PAM and Operating Systems Concepts Quiz

The primary vulnerability is that an attacker only needs to obtain the password hash, rendering the security of hashing ineffective.

Kerberos is preferred because it provides a more secure authentication mechanism compared to NTLM, which is older and has known vulnerabilities.

PAM centralized user authentication management, allowing various programs to utilize a common authentication library instead of handling it independently.

<p>The 'auth' activity in PAM is responsible for verifying user credentials, typically through passwords or other authentication methods like tokens or fingerprints.</p> Signup and view all the answers

<p>The 'account' activity decides whether an authenticated user is allowed to log in based on account permissions and conditions.</p> Signup and view all the answers

<p>PAM control flags determine the outcome of authentication modules, dictating whether to stop immediately, continue but report failure, or ignore results depending on the situation.</p> Signup and view all the answers

<p>Protection rings are hierarchical levels of privilege in an operating system, where ring 0 has the highest privileges and interacts directly with hardware, while ring 3 has the least privileges and runs user applications.</p> Signup and view all the answers

<p>A user process executes a system call by transitioning from user space (ring 3) to kernel space (ring 0) through a defined interface provided by the operating system.</p> Signup and view all the answers

<p>The attempt results in a SIGILL (illegal instruction) signal, preventing execution due to insufficient privileges.</p> Signup and view all the answers

<p>If a PAM requisite module fails, the authentication process immediately returns failure and halts further checks.</p> Signup and view all the answers

<p>System calls serve as the interface for user processes to request services from the operating system, such as creating or terminating processes and managing memory.</p> Signup and view all the answers

<p>A sufficient flag indicates that if the module passes, authentication succeeds and further checks stop, while an optional flag means the result is ignored and does not affect authentication.</p> Signup and view all the answers

<p>User authentication involves verifying credentials, such as passwords, to determine if an entity is allowed access to a resource.</p> Signup and view all the answers

<p>A protection system and a reference monitor.</p> Signup and view all the answers

<p>By allowing only trusted administrators to modify the protection state via trusted software.</p> Signup and view all the answers

<p>Users can modify the protection state at their discretion.</p> Signup and view all the answers

<p>It represents an access control policy by showing what operations processes can perform on files.</p> Signup and view all the answers

<p>ACLs allow arbitrary permissions to be granted to specific users and groups.</p> Signup and view all the answers

<p>User ID (uid), group ID (gid), and a groups list.</p> Signup and view all the answers

<p>Real user ID, Effective user ID, and Saved user ID.</p> Signup and view all the answers

<p>Read (r), write (w), and execute (x).</p> Signup and view all the answers

<p>Execute permission on the directory.</p> Signup and view all the answers

<p>The system checks the permissions associated with the file.</p> Signup and view all the answers

<p>The setuid bit allows users to run a program with the permissions of the program's owner, typically enabling access to privileged resources.</p> Signup and view all the answers

<p>Horizontal privilege escalation refers to gaining privileges of another unprivileged user, while vertical escalation involves obtaining root or kernel privileges.</p> Signup and view all the answers

<p>The fork() function creates a new process where the child inherits the real, effective, and saved UIDs from the parent.</p> Signup and view all the answers

<p>Virtual memory allows processes to use virtual addresses which are mapped to physical addresses, enabling more efficient use of system memory.</p> Signup and view all the answers

<p>The MMU performs the mapping of virtual addresses to physical addresses, facilitating the use of virtual memory.</p> Signup and view all the answers

<p>A local root exploit is a vulnerability that allows an unprivileged user to gain root rights on a system.</p> Signup and view all the answers

<p>'su' allows users to switch to another user, typically root, while 'ping' requires elevated permissions to access raw network sockets.</p> Signup and view all the answers

<p>Memory access control is crucial for security, preventing one process from reading or writing to the memory of another process.</p> Signup and view all the answers

<p>Context switches necessitate flushing the TLB to ensure that the correct memory address mappings are used for the new process.</p> Signup and view all the answers

<p>PAM (Pluggable Authentication Module) provides a flexible framework for authenticating users before granting them elevated privileges through setuid programs.</p> Signup and view all the answers

<p>To protect user processes from each other and isolate the TCB from user processes.</p> Signup and view all the answers

<p>They allow for modifications of the OS kernel at runtime without requiring a reboot.</p> Signup and view all the answers

<p>File descriptors are integer indexes that map to a file descriptor table, allowing processes to reference files and devices.</p> Signup and view all the answers

<p>It may lead to unauthorized I/O operations if sensitive descriptors are not closed before execution.</p> Signup and view all the answers

<p>It refers to the representation of all resources, including devices and processes, as files in the file system.</p> Signup and view all the answers

<p>A microkernel has a smaller TCB, which reduces the potential attack surface for vulnerabilities.</p> Signup and view all the answers

<p>AC restricts access to resources based on permissions set for users and processes.</p> Signup and view all the answers

<p>The system call is <code>close()</code>.</p> Signup and view all the answers

<p>It checks a user’s access rights based on their real user ID.</p> Signup and view all the answers

<p>Udev automatically handles the loading of kernel modules.</p> Signup and view all the answers

<p>Files are logically organized in a hierarchical structure, resembling an inverted tree.</p> Signup and view all the answers

<p>Kernel modules do not have floating-point support.</p> Signup and view all the answers

<p>These syscalls allow user processes to interact with files and devices in a controlled manner.</p> Signup and view all the answers

<p>A reboot is typically required to apply the modifications.</p> Signup and view all the answers

<p>The init process is responsible for starting user authentication and managing system services.</p> Signup and view all the answers

<p>It prevents a subject from writing to an object that has a lower security level, ensuring that sensitive information isn't leaked to less secure processes.</p> Signup and view all the answers

<p>Strong tranquility means a process's security level never changes, while weak tranquility allows changes as long as they don't violate the security policy.</p> Signup and view all the answers

<p>The Biba model is designed to protect the integrity of information by preventing subjects from reading/ writing information at levels below or above their own.</p> Signup and view all the answers

<p>LSMs utilize hooks to allow the kernel to support various security models, enforcing access control decisions on security-critical resources.</p> Signup and view all the answers

<p>A chroot jail confines a process to a specified directory, making the outside file system invisible to that process.</p> Signup and view all the answers

<p>OS-level virtualization operates multiple isolated user-space instances sharing the kernel, whereas traditional virtualization mimics entire hardware environments.</p> Signup and view all the answers

<p>Namespaces restrict a container’s visibility of global resources, providing process-level isolation within the system.</p> Signup and view all the answers

<p>Cgroups limit and manage the resource usage of different groups of processes, ensuring fair allocation of system resources.</p> Signup and view all the answers

<p>The key components include Activities, Services, Broadcast Receivers, and Content Providers.</p> Signup and view all the answers

<p>Application isolation ensures that each app operates within its secure environment, preventing access to other apps' data.</p> Signup and view all the answers

<p>Paravirtualization requires modifications to the guest OS and drivers to replace nonvirtualizable instructions with hypercalls.</p> Signup and view all the answers

<p>Improper use of <code>setuid()</code> can allow unauthorized elevation of privileges, potentially enabling users to escape privilege restrictions.</p> Signup and view all the answers

<p>Hardware full virtualization reduces the complexity of the Virtual Machine Monitor (VMM) by introducing a protection ring specifically for the hypervisor.</p> Signup and view all the answers

A technique where an attacker steals a password hash and uses it to gain access to a system without needing the actual password.

A protocol used for single sign-on authentication in Windows networks, still commonly found in many organizations despite security concerns.

A framework that provides a centralized authentication mechanism for various applications and programs on a system, making user authentication more modular and flexible.

A PAM activity where the system verifies a user's identity using methods like passwords, tokens, or biometrics.

A PAM activity that determines whether a user is authorized to log in after their identity has been verified. This involves checking user permissions.

A mechanism in operating systems that allows a user to authenticate and access resources.

The process of determining if an authenticated entity is allowed to perform an action on a resource.

A system call is a request from user space to the OS to perform a certain operation. It allows user programs to access privileged resources like hardware.

A defined interface through which user programs interact with the operating system.

A control flag used in PAM to specify how module failures should be handled.

Specifies that if a PAM module fails, the authentication process immediately stops and returns failure.

Specifies that if a PAM module fails, the authentication process continues but returns failure in the end.

A fundamental concept in access control that defines what operations (like reading or writing) subjects (processes) can perform on objects (files). It's like a set of rules that govern how information is accessed.

A mechanism that enforces the access control specifications defined by the protection system. It acts as the gatekeeper, checking if a subject is allowed to access an object based on the defined rules.

A type of access control where only trusted administrators can modify the protection state. This ensures that only authorized changes are made to the access rules.

A type of access control where users can modify the protection state. This allows users to grant or deny access to their files based on their preferences.

A table-like representation of access control policy. It lists subjects (processes) and objects (files) and defines what permissions subjects have on each object.

A method used to grant access permissions to specific users or groups for a file or directory. This flexibility allows for more granular control over file access.

A unique identifier assigned to every user for login purposes. This ID helps the operating system recognize and authenticate users.

A unique identifier assigned to a group of users. This ID represents a collection of users with common permissions or interests.

A set of groups that a user has access to. This includes the primary group and any additional groups the user belongs to.

The permissions granted to the owner of a file. This includes the ability to read, write, or execute the file.

The Trusted Computing Base (TCB) in Linux encompasses all code running in the Kernel space and certain privileged processes that are trusted to execute critical system operations.

Loadable Kernel Modules (LKMs) allow the OS kernel to be modified at runtime, providing flexibility and extensibility.

LKMs are loaded at runtime and execute in Kernel space (ring 0), granting them privileged access to system resources.

A kernel module is not a typical application, as it doesn't execute sequentially or have automatic cleanup, and it cannot directly access user-space data or functions.

Modules are stored in the /usr/lib/modules/kernel_release_ directory, and loading them can be done automatically during boot or manually using the insmod command.

The Unix file system organizes persistent data on background storage into logical units called files.

Everything in Unix is represented as a file, including devices, processes, and network connections. This makes it possible to use the same tools and API for interacting with diverse resources.

File descriptors are integers used by the Kernel to keep track of open files and their associated resources.

When a new process is created, it inherits any open file descriptors from its parent. This can lead to security vulnerabilities if sensitive file descriptors are not closed before invoking a child process.

Standard Input (stdin), Standard Output (stdout), and Standard Error (stderr) are special file descriptors used for common input and output operations.

Access Control (AC) selectively restricts access to resources based on authorization rules.

AC mechanisms authorize requests from subjects (e.g., users, processes) to perform operations on objects (e.g., files, sockets) based on specific rules.

A trusted computing base (TCB) is a set of system components trusted to enforce security policies. It includes the operating system kernel, privileged processes, and hardware security mechanisms.

Loadable kernel modules (LKMs) are small programs that can be loaded into the kernel at runtime, extending its functionality without requiring a system reboot.

File descriptors are integers used by the operating system to represent open files. They act as pointers to files, allowing the system to efficiently manage access to them.

A special bit set in file permissions that allows a program to run with the privileges of the file owner, not the user running it.

The process of granting a program the ability to execute with the privileges of the file owner, effectively letting it act as that user.

The user ID associated with the person who started a program (e.g., you).

The user ID associated with the owner of the program the user is running. It is set by the SUID bit.

The process of gaining elevated privileges beyond what the user normally has, such as accessing files or modifying system configurations.

A type of privilege escalation that involves obtaining the permissions of another user who doesn't have administrative rights.

A type of privilege escalation that involves obtaining the highest level of privileges (usually root), giving the attacker full control over the system.

A technique used in operating systems to map addresses in a program's memory (virtual addresses) to physical memory addresses on the hardware.

A fixed-size block of memory used by the operating system to manage memory allocation and permissions.

A table used by the MMU to translate virtual memory addresses to physical memory addresses.

A security model that focuses on protecting the integrity of information. It prevents data from being modified by unauthorized entities, ensuring that data remains accurate and reliable.

A rule in the Biba model that prohibits a subject (user or process) from reading objects with a lower integrity level.

A rule in the Biba model that prohibits a subject from writing to an object with a higher integrity level.

A framework within the Linux kernel that allows for the implementation of different security models without compromising the kernel's integrity.

A technique used to isolate processes within a specific directory on the file system, restricting their access to files outside that directory.

A form of virtualization where multiple isolated user-space instances (containers) run on the same kernel. Containers share the host operating system's kernel but have their own file system.

A technique for running a whole computer system in software, simulating the hardware environment and its behavior. Allows running unmodified operating systems, even from different architectures.

The process of simplifying the management of an operating system by introducing a software abstraction layer, known as a virtual machine monitor (VMM), or hypervisor.

A type of virtualization where the kernel code is translated on the fly to run on a virtual machine. The guest operating system is unaware of its virtual environment.

A type of virtualization where the guest operating system and its drivers are specifically modified to interact with the virtualization layer.

The process of running multiple isolated Linux systems (containers) as a single entity on a control host. Achieved by namespaces and control groups.

A mechanism that restricts what a container can see, providing process-level isolation of global resources.

A mechanism that sets upper bounds on resources that can be used by a container, controlling resource allocation within groups.

The software environment where Android applications run, providing a runtime for Dalvik Virtual Machine and core libraries.

A secure mechanism that ensures Android applications run in isolation, protecting system resources and user data.