execute.

Access Control List (ACL) → A list of permissions attached to an object showing who can access it.

Capability List → A list of permissions attached to a subject showing what it can access.

Common Confusions

Believing the access control matrix is always stored as a full table in memory.

Believing the access control matrix is always stored as a full table in memory. The matrix is a conceptual model; practical systems use ACLs or capability lists to store permissions efficiently.

Thinking subjects and objects are the same.

Thinking subjects and objects are the same. Subjects are active entities requesting access, while objects are passive resources being accessed.

Summary

Access control matrix organizes who can do what to which resource in a clear table format.

Subjects are users or processes, objects are resources, and permissions define allowed actions.

ACLs and capability lists are practical ways to implement the matrix in real systems.

Practice

1. What does an access control matrix primarily represent in operating systems?

easy

A. Which users have what permissions on which resources

B. The order in which processes are executed

C. The memory allocation for each program

D. The list of installed software on a system

Solution

1. Step 1: Understand the purpose of access control matrix

   An access control matrix is a table that shows permissions users have on resources.

2. Step 2: Match the description to the options

   Only Which users have what permissions on which resources correctly describes permissions of users on resources.

3. Final Answer:

   Which users have what permissions on which resources -> Option A

4. Quick Check:

   Access control matrix = user permissions on resources [OK]

Hint: Think: Who can do what on which resource? [OK]

Common Mistakes:

• Confusing access control matrix with process scheduling
• Thinking it shows memory or software lists
• Mixing permissions with system hardware details

2. Which of the following correctly represents a row in an access control matrix?

easy

A. Process1 -> Memory address 0x1000

B. User1: read, write

C. File size = 1024 bytes

D. CPU usage = 50%

Solution

1. Step 1: Identify what a row in access control matrix shows

   A row lists a user and their permissions on various resources.

2. Step 2: Check which option matches this format

   User1: read, write shows a user with permissions, matching the row concept.

3. Final Answer:

   User1: read, write -> Option B

4. Quick Check:

   Row = user permissions list [OK]

Hint: Rows list users and their permissions [OK]

Common Mistakes:

• Confusing resource details with user permissions
• Mixing process or CPU info with access control
• Choosing options unrelated to permissions

3. Given the access control matrix below:

Users\Files | File1 | File2
---------|--------|-------
Alice | read | write
Bob | write | execute

What permission does Bob have on File2?

medium

A. execute

B. write

C. read

D. no permission

Solution

1. Step 1: Locate Bob's row in the matrix

   Bob's permissions are listed in the second row.

2. Step 2: Find the permission under File2 column for Bob

   Bob has 'execute' permission on File2.

3. Final Answer:

   execute -> Option A

4. Quick Check:

   Bob on File2 = execute [OK]

Hint: Find user row, then resource column [OK]

Common Mistakes:

• Mixing up rows and columns
• Choosing Alice's permissions instead of Bob's
• Assuming default permissions if not listed

4. Identify the error in this access control matrix snippet:

Users\Resources | FileA | FileB
--------------|--------|-------
Carol | read | readwriteexecute

What is wrong with this matrix?

medium

A. The matrix must list users vertically, not horizontally

B. Carol cannot have read permission

C. Multiple permissions should be separated, not combined in one cell

D. FileB should not have any permissions listed

Solution

1. Step 1: Check how permissions are listed in each cell

   Permissions should be clearly separated, usually by commas or listed distinctly.

2. Step 2: Identify if combining multiple permissions in one cell is acceptable

   Combining multiple permissions in one cell without clear separation can cause confusion.

3. Final Answer:

   Multiple permissions should be separated, not combined in one cell -> Option C

4. Quick Check:

   Permissions must be clearly separated [OK]

Hint: Permissions must be clearly separated in matrix cells [OK]

Common Mistakes:

• Thinking users must be listed horizontally
• Assuming permissions can't be combined at all
• Ignoring formatting clarity in matrix

5. You have an access control matrix with users and resources. If you want to quickly check which users can write to a resource named Report.doc, what is the best approach?

hard

A. Look across the row for Report.doc and note users with write permission

B. Check the entire matrix for any write permission

C. Check the diagonal cells only for write permission

D. Look down the column for Report.doc and note users with write permission

Solution

1. Step 1: Understand matrix layout

   Rows represent users, columns represent resources.

2. Step 2: To find users who can write to Report.doc, check the column for that resource

   Looking down the column shows which users have write permission.

3. Final Answer:

   Look down the column for Report.doc and note users with write permission -> Option D

4. Quick Check:

   Users with write on resource = column check [OK]

Hint: Check down the resource column for permissions [OK]

Common Mistakes:

• Looking across a resource row instead of column
• Checking only diagonal cells
• Scanning entire matrix unnecessarily