{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/operating-system","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/operating-system/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/operating-system/"},"term":{"en":"Operating system","da":"Styresystem"},"aka":{"en":["OS"],"da":["OS","operativsystem"]},"domain":["cs"],"cluster":"os","layer":"os","status":"current","era":1964,"summary":{"en":"The base software that runs a computer, shares it between programs and keeps them from interfering with each other.","da":"Den grundlæggende software, der styrer en computer, deler den mellem programmer og holder dem adskilt fra hinanden."},"body":{"formal":{"en":"The layer of software between the physical machine and the programs a user runs. It divides time, storage and devices among programs and gives them one common, controlled way to use the machine.","da":"Det lag af software, der ligger mellem selve maskinen og de programmer, en bruger kører. Det fordeler tid, lagerplads og udstyr mellem programmerne og giver dem én fælles, kontrolleret måde at bruge maskinen på."},"plain":{"en":"Like the management of an apartment building - tenants share the water, heat and stairs, and the management makes sure no one takes everything or walks into someone else's flat.","da":"Som administrationen i en boligforening - beboerne deler vand, varme og trappe, og administrationen sørger for, at ingen tager det hele eller går ind i andres lejlighed."},"inPractice":{"en":"A case officer in a municipality has email and a budget sheet open at once on a Windows laptop; the operating system decides which one gets the machine at each moment and stops either from reading the other's data.","da":"En sagsbehandler i en kommune har mail og et budgetark åbent samtidig på en Windows-bærbar; styresystemet bestemmer, hvilket program der får maskinen hvornår, og forhindrer dem i at læse hinandens data."},"whyItMatters":{"en":"Almost every security control on a computer - logins, permissions, logs - is enforced by the operating system, so a weakness in it undermines everything built on top.","da":"Næsten alle sikkerhedskontroller på en computer - login, rettigheder, logs - håndhæves af styresystemet, så en svaghed i det undergraver alt, der bygger ovenpå."}},"deepDive":{"en":"An operating system provides two things at once: abstraction and isolation. It turns a CPU into processes and threads, physical RAM into per-process virtual address spaces, disks into file systems, network interfaces into sockets and devices into uniform driver interfaces, and it multiplexes all of them among competing programs. Isolation depends on hardware support that the OS configures: privilege rings or exception levels separate kernel and user mode, and the memory-management unit translates every virtual address through page tables the kernel controls, so one process simply has no mapping for another's memory. A page fault, a timer interrupt or a system call are the only ways control returns to the kernel.\n\nThe kernel is the privileged core, but the OS as delivered is much larger: the C library and system libraries that wrap system calls, the init and service manager (systemd, Windows Service Control Manager, launchd), the dynamic loader, shells, package management, authentication stacks (PAM, the Windows Local Security Authority) and the default configuration. POSIX (IEEE 1003.1) standardises the Unix-style interface, which Linux, the BSDs and macOS largely follow; Windows exposes the Win32 API on top of the native NT API. Scheduling policy illustrates how much is policy rather than mechanism: Linux replaced its Completely Fair Scheduler with EEVDF in kernel 6.6 (2023), while Windows uses a priority-based preemptive scheduler with dynamic boosts.\n\nFrom a security perspective the OS is the reference monitor for most controls: it authenticates users, labels every process with an identity (UID/GID or a Windows access token with SIDs and privileges), checks permissions on every object access, and produces audit events. Hardening therefore means configuring those mechanisms: CIS Benchmarks and Microsoft security baselines specify settings, while exploit mitigations such as ASLR, DEP/NX, stack canaries and control-flow integrity (CFG, CET shadow stacks) make memory-corruption bugs harder to exploit. Mandatory access control (SELinux, AppArmor) and sandboxing (seccomp, Windows AppContainer, the iOS and Android app sandboxes) restrict what even a compromised process can do.\n\nLifecycle is an under-appreciated risk. Each OS release has a support window after which it receives no security updates; Windows 10 reached end of support on 14 October 2025, with paid Extended Security Updates as a temporary bridge, and embedded or industrial systems often run long-unsupported versions because the equipment vendor has not certified a newer one. Asset inventories should therefore record the exact OS version and support status, and ISO/IEC 27001:2022 control 8.8 (management of technical vulnerabilities) treats unsupported software as a risk to be handled explicitly. Virtualisation and containers add layers: a hypervisor isolates whole OS instances, whereas containers share one host kernel and rely on namespaces and cgroups, so a kernel vulnerability can break container isolation but not, by itself, VM isolation.","da":"Et styresystem leverer to ting på én gang: abstraktion og isolation. Det gør en CPU til processer og tråde, fysisk RAM til virtuelle adresserum pr. proces, diske til filsystemer, netværkskort til sockets og enheder til ensartede drivergrænseflader, og det fordeler dem alle mellem konkurrerende programmer. Isolationen afhænger af hardwareunderstøttelse, som styresystemet konfigurerer: privilegieringe eller exception levels adskiller kerne- og brugertilstand, og hukommelsesstyringsenheden (MMU) oversætter hver virtuel adresse via sidetabeller, som kernen styrer, så én proces simpelthen ikke har nogen afbildning af en andens hukommelse. En sidefejl, et timerinterrupt eller et systemkald er de eneste veje, hvorved kontrollen vender tilbage til kernen.\n\nKernen er den privilegerede del, men styresystemet, som det leveres, er langt større: C-biblioteket og systembiblioteker, der pakker systemkaldene ind, init- og tjenestestyringen (systemd, Windows Service Control Manager, launchd), den dynamiske loader, shells, pakkehåndtering, autentificeringsstakke (PAM, Windows Local Security Authority) og standardkonfigurationen. POSIX (IEEE 1003.1) standardiserer den Unix-agtige grænseflade, som Linux, BSD'erne og macOS stort set følger; Windows udstiller Win32-API'et oven på det native NT-API. Scheduling viser, hvor meget der er politik frem for mekanisme: Linux erstattede Completely Fair Scheduler med EEVDF i kerne 6.6 (2023), mens Windows bruger en prioritetsbaseret præemptiv scheduler med dynamiske løft.\n\nSikkerhedsmæssigt er styresystemet referencemonitor for de fleste kontroller: det autentificerer brugere, mærker hver proces med en identitet (UID/GID eller et Windows-access token med SID'er og privilegier), tjekker rettigheder ved hver adgang til et objekt og danner audithændelser. Hærdning betyder derfor at konfigurere de mekanismer: CIS Benchmarks og Microsofts sikkerhedsbaselines angiver indstillinger, mens afværgemekanismer som ASLR, DEP/NX, stack canaries og kontrolflowintegritet (CFG, CET shadow stacks) gør hukommelsesfejl sværere at udnytte. Obligatorisk adgangskontrol (SELinux, AppArmor) og sandkasser (seccomp, Windows AppContainer, app-sandkasserne i iOS og Android) begrænser, hvad selv en kompromitteret proces kan gøre.\n\nLivscyklus er en undervurderet risiko. Hver styresystemversion har en supportperiode, hvorefter den ikke får flere sikkerhedsopdateringer; Windows 10 nåede end of support den 14. oktober 2025 med betalte Extended Security Updates som midlertidig bro, og indlejrede eller industrielle systemer kører ofte versioner, der længe har været uden support, fordi udstyrsleverandøren ikke har certificeret en nyere. Aktivfortegnelser bør derfor registrere præcis styresystemversion og supportstatus, og ISO/IEC 27001:2022 kontrol 8.8 (håndtering af tekniske sårbarheder) behandler software uden support som en risiko, der skal håndteres eksplicit. Virtualisering og containere tilføjer lag: en hypervisor isolerer hele styresystemer, mens containere deler én værtskerne og bygger på namespaces og cgroups, så en kernesårbarhed kan bryde containerisolationen, men ikke i sig selv isolationen mellem virtuelle maskiner."},"edges":[{"type":"used-with","to":"cs/patch","why":{"en":"Operating systems are kept safe over time by applying the patches their vendors publish.","da":"Styresystemer holdes sikre over tid ved at installere de patches, leverandøren udgiver."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"cs/permission","confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"Operating Systems: Three Easy Pieces","url":"https://pages.cs.wisc.edu/~remzi/OSTEP/","tier":"textbook","publisher":"Arpaci-Dusseau"},{"title":"Modern Operating Systems","tier":"textbook","publisher":"Tanenbaum & Bos (Pearson)"}],"draft":true}