Chapter 3 — Operating systems and privilege
Lesson map
Lesson 03 published. Map, example, EX007.
flowchart TD
N0["Learning outcomes"]
N1["3.1 The operating system's job"]
N2["3.2 Users and administrators"]
N3["3.3 Least privilege"]
N4["3.4 Finding who has admin rights"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX007"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 The operating system's job"]
N2["3.2 Users and administrators"]
N3["3.3 Least privilege"]
N4["3.4 Finding who has admin rights"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX007"]
[Learning outcomes]
|
v
[3.1 The operating system's job]
|
v
[3.2 Users and administrators]
|
v
[3.3 Least privilege]
|
v
[3.4 Finding who has admin rights]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX007]
Learning outcomes
You will (1) explain what an operating system does; (2) distinguish user and administrator; (3) describe least privilege.
3.1 The operating system's job
The operating system manages hardware, runs programs, stores files and controls who can do what. It separates a privileged core, the kernel, from ordinary programs, so that one misbehaving program cannot easily take over the whole machine. The trust's laptops run Windows; the servers run a mix of Windows Server for the directory and Linux for the web, file, print and management system servers.
The kernel also decides which account owns each running program, which is why the privilege of the signed-in account matters so much. For Tomás this means the same review questions apply on both kinds of server, even though the commands differ: who can sign in, who can become an administrator and which services run with high privilege.
3.2 Users and administrators
Every action on a computer runs as some account. Standard users can run programs and change their own files. Administrators on Windows, or root on Linux, can change anything: install software, alter security settings and read other users' files. Because of this, malware that runs as an administrator can do far more damage than malware running as a standard user.
At the trust, a teacher who opens a malicious attachment while signed in as a standard user exposes their own files, but cannot switch off endpoint protection or install a service that survives a restart. The same attachment opened by one of the four teachers with local administrator rights could do both, which is why their rights became a finding.
3.3 Least privilege
Saltzer and Schroeder described least privilege in 1975: every program and user should operate using the least set of privileges needed. In practice, this means teachers use standard accounts, Dev uses a separate administrator account only when needed, and services on servers run as dedicated accounts rather than root. On Linux, the sudo tool lets named users run specific commands with higher privilege, with each use logged.
Least privilege applies to Tomás as well: his placement account can read logs and configuration through sudo but cannot install packages or change settings. Dev's separate administrator account means that a phishing email read in his everyday account does not reach the servers directly.
3.4 Finding who has admin rights
Tomás checks the local administrators group on ten laptops and finds that four teachers have been added over the years, usually to install a classroom app. He records the names and reasons. Removing these rights later must come with an alternative, such as Dev installing approved apps centrally.
The reasons are ordinary: in most cases a teacher needed a classroom app installed before a lesson and Dev was at the other school. None of the four rights had been removed afterwards, because nobody kept a list of who had been given them or why. Tomás records the reasons without naming anyone in his college notes, using synthetic names there instead.
Worked example
On one Linux server, Tomás lists members of the sudo group and finds Dev and the outside company's engineer account, both expected, and an old account belonging to a previous technician, which is flagged.
Synthetic case. Accounts are synthetic.
Errors and limits
Removing admin rights without offering a way to get needed software leads staff to look for workarounds.
Exercises
- EX007 — Kernel separation. Why does the OS separate the kernel from ordinary programs? Rubric: 3 = protects system from a misbehaving program;; 2 = mentions protection;; 1 = vague;; 0 = none.
- EX008 — Admin risk. Explain why malware running as administrator is more harmful. Rubric: 3 = can change security settings, install, read all files;; 2 = one example;; 1 = vague;; 0 = none.
- EX009 — Replacing rights. Suggest how teachers can get classroom apps once admin rights are removed. Rubric: 3 = central installation or self-service catalogue with approval;; 2 = ask IT;; 1 = vague;; 0 = none.
Synthesis
The operating system enforces privilege boundaries; least privilege keeps those boundaries meaningful.
Continue studying — chapter 03 of 30
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →