3 ms·

I don't really understand what's the point of tracking the sources when copying files? A security policy which restricts my actions over an object I had copied

I don't really understand what's the point of tracking the sources when copying files? A security policy which restricts my actions over an object I had copied (with permissions to do so) seems a bit strange to me. But the slides don't really explain why this is wrong?

dredmorbius 12y ago
I'm frankly puzzled by this as well. 1. Why is it a mandatory requirement? 2. How can it possibly be uniformly implemented. E.g.: curl <some source> | perl -e <some filter> > file How the hell is _any_ OS going to track origin of 'file'? What _is_ origin of 'file'? Add an arbitrary number of netcat-over-UDP transfers between start and end of process. Ownership/origin metadata is impossible to track unless it's overlayed on every single bit of of information transiting every process and every network node. djb simply does a massive hand-wave over this, as far as I can tell. I respect the man a lot, but this totally loses me.
- myhf 12y ago
  Listing the most immediate network connection as the source helps reduce a lot of questions to "do you trust this url?". But with a web of trust, you could also identify multiple remote sources as belonging to the same entity.
- jkolash 12y ago
  It seems simple you just give an OS program the URI necessary. The program then performs the download and tags it with the relevant metadata. The example you give would be a bit more complicated, but you would just rewrite curl to attach metadata to file descriptors. Then the OS can have some restrictions about certain programs reading from file descriptors with metadata it deems untrustworthy.
- sitkack 12y ago
  How is this different than the concept of 'taint' in Perl? Or setting meta data on a file object? mdls -name kMDItemWhereFroms slides-djb-20140710-a4.pdf kMDItemWhereFroms = ( "http://cr.yp.to/talks/2014.07.10/slides-djb-20140710-a4.pdf", "" ) Set some metadata on process streams. One could write a kernel module to track this flow. I'd love to set filters on file actions like, "after an image/pdf/etc has been downloaded prevent any program from loading it until it has been scrubbed through a whitelisting format normalizer running in a VM" if problems are found, alert and blacklist source. Free technical PDFs make a great vehicle into a research org.
  - dredmorbius 12y ago
    Taint isn't telling you who data came from. Only that it was external to the program. That's a much simpler challenge, particularly as it takes place within a single process's context.
cbsmith 12y ago
This is kind of a core principle of mandatory protection systems (Class B for people familiar with the old orange book). Without this, it because difficult to ensure security policies are subverted by users. There are also some really powerful security benefits when essentially nothing is anonymous.

dredmorbius 12y ago

I'm frankly puzzled by this as well. 1. Why is it a mandatory requirement? 2. How can it possibly be uniformly implemented. E.g.: curl <some source> | perl -e <some filter> > file How the hell is _any_ OS going to track origin of 'file'? What _is_ origin of 'file'? Add an arbitrary number of netcat-over-UDP transfers between start and end of process. Ownership/origin metadata is impossible to track unless it's overlayed on every single bit of of information transiting every process and every network node. djb simply does a massive hand-wave over this, as far as I can tell. I respect the man a lot, but this totally loses me.

myhf 12y ago
Listing the most immediate network connection as the source helps reduce a lot of questions to "do you trust this url?". But with a web of trust, you could also identify multiple remote sources as belonging to the same entity.
jkolash 12y ago
It seems simple you just give an OS program the URI necessary. The program then performs the download and tags it with the relevant metadata. The example you give would be a bit more complicated, but you would just rewrite curl to attach metadata to file descriptors. Then the OS can have some restrictions about certain programs reading from file descriptors with metadata it deems untrustworthy.
sitkack 12y ago
How is this different than the concept of 'taint' in Perl? Or setting meta data on a file object? mdls -name kMDItemWhereFroms slides-djb-20140710-a4.pdf kMDItemWhereFroms = ( "http://cr.yp.to/talks/2014.07.10/slides-djb-20140710-a4.pdf", "" ) Set some metadata on process streams. One could write a kernel module to track this flow. I'd love to set filters on file actions like, "after an image/pdf/etc has been downloaded prevent any program from loading it until it has been scrubbed through a whitelisting format normalizer running in a VM" if problems are found, alert and blacklist source. Free technical PDFs make a great vehicle into a research org.
- dredmorbius 12y ago
  Taint isn't telling you who data came from. Only that it was external to the program. That's a much simpler challenge, particularly as it takes place within a single process's context.

cbsmith 12y ago

This is kind of a core principle of mandatory protection systems (Class B for people familiar with the old orange book). Without this, it because difficult to ensure security policies are subverted by users. There are also some really powerful security benefits when essentially nothing is anonymous.