Protection matrix
From Erights
(Difference between revisions)
(→Example) |
m |
||
| Line 10: | Line 10: | ||
If: | If: | ||
* we have only three different subjects (1, 2 and 3) | * we have only three different subjects (1, 2 and 3) | ||
| - | * eight different objects (six files and a printer and a | + | * eight different objects (six files and a printer and a mixer) |
* we recognize three different operations with objects (read, write and execute) | * we recognize three different operations with objects (read, write and execute) | ||
then one possible protection matrix may be: | then one possible protection matrix may be: | ||
Revision as of 15:18, 16 June 2009
Definition
One way how to capture the permissions of subjects to perform various operations with objects is to use a large matrix where:
- rows correspond to particular subjects
- columns correspond to particular objects
and the context of each cell determines what operations on a particular object are permitted for a particular subject.
Example
If:
- we have only three different subjects (1, 2 and 3)
- eight different objects (six files and a printer and a mixer)
- we recognize three different operations with objects (read, write and execute)
then one possible protection matrix may be:
It is not very usual to actually store permissions in the form of a 2-dimensional array as shown in the figure above but there are such systems which do so. Usually, the set of subjects and the set of objects are small and immutable. See protection in Minix 3.1.1.
