Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the book named "operating system security", I read this paragraph:

"Protection domains can also be constructed from an intersection of the associated subjects (e.g., Windows 2000 Restricted Contexts [303]). The reason to use an intersection of subjects permissions is to restrict the protection domain to permissions shared by all, rather than giving the protection domain subjects extra permissions that they would not normally possess."

I don't understand the meaning of "intersection of subjects permissions" and how to use this property.Any idea?

share|improve this question

The author is being vague, but may be trying to express the idea of a protection domain that is accessible by two or more persons, without creating a new permission that the persons share.

Assume it exists and has permissions (joe, rw-) (sam r--) and (bob rw-) If we can also set the permission (~[joe|sam|bob] ---) then we have an unnamed security-domain-like-thing that only they can access.

I would
1. see if that description is consistent with the other descriptions in the chapter/section, and consider
2. writing the author and asking them (:-))

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.