1

I am trying to understand what is the purpose of the CPU protection rings (specifically user mode and kernel mode).

I don't think that the CPU protection rings are meant to protect against malicious programs, because a malicious program can be written to run in kernel mode instead of user mode (it can be written as a device driver for example) and then it will be able to cause whatever damage it wants.

I rather think that the CPU protection rings are meant to protect against unintentional programming mistakes, for example a programmer may unintentionally write code to access the memory of another process or the memory of the kernel, but since the program will run in user mode, the program will not be able to access the memory of another process or the memory of the kernel.

Am I correct?

Improve this question
4
  • 3
    Both. From en.wikipedia.org/wiki/Protection_ring: "protection rings are mechanisms to protect data and functionality from faults (by improving fault tolerance) and malicious behaviour (by providing computer security)."
    – Robert Harvey
    Mar 28, 2019 at 15:32
  • @Robert Harvey But I don't understand how protections rings can protect against "malicious behaviour", because as I said in my question, a malicious program can be written to run in kernel mode instead of user mode.
    – user7681202
    Mar 28, 2019 at 15:44
  • Edit your question to clarify that you're asking about this specifically.
    – Robert Harvey
    Mar 28, 2019 at 15:49
  • If you can convince the user to install your arbitrary code as a modification of the OS for a good pretext, then obviously you win.
    – curiousguy
    Mar 29, 2019 at 0:41

2 Answers 2

Reset to default
5

Are the cpu protection rings meant to protect against malicious programs, or against unintentional programming mistakes?

CPU protection rings are meant to enable operating system software the control and protection checks necessary to implement an overall security strategy with good performance.  This includes the notion of kernel mode vs. user mode.  (Multiple rings are useful so that one operating system can efficiently guest host/run (an)other operating system(s), instead of only user programs.)

I don't think that the CPU protection rings are meant to protect against malicious programs, because a malicious program can be written to run in kernel mode instead of user mode

You would still have to find an exploit that would trick the overall hardware/software system into running the program in kernel mode.  An operating system would be remiss in allowing an unknown program (from the internet or otherwise) to run in the most privileged ring, regardless of where that code might have wanted to run.

(it can be written as a device driver for example) and then it will be able to cause whatever damage it wants.

Yes, if you could trick the system into loading your device driver, you'd have a lot of control.  Bootkits do similar, they bypass security by placing files early in the boot process, so that those run before the operating system has a chance to come up and protect things (then further, they hide themselves from prying eyes).

This an aspect of why permissions are so important.  A user mode program with unlimited permission can write to the file system in areas that will cause the operating system to load device drivers or the boot mechanism to load a bootkit.

I rather think that the CPU protection rings are meant to protect against unintentional programming mistakes, for example a programmer may unintentionally write code to access the memory of another process or the memory of the kernel, but since the program will run in user mode, the program will not be able to access the memory of another process or the memory of the kernel.

Kernel mode, for example, can reprogram the hardware's virtual memory protection and mapping mechanism, and this allows an operating system to establish separate address spaces for user mode processes.  User mode, however, cannot make changes to the address space.  Yet, the hardware CPU cannot remember everything needed to maintain an address space, so when it runs into something it doesn't know about, it faults back into kernel mode asking the operating system software to take over — the OS then decides if this is an illegal access (e.g. at kernel memory, or some other process or shared library) or if this is a legal access that the CPU didn't fully know about this go around (this is how page faults work in virtual memory).

Ultimately, security is accomplished by a complex choreography between hardware and (operating system or privileged) software.  The hardware does simple (and a few complex) things that it can be programmed to do and that it can do rather quickly (perhaps in parallel with other computing), and anything that either doesn't fit inside the CPU or is overly complex is left for software.  Software then makes use of the hardware features constantly changing and reprogramming the hardware as needed to run different programs or even different parts of the same program, while preventing the program from coloring outside of the lines.

Improve this answer
3
  • "Yes, if you could trick the system into loading your device driver, you'd have a lot of control" Why would I need to trick the system, in Windows device drivers are installed just like regular programs (using an installer file), and I think in Linux this is also the case. Or Am I missing something?
    – user7681202
    Mar 28, 2019 at 18:10
  • @user7681202 Installing drivers requires admin level access. If you already have admin level access, you control the machine. If you can trick someone into installing malicious software, you already control the machine. xkcd.com/1200 The other thing worth mentioning is that 25 years ago, mutli-user computers that needed to protect user accounts from admin privleges were the norm, and few people owned their own "powerful unix computers". So protecting the OS from users was important since the user didn't own the machine.
    – Steve Sether
    Mar 28, 2019 at 18:49
  • 1
    This is a good answer because it talks about putting the control on the OS. I think you should mention that the OS needs to protect against not just malicious programs, but buggy ones as well. Before protected memory, and pre-emptive multitasking built into the OS, crashes and freezes were extremely common in operating systems. Many people aren't old enough to remember the bad-old-days of classic MacOS, or Windows 3.1 and the crashes.
    – Steve Sether
    Mar 28, 2019 at 18:56
2

The short answer is both.

a malicious program can be written to run in kernel mode instead of user model

This is true, but that doesn't mean the program will actually run in kernel mode. Depending on the route of deployment, the attacker may (and hopefully most often will) not get to choose how their code first runs on the victim machine. Anecdotally (I don't have statistics to back this up), the most common vulnerabilities will result in it running in user mode. It may still be able to do considerable damage, but the hope is that the protections in place slow down or limit the attack.

Improve this answer
1
  • Jerry's answer is good, but i want to add something to it. In order to have your program run in kernel mode, you need some conditions/exploits to get in. For example a driver will run in kernel mode, if you manage to install a custom driver on a pc, you will be able to run some code in kernel mode. You can't just execute a program and say it's kernel mode, it'll be user mode by default.
    – El Void
    Mar 28, 2019 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .