3 ms·

Note that there's nearly a decade of experience, research, and development between the "UNIX security holes" course djb mentions in that paper, and today; Capsi

by emaste 14y ago

Note that there's nearly a decade of experience, research, and development between the "UNIX security holes" course djb mentions in that paper, and today; Capsicum is not just an implementation of mid-2000s privilege separation. I believe the examples he presents (xine-lib buffer overflow obtaining access to a user's files, or one web page in browser stealing from and corrupting other pages) are capable of being generally addressed by Capsicum. djb's stance seems to require "avoiding bugs," a laudable bug extremely difficult goal for most programmers. Capsicum aims to make it easy to minimize the damage possible if a bug is exploited. Capsicum-enabled gzip is a good example: an exploit in the decompression code is limited to modifying the content of the output stream.

glhaynes 14y ago
"a laudable bug extremely difficult goal" A rare instance of a typo in a carefully-composed post perfectly illustrating its point.
- daivd 14y ago
  Hofstadterian
tptacek 14y ago
I don't think I disagree, but for the sake of argument, if the cost of addressing flaws with progressively pickier authorization controls exceeds the cost of eradicating bugs, that's not a success for least-privilege. My bigger bone to pick here is that the security frontier has shifted; we're no longer as interested in the border between applications and the operating system as we are in the border between different pieces of application code, and the border between the application and the database.
- jfb 14y ago
  There was a recent XKCD cartoon that touched on this; the focus on separation of privilege has historically been couched in terms of protecting one user from another. But the overwhelming majority of computing devices being sold are no longer multiuser, even as they maintain the outdated modalities. I'm not happy that my single-user machine even has the concept of multiple users; that is way, way, way too coarse a level of granularity for privilege separation.
  - emaste 14y ago
    Indeed, this is one of the things Capsicum is intended to address. Quoting from Robert Watson's PhD thesis, "A purely system-centric view, however, fails to address the observation that the security interactions of "users" are decreasingly central: desktop and notebook computers, tablet PCs, and smart phones typically have exactly one user." ... "Capsicum addresses these problems by introducing new (and complementary) security primitives to support compartmentalisation: capability mode and capabilities. Capsicum capabilities should not be confused with operating system privileges, occasionally referred to as capabilities in the OS literature. Capsicum capabilities are an extension of UNIX file descriptors, and reflect rights on specific objects, such as files or sockets. Capabilities may be delegated from process to process in a granular way in the same manner as other file descriptor types: via inheritance or message-passing." http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-818.html http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-818.html
- cperciva 14y ago
  And my point is that capsicum is a way to impose boundaries between different parts of a single application.
  - tptacek 14y ago
    Neat. Can you say a little more about that?
    - cperciva 14y ago
      Not really -- I'm not involved with capsicum, either as a developer or as a user (yet... I'm waiting for this project to make it easier for me to integrate capsicum into my code). What I know is just based on talking to the people behind capsicum. The best information is on the Capsicum website: http://www.cl.cam.ac.uk/research/security/capsicum/ http://www.cl.cam.ac.uk/research/security/capsicum/ Particularly interesting bits: chromium-capsicum - a version of Google's Chromium web browser that uses capability mode and capabilities to provide effective sandboxing of high-risk web page rendering. Library self-compartmentalization - we are adapting a number of commonly-used libraries, such as compression and image processing libraries, to automatically execute risky portions of their code in capability mode sandboxes. This will allow largely or entirely unmodified applications, such as web browers, to benefit from lightweight and easy-to-deploy sandboxing.
- trotsky 14y ago
  If you're not primarily spending time doing audits on n-tier web and enterprise, I'm not sure how inclusive that is. At least for user devices os and interprocess defense along with chains of trust and mitigation via painless refresh is all pretty os centric. It's just not as rbac centric.

by emaste 14y ago

glhaynes 14y ago

"a laudable bug extremely difficult goal" A rare instance of a typo in a carefully-composed post perfectly illustrating its point.

daivd 14y ago
Hofstadterian

tptacek 14y ago

I don't think I disagree, but for the sake of argument, if the cost of addressing flaws with progressively pickier authorization controls exceeds the cost of eradicating bugs, that's not a success for least-privilege. My bigger bone to pick here is that the security frontier has shifted; we're no longer as interested in the border between applications and the operating system as we are in the border between different pieces of application code, and the border between the application and the database.

jfb 14y ago
There was a recent XKCD cartoon that touched on this; the focus on separation of privilege has historically been couched in terms of protecting one user from another. But the overwhelming majority of computing devices being sold are no longer multiuser, even as they maintain the outdated modalities. I'm not happy that my single-user machine even has the concept of multiple users; that is way, way, way too coarse a level of granularity for privilege separation.
- emaste 14y ago
  Indeed, this is one of the things Capsicum is intended to address. Quoting from Robert Watson's PhD thesis, "A purely system-centric view, however, fails to address the observation that the security interactions of "users" are decreasingly central: desktop and notebook computers, tablet PCs, and smart phones typically have exactly one user." ... "Capsicum addresses these problems by introducing new (and complementary) security primitives to support compartmentalisation: capability mode and capabilities. Capsicum capabilities should not be confused with operating system privileges, occasionally referred to as capabilities in the OS literature. Capsicum capabilities are an extension of UNIX file descriptors, and reflect rights on specific objects, such as files or sockets. Capabilities may be delegated from process to process in a granular way in the same manner as other file descriptor types: via inheritance or message-passing." http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-818.html http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-818.html
cperciva 14y ago
And my point is that capsicum is a way to impose boundaries between different parts of a single application.
- tptacek 14y ago
  Neat. Can you say a little more about that?
  - cperciva 14y ago
    Not really -- I'm not involved with capsicum, either as a developer or as a user (yet... I'm waiting for this project to make it easier for me to integrate capsicum into my code). What I know is just based on talking to the people behind capsicum. The best information is on the Capsicum website: http://www.cl.cam.ac.uk/research/security/capsicum/ http://www.cl.cam.ac.uk/research/security/capsicum/ Particularly interesting bits: chromium-capsicum - a version of Google's Chromium web browser that uses capability mode and capabilities to provide effective sandboxing of high-risk web page rendering. Library self-compartmentalization - we are adapting a number of commonly-used libraries, such as compression and image processing libraries, to automatically execute risky portions of their code in capability mode sandboxes. This will allow largely or entirely unmodified applications, such as web browers, to benefit from lightweight and easy-to-deploy sandboxing.
trotsky 14y ago
If you're not primarily spending time doing audits on n-tier web and enterprise, I'm not sure how inclusive that is. At least for user devices os and interprocess defense along with chains of trust and mitigation via painless refresh is all pretty os centric. It's just not as rbac centric.