Protection rings

Protection rings are a processor-enforced privilege hierarchy. In the classical four-ring model, ring 0 holds the operating system kernel and is the most privileged level, ring 1 holds operating system services, ring 2 holds device drivers, and ring 3 holds user applications and is the least privileged. Privilege increases toward the centre, so each ring is granted only the access its job requires, in the spirit of least privilege.

Two pairs of names describe the processor state that goes with the ring. Ring 0 code runs in kernel mode, also called supervisor state, where privileged instructions are permitted. Ring 3 code runs in user mode, also called problem state, where they are refused and anything more must be requested through a system call. Enforcement is in silicon: the processor raises a privilege fault when code attempts an operation outside its ring, which is why rings are described as enforced by hardware rather than by policy. That separates them from the policy decision made by the security kernel at the boundary of the trusted computing base. In practice Windows and Linux use ring 0 and ring 3 only, running drivers alongside the kernel.

Exam relevance: a scenario in which an application cannot execute a privileged instruction is describing ring enforcement, and the mechanism is hardware. A candidate is expected to be able to place all four rings in order even though production systems collapse them to two.