---
title: "Trap door; firewalls and ACL"
subject: "Operating System"
chapter: 8
key: "semester_6/operating_system:trapdoor-firewall-acl"
source: https://www.bctengineer.com/q/semester_6/operating_system/trapdoor-firewall-acl
site: BCT Engineering
---

# Trap door; firewalls and ACL

Operating System · Chapter 8: Security

- Asked in: 2068 Bhadra, 2+6 marks
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_6/operating_system/trapdoor-firewall-acl
- Whole chapter: https://www.bctengineer.com/md/semester_6/operating_system/chapter-8

## Question

What is a trap door? Explain in firewalls and access control lists.

## Short answer

A trap door is a secret entry point bypassing authentication, often left for debugging. A firewall filters traffic between trusted and untrusted networks using rules (packet-filter, stateful, or proxy). An ACL lists which users/groups may perform which operations on an object; routers also use ACLs for packet filtering. Firewalls guard the perimeter, ACLs guard resources, trap doors are vulnerabilities.

## Answer

#### Trap door
A **trap door (back door)** is a secret entry point deliberately built into a program, bypassing normal authentication, e.g. a hidden username or password, or a special key sequence which gives access. Programmers add it for debugging or maintenance, but if forgotten or misused it is a serious security hole. Example: a login program that accepts the name "zzzz" with any password. It is difficult to detect, so the defence is code review and careful control of development.

#### Firewall
A **firewall** is a system (hardware, software or both) placed between a trusted internal network and an untrusted external network (Internet). It checks all traffic and permits or blocks it according to rules. It protects against external attacks, but not those that bypass it (insider attacks, laptops brought inside).

```text
 Internet ---> [ Firewall ] ---> Internal LAN
                  rules
```

Types:
- **Packet-filter firewall:** examines headers (source/destination IP, port, protocol) and allows or drops packets.
- **Stateful inspection firewall:** keeps track of connections.
- **Application-level gateway (proxy):** examines the content for specific applications (e.g. HTTP, FTP).

Typical rule: allow TCP port 80 to the web server, deny everything else.

#### Access control list (ACL)
An ACL is a list attached to an object (file, directory, router interface) specifying which users or groups can perform which operations.

| Object | User/Group | Rights |
|---|---|---|
| report.doc | Ram | Read, Write |
| report.doc | staff | Read |
| report.doc | others | None |

In routers, an ACL is also used for packet filtering: an ordered list of permit/deny rules checked from top to bottom. When a request arrives, the OS or router checks the ACL, and permits it only if a matching entry gives that right. ACLs are easy for finding who may access an object, and for revoking access, but a long list slows down checking.

Together, firewalls protect the network boundary, ACLs protect the individual resources inside, and trap doors are what must be guarded against in the software.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. What is a trap door?
   A. A firewall rule that blocks traffic
   B. A secret entry point built into a program that bypasses authentication
   C. A flood of requests
   D. A fake login screen run by a stranger
   Answer: B. Added for debugging, it becomes a hole if misused; code review is the defence. (Key point: Trap door)

2. Where is a firewall placed, and what can it not stop?
   A. Inside each file; viruses on the network
   B. On the CPU; memory errors
   C. Between trusted and untrusted networks; it cannot stop attacks that bypass it, like insiders
   D. Between processes; deadlock
   Answer: C. It filters traffic on the boundary only. (Key point: Firewall)

3. What does a packet-filter firewall examine?
   A. The full application content
   B. Only passwords
   C. Only encrypted bodies
   D. Headers: source/destination IP, port and protocol
   Answer: D. Application gateways examine content; packet filters examine headers. (Key point: Packet filter)

4. How is a router ACL evaluated?
   A. Ordered permit/deny rules checked top to bottom
   B. All rules at once, last wins
   C. Randomly
   D. Only the deny rules
   Answer: A. The first matching entry decides. (Key point: Router ACL)

## Related in Operating System

- [Protection domain and ACL](https://www.bctengineer.com/question.md?key=semester_6%2Foperating_system%3Aprotection-domain-acl) — Operating System, chapter 8, asked 2×

## Related in other subjects

- [Terzaghi's trap door experiment](https://www.bctengineer.com/question.md?key=semester_5%2Ffoundation_engineering%3Aterzaghi-trap-door) — Foundation Engineering, chapter 4, asked 4×
- [Media Access Control and significance](https://www.bctengineer.com/question.md?key=semester_7%2Fcomputer_networks_and_security%3Amac-significance) — Computer Networks and Security, chapter 3