A Few Words About Security

The Central Role of OS Security

Nearly all software depends on the operating system to run. If the OS is insecure, even perfect applications above it cannot guarantee safety. The OS controls hardware resources, so any vulnerability may allow attackers to take over the entire system. Given the widespread use of operating systems, their security flaws have far-reaching effects.

Difficulties in Achieving Security

Operating systems have large amounts of code and complex algorithms, making flaws easy to hide. They must isolate multiple concurrent processes to prevent one from harming others or the system. Unknown programs downloaded by users should not receive the same privileges as the owner, or they could cause severe damage.

Resources That Need Protection

The OS can access all memory, files, devices, and networks. A process cannot protect itself from a malicious OS. Therefore, it is essential to ensure the OS itself has no exploitable vulnerabilities and to patch them promptly. Hardware such as security enclaves provides extra isolation, though it is difficult to implement perfectly.

Pitfalls

• Believing application security is sufficient while ignoring the underlying OS
• Delaying installation of operating system security updates

Minimum C11 · complete program · Download .c

#include <stdio.h>

int main(void) {
    printf("OS security simulation: processes isolated by kernel.\n");
    printf("Access granted only to permitted resources.\n");
    printf("Malicious process cannot steal data or crash others.\n");
    return 0;
}

Compile locally

gcc -std=c11 -Wall -Wextra -Wpedantic -Werror ostep-53-security-intro.c -o example && ./example

Expected result

OS security simulation: processes isolated by kernel.
Access granted only to permitted resources.
Malicious process cannot steal data or crash others.

CHECK YOUR UNDERSTANDING

Close the answer. Explain it.

Why must the operating system provide isolation mechanisms to protect process resources?

Check the sources

• OSTEP chapter PDF

Drafts and official chapters change. The version mark is only the example’s minimum.