SAAS (see Software As A Service)

SACL (see System Access Control list)

Safe state, 457–458

Safe-mode, Windows, 914

Safety, hypervisor, 482

Salt, 641

Saltzer, Jerome, 609, 1045

SAM (see Security Access Manager)

Same page merging, 225

Sandbox, Windows, 1016

Sandboxing, 477, 692

SATA (see Serial ATA)

Scan code, 397

Schedulable system, 168

Scheduler, 152

Scheduling algorithm

• affinity, 552

• aperiodic, 168

• batch systems, 160–161

• categories, 156–157

• co-scheduling, 555

• completely fair share, 167–168

• first-come first served, 160

• gang, 554–555

• goals, 157–159

• guaranteed, 166

• Hyper-V, 1005–1006

• interactive system, 162–168

• introduction, 153–159

• Linux, 736–740

• lottery, 166–167

• multicomputer, 575–576

• multiple queue, 164–165

• multiprocessor, 550–557

• nonpreemptive, 156

• periodic, 169

• preemptive, 156

• priority, 163–164

• real-time, 168–169

• response time, 159

• round-robin, 162–163

• shortest job first, 160–161

• shortest process next, 165–166

• shortest remaining time next, 161

• smart, 552

• space sharing, 552–554

• thread, 169–171

• time sharing, 551–552

• two-level, 552

• when to do, 155–156

• Windows, 944–950

Scheduling for proportionality, 159

Scheduling for security, 556–557

Scheduling for throughput, 158

Scheduling for turnaround time, 158

Scheduling group, Windows, 950

Scheduling mechanism, 169

Scheduling policy, 169

Scheduling quantum, 162

Schroeder, Michael, 609, 1045

Scroll bar, 409

SDK (see Software Development Kit)

Sealing, 913

Seamless live migration, 504

Second level address translation, 1005

Second system effect, 1081

Second-chance page replacement algorithm, 210–211

Secret-key cryptography, 633–634

Section, Windows, 885

SectionHandle, Windows, 885

Secure boot, 36, 912

Secure file deletion and disk encryption, 322

Secure kernel, Windows, 897

Secure virtual machine, 483

Security, 605–697

• Android, 836–856

• file system, 322–323

• formal model, 628–637

• implementation in Linux, 792–793

• Linux 789–793

• multiserver operating system, 612

• multilevel, 630

• Windows, 1018–1035

• Windows virtualization, 1017–1018

Security access manager, 892

Security API calls, Windows, 1022–1023

Security attack

• back door, 680–681

• buffer-overflow, 648–658

• code-reuse, 653–655

• command-injection, 666–667

• covert-channel, 669–671

• denial-of-service, 608

• diverting attack, 656–657

• double fetch, 668

• exploiting hardware, 668–679

• exploiting software, 647–668

• flush & reload, 673

• format-string, 658–661

• insider, 679–681

• integer overflow, 665–666

• logic bomb, 679–680

• login spoofing, 681

• Meltdown, 676

• null pointer dereferencing, 664–665

• passive, 616

• return-oriented programming, 653–655

• return-to-libc, 653

• rowhammer, 682

• side channel, 671–674

• Spectre, 678–679

• speculation, 677–679

• Stuxnet, 639–640

• time bomb, 680

• time of check to time of use, 667–668

• transient execution, 674–679

• type-confusion, 662–664

• use-after-free, 661–662

Security by obscurity, 632

Security descriptor, 885

• Windows, 1021

Security domain, 608

Security fundamentals, 607–618

Security mechanism, 608

Security mitigation, Windows, 1025–1026

Security model, 628–632

• Bell-LaPadula, 630–631

• Biba, 631–632

Security of the operating system structure, 611–612

Security principles, 609–611

• complete mediation, 610

• east common mechanism, 610

• economy of mechanism, 609–610

• fail-safe default, 610

• least authority, 610

• open design, 611

• privilege separation, 610

• psychological acceptability, 611

Security reference monitor, Windows, 908

Security scheduling, 556–557

Security system calls, Linux, 791–792

Security triad, 608–609

Seek system call, 269

Segment, 240

Segmentation, 240–248

• implementation, 242–243

• Intel x86

• MULTICS, 243–247

Segmentation fault, 203

Select system call, 110, 905

Self-map, Windows, 941

SELinux, 843–845

Semantics, file sharing, 593–594

• session, 593

Semaphore, 129–133, 130–132

• Windows, 938

Sem trywait system call, 741

Send and receive, multicomputer, 565

Send system call, 1047

Senda system call, 1047

Sendfile system call, 775

Sendrec system call, 1047

Sensitive instruction, 482

Separate instruction and data space, 227–229

Separation of policy and mechanism, 169, 238–240

Sequential access, 266

Sequential consistency, 593

distributed shared memory, 575

Sequential process, 86

Serial ATA, 30, 370

Serial bus architecture, 33

Server, 68

• event-driven, 116–118

• X, 404

Server container, Windows, 1011, 1013

Server operating system, 37

Server physical address, Hyper-V, 1005

Server silo, Windows, 1012

Server stub, 569

Service, Android, 825–837

Service pack, 17

Session semantics, 593

Set attributes system call, 270

Set-acl system call, 625

SetEvent Win32 call, 938, 944

Setgid system call, 792

SetInformationJobObject Win32 call, 1012, 1013

SetPriorityClass Win32 call, 945

SetProcessinformation Win32 call, 949

SetSecurityDescriptorDacl Win32 call, 1023

SetThreadContext Win32 call, 904

Setthreadinformation Win32 call, 949

SetThreadPriority Win32 call, 945

Setuid system call, 792

Sfc program, 312

SGX (see Software Guard Extension)

SHA-256 hash function, 635

SHA-512 hash function, 635

Shadow page table, 494

Shadow stack, Windows, 1029

Shamir, Adi, 634

Shared bus architecture, 33

Shared file, 288–290

Shared hosting, 71

Shared library, 64, 230–232

Shared lock, 770

Shared pages, 228–229

Shared text segment, 746

Shared-memory multiprocessor, 530

Shell, 2, 46–47, 716–719

• simplified, 728

Shell magic character, 717

Shell pipe symbol, 718

Shell pipeline, 718

Shell prompt, 716

Shell script, 718

Shell wild card, 717

Shellcode, 650

Shim, Windows, 943

Shipley, Peter, 640

Short name, NT file system, 993

Shortcut, 278

Shortest job first scheduling, 160–161

Shortest process next scheduling, 165–166

Shortest remaining time next scheduling algorithm, 161

Shortest seek first disk scheduling, 376

SID (see Security ID)

Side channel, 556

Side-by-side library, Windows, 927

Side-channel attack, 671–674

Sigaction system call, 729

Signal, 725

• monitor, 141

Signature block, 635

Silo, Windows, 1011

SIMMON, 480

Simonyi, Charles, 412

Simple integrity property, 632

Simple security property, 630

Simplicity principle, 1046

Simulating LRU in software, 212–214

Simultaneous multithreading, 541

Single indirect block, 328, 781

Single interleaved disk, 374

Single large expensive disk, 386

Single root I/O virtualization, 500

Single-level directory system, 272–273

Single-root I/O virtualization, Hyper-V, 1008

Singularity, 617

SK (see Secure Kernel)

Skeleton, 595

Skew, disk, 372–373

Slab allocator, 752

SLAT (see Second Level Address Translation)

SLED (see Single Large Expensive Disk)

Sleep and wakeup, 127

SleepConditionVariableCS Win32 call, 939

SleepConditionVariableSRW Win32 call, 939

Slice, cache, 538

Slim reader-writer lock, 939

SMAP (see Supervisor Mode Access Protection)

Smart card, 646

Smart card operating system, 39

Smart NIC, 562

Smart scheduling, 552

Smartphone, 13, 14, 19, 37

Smartphone operating system, 37

SMEP (see Supervisor Mode Execution Protection)

SMP (see Symmetric MultiProcessor)

SmPageEvict Win32 call, 975

SmPageRead Win32 call, 974

SmPageWrite Win32 call, 973, 974

SMT (see Simultaneous Multithreading)

Snooping cache, 538

Snooping multiprocessor, 538

SoC (see System on a Chip)

Social engineering, Android, 856–861

Socket

• Linux, 759–763

• Windows, 937

Socket system call, 765

Soft fault, Windows, 958, 964

Soft miss, TLB, 203

Soft real time scheduling, 168

Soft timer, 394–395

Software as a service, 502

Software development kit, 795

• Windows, 882

Software fault isolation, 514

Software guard extension, 688

Software hardening, 681–694

Software TLB management, 202–203

Solid state drive, 7, 381–385

SPA (see s Server Physical Addresses)

Space sharing, 552–554

Space-time trade-offs, 1072–1075

Sparse file, NT file system, 995–996

Special file, 45, 264, 758

Spectre, 678–679, 928

Spin lock, 124, 546–549

Spinning versus switching, 548–549

Spooler directory, 119

Spooling, 12, 369

Spooling directory, 369

Square-wave mode, clock, 391

SR-IOV (see Single Root I/O Virtualization)

SR-IOV (see Single-Root I/O Virtualization)

SRW (see locks Slim Reader-Writer locks)

SS direct memory access, 344

SSD (see Solid State Drive)

SSF (see Shortest Seek First disk scheduling)

Stable storage, 382–385

Stack canary, 650–652

• avoiding, 651

Stack pointer, 21

Stack segment, 56

Stage 2 translation, Hyper-V, 1005

Standard error, 717

Standard input, 717

Standard output, 717

Standard UNIX, 708–709

Standby list, Windows, 959

Standby mode, Windows, 1001

Star property, 630

Starting a process, Android, 832

Startup repair, 914

Starvation, 442, 468–469

Stat system call, 54, 773, 776, 778

Stateful file system, 789

Stateless file system, 786

Static relocation, 183

Static vs. dynamic structures, 1062–1063

Storage allocation, NT file system, 994–998

Storage pool, Windows, 980

Storage spaces, Windows, 980

Store eviction thread, Windows, 975

Store manager, Windows, 973

Store-and-forward packet switching, 560

Stored value card, 644

Strict alternation, 123–124

Striping, RAID, 386

Structure, operating system, 1054–1057

• Windows, 894–929

Stuxnet attack, 639–640

Subject, ACL, 622

Subscribe, 597

Substitution cipger, 633

Subsystem, Windows, 880, 926–929

Superblock, 278, 775, 776

Superfetch, Windows, 966

Superscalar computer, 22

Superuser, 41, 790

Supervisor mode, 2

Supervisor mode access protection, 687

Supervisor mode execution protection, 687

Suspend blocker, 804

• Android, 804

Svchost.exe, 928

SVID (see System V Interface Definition)

SVM (see Secure Virtual Machine)

Swap area, 755

Swapper process, 754

Swappiness, 756

Swapping, 185–188

Symbian, 19

Symbolic link, 278

Symbolic linking, 289

Symmetric multiprocessor, 544, 1005

Symmetric-key cryptography, 633

Sync system call, 757, 984

Synchronization, 132

• Linux, 740–741

• Windows, 938–940

Synchronization and IPC, 119–152

Synchronization event, 938

Synchronization multiprocessor, 545–548

Synchronization object, 905

Synchronous call, 566

Synchronous input/output, 353

Synchronous vs. asynchronous communication, 1064–1065

Synthetic interrupt support, Hyper-V, 1006

System access control list, Windows, 1022

System bus, 20

System call, 23, 50–63

• access, 667, 671, 792

• alarm, 729, 1077

• append, 269

• atomic read, 740

• atomic set, 740

• brk, 745, 747

• chdir, 735, 774

• chmod, 791

• clone, 734, 735, 736, 1059

• close, 269, 761, 771, 785, 786

• closedir, 277

• connect, 760

• creat, 269, 277, 770, 771, 772, 774, 785

• delete, 269, 277

• directory management, 58–59

• down, 770, 1077

• exec, 90, 620, 727, 728, 732, 748, 808, 831, 935, 936, 1052, 1059

• exit, 728

• fcntl, 773

• file management, 57–58

• fork, 544, 724, 726, 727, 731, 733, 734, 735, 753, 808, 831, 832, 930, 935, 936, 1052, 1059, 1069

• fstat, 773

• fsync, 757

• get-acl, 625

• get attributes, 269

• getpid, 725

• ioctl, 761, 982, 983, 984

• kill, 729

• kmalloc, 753

• link, 277, 774

• listen, 760

• lock, 775

• lookup, 785

• lseek, 734, 735, 772, 1047

• mem, 749

• miscellaneous, 60

• mkdir, 773

• mmap, 747, 806, 890

• mount, 786, 787

• munmap, 747

• mutex trylock, 741

• nice, 737

• notify, 1047

• open, 269, 758, 771, 775, 777, 785, 786, 789

• opendir, 277

• pause, 729

• pipe, 773

• read, 269, 593, 619, 738, 746, 757, 758,

• 772, 775, 779, 781, 786, 788, 793, 1045,

• 1047, 1048, 1051

• readdir, 277, 774

• receive, 1047

• rename, 270, 277

• rewinddir, 774

• rmb, 740

• rmdir, 773

• seek, 269

• select, 110, 905

• sem trywait, 741

• send, 1047

• senda, 1047

• sendfile, 775

• sendrec, 1047

• set-acl, 625

• set attributes, 270

• setgid, 792

• setuid, 792

• sigaction, 729

• socket, 765

• stat, 773, 776, 778

• sync, 757, 984

• unlink, 277, 774

• unlock, 1054, 1065

• unmap, 747

• vmalloc, 753

• waitpid, 726, 727, 728

• Windows, 60–63

• wmb, 740

• write, 269, 593, 619, 746, 757, 758, 760, 772, 775, 782, 788, 793, 1048

System call (see also individual system calls)

System call (see also Win32 call)

System call (see also Windows API call)

System on a chip, 538

System partition, Windows, 976

System process, Windows, 934, 977

System restore, 914

System store, Windows, 975

System thread, Windows, 977

System V, 15, 707

System V examples, 1088

System V interface definition, 708

System-call interface, 1051–1053

System/360, 11

Syzkaller, 615