Re: separating policy and mechanism

[fche at redhat dot com (Frank Ch. Eigler)]

"Chen, Brad" <brad.chen@intel.com> writes:

> [...]  For example, a hypothetical policy configuration file might
> support options like this:
>
> 	Kernel-Writes: deny all
> 	Kernel-Reads: allow if USER=$UID
> 	Kernel-Calls: allow by symbol
> 		sys_read()
> 		sys_write()
> 		sys_open() with user=$UID

OK.  A tangible first step in this direction will be to get the
translator to print a "security profile" of an elaborated script
program.  This would enumerate the sorts of items you listed: external
references by the script and its dependencies.


> I assume these restrictions would apply only to code created by the
> script author; the tapsets and runtime would be considered
> "trusted"; effectively like part of the OS.

OK but recall my note during the face-to-face meeting that we need to
consider people reusing each other's script fragments in a way that
avoids automatically blessing those reused scripts as trusted.


> Clearly there is a huge amount of work implied by such options; I'm
> trying to communicate a vision, not a May deliverable. [...]

Fair enough.  Please don't feel discouraged.  I am sure there is a
germ of a good idea in there, even if I don't quite see it yet. ;-)


- FChE