1.2 What Is an Operating System?

For most people, a computer is a tool for solving problems. When running a word processor, a computer becomes a machine for arranging words and ideas. With a spreadsheet, the computer is a financial-planning machine, one that is vastly more powerful than a pocket calculator. Connected to an electronic network, a computer becomes part of a powerful communications system.

At the heart of every computer is a master set of programs called the operating system. This is the software that communicates with the system hardware to control the computer's input/output systems, such as keyboards and disk drives, and that loads and runs other programs. The operating system is also a set of mechanisms and policies that help define controlled sharing of system resources.

Along with the operating system is (usually) a large set of standard utility programs for performing common functions such as copying files and listing the contents of directories. Although these programs are not technically part of the operating system according to some formal definitions, the popular notion of an operating system includes them. Whether they are part of the definition or not, they can have a dramatic impact on a computer system's security.

All of Unix can be divided into four parts:

The kernel

The kernel, or heart of the Unix system, is the operating system. The kernel is a special program that is loaded into the computer when it is first started. It controls all of the computer's input and output systems, allows multiple programs to run at the same time, and allocates the system's time and memory among them. The kernel includes the filesystem, which controls how files and directories are stored on the computer's storage devices (e.g., disks). The filesystem is one main mechanism by which security is enforced. Some modern versions of the Unix system allow user programs to load additional modules, such as device drivers, into the kernel after the system starts running.

Standard utility programs

These programs are run by users and by the system. Some programs are small and serve a single function—for example, /bin/rm deletes files and /bin/cp copies them. Other programs are large and perform many functions—for example, /bin/sh and /bin/csh are Unix shells that process user commands, and are themselves programming languages.

System database files

Most of the database files are relatively small and are used by a variety of programs on the system. One file, /etc/passwd, contains the master list of every user on the system. Another file, /etc/group, describes groups of users with similar access rights.

System startup and configuration files

Most of the startup and configuration files are relatively small and are used by a variety of programs on the system. These include files describing which server to start, and the network name and address of the machine. For example, most systems store information about how to look up Internet hostnames in /etc/resolv.conf.

From the point of view of Unix security, these four parts interact with a fifth entity:

Security policy

This policy determines how the computer is run with respect to the users and system administration. Policy plays as important a role in determining your computer's security as the operating system software. A computer that is operated without regard to security cannot be trusted, even if it is equipped with the most sophisticated and security-conscious software. For this reason, establishing and codifying policy plays a very important role in the overall process of operating a secure system. This is discussed further in Chapter 3.

One of the things that makes Unix security so challenging is that all of these items are moving targets. Today's Unix systems contain many more utility programs, database files, and configuration files than they did a few years ago. Today's Unix kernel has dramatically more functionality than the simple kernel on which the underlying Unix design was based. Even the security policies in organizations that use Unix systems have changed substantially in recent years. As a result, operating a Unix system in a secure manner today is a very different task from ever before.