Protection matrix

From Erights

Definition

One way how to capture the permissions of subjects to perform various operations with objects is to use a large matrix where:

• rows correspond to particular subjects
• columns correspond to particular objects

and the context of each cell determines what operations on a particular object are permitted for a particular subject.

Example

If:

• we have only three different subjects (1, 2 and 3)
• eight different objects (six files and a printer and a plotter)
• we recognize three different operations with objects (read, write and execute)

then one possible protection matrix may be:

It is not very usual to actually store the permissions in the form of a 2-dimensional array as shown in the figure above but there are such systems. Usually, the set of subjects and the set of objects are small and immutable. See protection in Minix 3.1.1.