Messages in this thread | | | Date | Tue, 19 Sep 2006 08:54:41 -0700 (PDT) | From | Casey Schaufler <> | Subject | Re: [PATCH 3/4] security: capabilities patch (version 0.4.4), part 3/4: introduce new capabilities |
| |
--- Joshua Brindle <method@gentoo.org> wrote:
> Casey Schaufler wrote: > > --- Joshua Brindle <method@gentoo.org> wrote: > > > >>> The first system I took through evaluation > >>> (that is, independent 3rd party analysis) stored > >>> security attributes in a file while the second > >>> and third systems attached the attributes > >>> directly (XFS). The 1st evaluation required > >>> 5 years, the 2nd 1 year. It is possible that > >>> I just got a lot smarter with age, but I > >>> ascribe a significant amount of the improvement > >>> to the direct association of the attributes > >>> to the file. > >>> > >> Thats great but entirely irrelevant in this > context. > >> The patch and caps > >> in question are not attached to the file via some > >> externally observable > >> property (eg., xattr) but instead are embedded in > >> the source code so > >> that it can drop caps at certain points during > the > >> execution or before > >> executing another app, thus unanalyzable. > >> > > > > Oh that. Sure, we used capability bracketing > > in the code, too. That makes it easy to > > determine when a capability is active. What, > > you don't think that it's possible to analyze > > source code? Of course it is. Refer to the > > evaluation reports if you don't believe me. > > > > > When I see an analysis of every line of source code > on an average Linux > machine then I might believe you
Would an above average Unix system suffice? How about MULTICS?
It's been done for: Irix and Trusted Irix Solaris and Trusted Solaris UNICOS HP/UX AIX SystemV Xenix
> (if you'll grant > that no software can > ever be installed on it afterward without being > analyzed)
Rubbish. No privileged software can be installed. Software that runs as a user without capabilities can be installed freely. It only requires analysis if it violates policy, which on a system with POSIX capabilities means running in possession of capabilities.
> but until then > I'll stick with a centralized policy.
OK. There is value in containment.
> I doubt many others will be > satisfied with that limitation.
It's been selling in the marketplace for the past 20 years.
> Bracketing hardly makes it analyzable, how can you > possibly know if the > bracketing happened?
Err, read the code?
> You *believe* it will and > therefore you say that > the bracketed code is safe but in reality this is a > discretionary > mechanism and you have zero assurance that there is > any security whatsoever,
Ah, no. You don't seem to understand the concept.
> no thanks, I'll pass.
Probably just as well, all things considered.
Casey Schaufler casey@schaufler-ca.com - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |