---
title: "Short note: Protection domain"
subject: "Operating System"
chapter: 8
key: "semester_6/operating_system:protection-domain-note"
source: https://www.bctengineer.com/q/semester_6/operating_system/protection-domain-note
site: BCT Engineering
---

# Short note: Protection domain

Operating System · Chapter 8: Security

- Asked in: 2073 Magh, 3.5 marks; 2075 Baisakh, 3 marks (asked 2 times)
- Video: [🔒 Protection Domains Explained: OS Security for Beginners](https://www.youtube.com/watch?v=kD0qTab9kwo) — CodeLucky
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_6/operating_system/protection-domain-note
- Whole chapter: https://www.bctengineer.com/md/semester_6/operating_system/chapter-8

## Question

Write a short note on protection domain.

## Short answer

A protection domain is a set of (object, rights) pairs defining what a process can access. Processes run in one domain at a time and may switch domains (e.g., system calls enter kernel domain). UNIX uses UID/GID; setuid programs temporarily adopt the file owner's domain. Domains enforce least privilege and are stored as ACLs or capability lists.

## Answer

A **protection domain** is the set of objects a process can access, together with the operations (rights) permitted on each. It is written as a set of pairs *(object, rights)*; for example, (file1, {read, write}), (printer, {print}).

#### Key points
- A process runs in one domain at a time and can access only objects defined in that domain.
- The domain can be a user, a group, a role or even a procedure.
- The same object can appear in different domains with different rights.
- A process may switch domains (domain switch), e.g. a system call enters kernel domain.

#### Example in UNIX
The domain is defined by (UID, GID). Every process with the same UID/GID can access the same files. When a user runs a program with the **setuid** bit, the process takes the domain of the file's owner temporarily (e.g. `passwd` runs as root to update the password file).

#### Domain-object matrix
| Domain | File1 | File2 | Printer |
|---|---|---|---|
| D1 | R | RW | – |
| D2 | – | R | Print |

Stored by column, it becomes an ACL; stored by row, a capability list.

Protection domains enforce the **principle of least privilege**: a domain should hold only the rights needed for its task.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. What does a protection domain contain?
   A. Only users' passwords
   B. Objects with permitted operations, as (object, rights) pairs
   C. Only list of processes
   D. Only the network address
   Answer: B. Example: (file1, {read, write}), (printer, {print}). (Key point: Domain)

2. How is a domain defined in UNIX?
   A. By file name and size
   B. By process ID only
   C. By (UID, GID)
   D. By terminal number
   Answer: C. Processes with the same UID/GID access the same files. (Key point: UNIX domain)

3. What does least privilege imply?
   A. Every domain holds every right
   B. Only root has domains
   C. Rights never change
   D. A domain holds only the rights needed for its task
   Answer: D. It limits damage from errors and attacks. (Key point: Least privilege)

4. The domain-object matrix stored by column gives what?
   A. An ACL
   B. A capability list
   C. A hash table
   D. A firewall rule
   Answer: A. By row it gives a capability list. (Key point: Matrix storage)

## Related in Operating System

- [Protection domain and ACL](https://www.bctengineer.com/question.md?key=semester_6%2Foperating_system%3Aprotection-domain-acl) — Operating System, chapter 8, asked 2×