4 ms·

A question for people who are security experts: do you think the model of a computer having limited users and privileged users, with a user gaining privileged a

A question for people who are security experts: do you think the model of a computer having limited users and privileged users, with a user gaining privileged access being a massive security problem, is really tenable? The CPU/GPU are shared resources on a machine and isolating the work they do by user is quite difficult. Would it really be infeasible to simply design compute systems under the assumption that all users can get root access? Most of these vulnerabilities can be mitigated for free by not giving any access to users you wouldn't mind having root access.

mschuster91 1y ago
> The CPU/GPU are shared resources on a machine and isolating the work they do by user is quite difficult. The problem is, users aren't even the threat boundary any more. Some classes of attacks like Rowhammer have been successfully exploited from Javascript.
ospray 1y ago
Its more like we build computers that way to protect people from running code they shouldn't and limiting the blast radius if they do. A lot of the protections that pushed iOS zero click jailbreak exploit chains to the $10 million plus range impact capability and performance heavily. However you do have a good user experience that "just works" and keeps people safe. Run as sudo no pass if want man just for many that's to much risk.
lotharcable 1y ago
Not a security expert here... But Discretionary Access Controls is a standard part of OS design for a very long time. It is certainly possible to go back to DOS-days and run all your programs without controls as terminate and stay resident programs. But that would be awfully inconvenient. The concept of "users" isn't just for human users. It is used to do things like prevent your web server from being able to read and edit your password files and such things.
- ytpete 1y ago
  I'm assuming what they are thinking along the lines of is not that we'd do away with the notion of privilege levels, but more that privilege boundaries would become 1:1 with hardware boundaries. So perhaps you'd have a dedicated CPU core with its own isolated cache for running the kernel, or that sort of thing. Almost like multiple separate systems communicating across client-server boundaries. I guess the question for me though (as neither a deep expert in security nor low-level hw) is, how much less efficient would that be than the kinds of mitigations used today for shared hardware? If it's far more guaranteed-safe and the cost is only just a bit higher than today's mitigations... that would be interesting indeed.

mschuster91 1y ago

> The CPU/GPU are shared resources on a machine and isolating the work they do by user is quite difficult. The problem is, users aren't even the threat boundary any more. Some classes of attacks like Rowhammer have been successfully exploited from Javascript.

ospray 1y ago

Its more like we build computers that way to protect people from running code they shouldn't and limiting the blast radius if they do. A lot of the protections that pushed iOS zero click jailbreak exploit chains to the $10 million plus range impact capability and performance heavily. However you do have a good user experience that "just works" and keeps people safe. Run as sudo no pass if want man just for many that's to much risk.

lotharcable 1y ago

Not a security expert here... But Discretionary Access Controls is a standard part of OS design for a very long time. It is certainly possible to go back to DOS-days and run all your programs without controls as terminate and stay resident programs. But that would be awfully inconvenient. The concept of "users" isn't just for human users. It is used to do things like prevent your web server from being able to read and edit your password files and such things.

ytpete 1y ago
I'm assuming what they are thinking along the lines of is not that we'd do away with the notion of privilege levels, but more that privilege boundaries would become 1:1 with hardware boundaries. So perhaps you'd have a dedicated CPU core with its own isolated cache for running the kernel, or that sort of thing. Almost like multiple separate systems communicating across client-server boundaries. I guess the question for me though (as neither a deep expert in security nor low-level hw) is, how much less efficient would that be than the kinds of mitigations used today for shared hardware? If it's far more guaranteed-safe and the cost is only just a bit higher than today's mitigations... that would be interesting indeed.