Messages in this thread | | | Date | Thu, 24 Aug 2006 07:49:33 +0200 | From | Pavel Machek <> | Subject | Re: [RFC][PATCH 8/8] SLIM: documentation |
| |
Hi!
> > > +In normal operation, the system seems to stabilize with a roughly > > > +equal mixture of SYSTEM, USER, and UNTRUSTED processes. Most > > > > So you split processes to three classes (why three?), and > > automagically move them between classes based on some rules? (What > > rules?) > > > > Like if I'm UNTRUSTED process, I may not read ~/.ssh/private_key? So > > files get this kind of labels, too? And it is "mozilla starts as a > > USER, but when it accesses first web page it becomes UNTRUSTED"? > > Processes are not moved from one integrity level to another, but are > demoted when they read from a lower integrity level object. By > definition sockets, are defined as UNTRUSTED, so reading from a > socket demotes the process to UNTRUSTED. (Secrecy is a separate > attribute.) In the Mozilla example, /usr/bin/mozilla is defined as > SYSTEM, preventing any process with lesser integrity from modifying > it. 'level -s' displays the level of the current process or of a > given file. For example, > > [zohar@L3X098X ~]$ level -s /usr/bin/mozilla > /usr/bin/mozilla > security.slim.level: SYSTEM PUBLIC > > Both mozilla and firefox-bin are defined as SYSTEM, as soon as the > firefox-bin process opens a socket, the process is demoted to > UNTRUSTED. > > I hope this answered some of your questions. We're working on > more comprehensive documentation, which we'll post with the next > release.
Do you have examples where this security model stops an attack?
Both my mail client and my mozilla will be UNTRUSTED (because of network connections, right?) -- so mozilla exploit will still be able t osee my mail? Not good. And ssh connects to the net, too, so it will not even protect my ~/.ssh/private_key ? Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |