- Asked 2/13
- 2073 Magh · 3.5 marks
- 2075 Baisakh · 3 marks
Short note: Protection domain
Short answer
A protection domain is a set of (object, rights) pairs defining what a process can access. Processes run in one domain at a time and may switch domains (e.g., system calls enter kernel domain). UNIX uses UID/GID; setuid programs temporarily adopt the file owner's domain. Domains enforce least privilege and are stored as ACLs or capability lists.
Write a short note on protection domain.
A protection domain is the set of objects a process can access, together with the operations (rights) permitted on each. It is written as a set of pairs (object, rights); for example, (file1, {read, write}), (printer, {print}).
Key points
- A process runs in one domain at a time and can access only objects defined in that domain.
- The domain can be a user, a group, a role or even a procedure.
- The same object can appear in different domains with different rights.
- A process may switch domains (domain switch), e.g. a system call enters kernel domain.
Example in UNIX
The domain is defined by (UID, GID). Every process with the same UID/GID can access the same files. When a user runs a program with the setuid bit, the process takes the domain of the file's owner temporarily (e.g. passwd runs as root to update the password file).
Domain-object matrix
| Domain | File1 | File2 | Printer |
|---|---|---|---|
| D1 | R | RW | – |
| D2 | – | R |
Stored by column, it becomes an ACL; stored by row, a capability list.
Protection domains enforce the principle of least privilege: a domain should hold only the rights needed for its task.
✓ Answer checked by Claude Opus 5.5 (high effort)
Related questions
- Protection domain and ACL · Operating System, chapter 8 · asked 2×