Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.os.development > #9418

Re: The morality of operating system security

Show all headers | View raw

On Sat, 9 Apr 2016 18:25:19 +0100
James Harris <james.harris.1@gmail.com> wrote:

> On 02/04/2016 01:24, Rod Pemberton wrote:
> > On Fri, 1 Apr 2016 09:22:58 +0100
> > James Harris <james.harris.1@gmail.com> wrote:
> >> On 31/03/2016 04:18, Rod Pemberton wrote:  
> >>> On Thu, 31 Mar 2016 00:13:49 +0100
> >>> James Harris <james.harris.1@gmail.com> wrote:  
> >>>> On 29/03/2016 22:39, Rod Pemberton wrote:  
> >>>>> On Tue, 29 Mar 2016 15:09:35 +0100
> >>>>> James Harris <james.harris.1@gmail.com> wrote:  

...

> For a system admin (your sense of the term) yes, as you say below, I 
> think there would need to be multiple administrators with different 
> privileges.
> 
> Imagine a sizeable organisation. It would have policies as to who can 
> see what, and would be regularly audited.
> 
> I would imagine that they would want to see audit-log entries for 
> various things. It would need to be possible to set up the OS to keep
> an audit trail of any 'interesting' actions.
> 
> There would probably be a master set of controls and one small team
> able to change them, and every change they made would be logged.
> 
> The log would need to show what controls they opened (to specific 
> groups) and closed.
> 
> Presumably, other people would use the opened controls to grant and 
> revoke privileges between users and data. Those changes may or may
> not be logged, depending on the company's audit policy.

I still see having a "master set of controls" as being an issue.

They would likely still have enough privilege to edit, delete, or
replace audit logs.   Alternately, they may be able to adjust file
privileges to temporarily restrict write access to the logs, or block
write access to the directory or higher-level directory.  They might
also be able to redirect output to a file which is deletable or null
depending on how the program is invoked.  Of course, they may be able
to log in to more privileged accounts or use privilege boosting apps
like 'su' or 'sudo' or run a privileged app, e.g., privileged editor or
shell or privileged OS app which allows terminal, shell, or CLI
commands to execute, which has sufficient privileges to do such things.

At best, the system would need multiple admin accounts, with each
account restricted to different capabilities.  This would likely need
to be by design, designed into the system directly.  I'm unsure if you
could convert a root/non-root model to this.  It might be possible to
delete the root account after the multiple restricted admins were
activated, or perhaps use root to delete the root password to block
access to the account.  Good luck if you messed up!

> Besides, as you mention backups, most conventional OS file
> permissions are completely swept aside by a system backup program. It
> has to have read access to everything and thus bypasses read-security
> on every file on the computer.

I think that's because it's run as admin or root.  If you were to run
a backup program as a user on a root/non-root system, it either wouldn't
run due to insufficient privilege to execute the app, or the backup app
would only backup the files your account has privileges to access.

> IMO it would be better to encrypt anything which is about to be
> stored on disc, except data recognised as public-readable. I know
> that's a very different model to what's normally done.

That would be good for transferring securely or storing private data.
However, what happens if the password to the encrypted data is lost?
What happens if the decryption fails? e.g., due to bad track or sector.
What do you do if all copies were mailed at the same time and somehow
destroyed?  Things like this occur in real life.  What do you do if
one of two RAID linked drives fails?  You always need a backdoor, an
additional copy, or an non-encrypted copy somewhere for life's failures.
People forget passwords.  People forget the answers to security
questions.  They have to be written down or recorded or you risk being
locked out.  Murphy's law strikes when least expected.

> Finally, if data are encrypted on storage something needs to know how
> to decrypt them. If a disc is moved from one instance of the OS to
> another there is a question over whether the new OS should be able to
> decrypt the same data or not.

That's an issue.  In some instances, you may want access on the
new system, e.g., recovery.  In other instances, you may not want
access on the new system, e.g., hacked.  An additional issue
is whether or not the new system has the hardware or software
to decrypt the data.  It may not.  That's a problem if you
need to recover data especially in the future once a system
becomes obsolete.

> >> That illustrates that people who "need" access generally get access
> >> to entire files of information - and that there is no restriction
> >> on what they can do with those files. OSes have file permissions
> >> and that is simply not adequate.  
> >
> > I think it's more a matter of setting up privileges to restrict
> > access to files is a total PIA.  
> 
> Cannot that stuff all be dealt with by granting privileges to certain 
> groups, and then choosing which users to put in which groups, as is
> done at the moment?

Group privileges probably would work for some or most of it.  But, you'd
still likely have dead or inactive accounts in the group which hackers
could attempt to access or reinstate.  Imagine a university or
medium-sized company.  They could have turnover of 1,000 people per
year or more.  If there isn't an administration tool that helps add and
remove accounts in bulk using some criteria, that's a lot of work for
somebody.

> That is to allow a certain person's userid to work normally and only
> get extra privileges when required. What the person would do is
> switch into a different O.R. (for which he/she had already been given
> permission) to carry out a privileged action. Then he/she could
> return to normal mode after carrying out the action that needed extra
> security.

Personally, I don't like the root/non-root model, but I'm usually in a
near admin capacity or I'm the computer's owner.  From my perspective,
it's generally an impediment to attempt to do any work as non-root,
since you'll need root privilege repeatedly to do anything important.
Of course, in a multi-user environment, you need some way to control
people, and not just basic users, but the admin's too.  People make
mistakes.  People attempt to bypass security to do their job or even
out of curiosity.  People become greedy or corrupt, when mistreated.
Human nature is the flaw here.  Perhaps, robotics and AI will be useful
in this regards ...

> >> IMO it would be better to give people permission to specific fields
> >> of data. And, as above, if the program accessing the data has to be
> >> authorised to do so, that program can limit itself to, say,
> >> displaying data on a screen, and not provide an option to do
> >> anything else with the data. That would prevent administrators
> >> making copies.  
> >
> > It's too much work and too many problems.
> 
> The number of employees would not matter much. They could be assigned
> to groups and operational roles when their accounts were created.

What do you to do prevent the need to delete inactive accounts?

> Of course, given that we are talking about fields and records, we are 
> talking about a very different model from the Unix stream-of-bytes
> model that is used for files. This is more like a database.

Yes.

> Perhaps when file structures are designed the fields could be
> assigned to groups, and then usergroups and organisational roles
> given access to those groups of fields..?

Setting, correcting, removing all these privileges seems
like a lot of work to me.

> AISI the system admins could set up the structures but not be
> allowed to see all the data.

If they control whom has which privileges, how does that work? ...
Privilege escalation is a serious problem if someone has privilege.
How do you prevent self-dealing of privileges to the privileged?
Raw trust?  Bad choice.  I think that's true whether discussing
computer admins, or law enforcement, or government agencies.
Even the most trustworthy people are not perfectly trustworthy.
Trust-but-verify?  Ok, I just verified that they stole everything ...

> That would be the realm of the data admins, e.g.
> the people who dealt with customers and updated the data.

Ok.

> I mean they might find something sensitive or personally embarrassing
> on a person's computer, or some private communication etc, but if
> they are looking for terrorism-related information they would not be
> interested in embarrassing stuff and not have any reason to look at
> it or do anything with it.

Well, that's not the way it usually works in the U.S.

Most things of an embarrassing nature are usually also illegal.
Once law enforcement gets their hands on such things, you'll be
charged with a crime even if their warrant didn't authorized
them to search for such stuff.

E.g., they have a warrant to search your house for terrorism and they
find something else, say any one of the following: illegal drugs,
prohibited weapons, illegal pornography, kidnapping, slavery, or fraud.
You'll be charged with crimes.  Now, technically, the U.S. has a
doctrine, "fruit of the poisonous tree," which prohibits evidence which
wasn't legally obtained via warrant or probable cause from being used,
but realistically that only causes a small percentage of such cases to
be discarded.  Judges usually favor law enforcement claims.  If the
crime is something considered to be heinous, the courts will prohibit or
restrict evidence which "stacks-the-deck" in favor of the prosecution.
I.e., the judge or prosecutor is "sure" that you're guilty and they
"tilt" the system in favor of you being convicted.

Another situation which happens is when they have probable cause for
something.  E.g., a criminal is fleeing law enforcement.  The criminal
breaks into your house while your on vacation (or holiday).  They have
probable cause to enter your home to obtain the criminal.  You for
whatever reason have something illegal to possess.  Certain things are
illegal to possess while others are illegal to obtain but not possess.
They generally don't need a warrant to charge you with a crime for
things which are illegal to possess.  I.e., illegal possession laws
end-run around our fourth amendment rights to unlawful search and
seizure.  So, you'll be charged with a crime even though law enforcement
had no legal reason to search you or your home for criminal activity
prior to chasing down a criminal.

Another situation which has happened a number of times in the past
decade is where people had to be evacuated for forest fires or floods.
Authorities were evacuating homes.  Authorities usually condemn
homes in flood or fire areas in order to have the legal right to enter
the homes to ensure they've been evacuated.  I.e., they legally entered
homes to make sure they were empty for the public good, but they were
also charging homeowners and occupants with crimes for stuff they found
in their homes during the evacuation process.

> >> I don't mind a limited group of people seeing my web browsing
> >> history or my emails or my texts etc. What I don't want is that
> >> info to escape and become visible to the wider public.  
> >
> > I'm not sure that is possible.  Once someone has the data, it
> > will usually propagate, typically, to someone in a foreign
> > country, where you have no legal recourse.
> 
> As long as there is only a small team who can see the stuff I don't 
> mind. In the UK that could be a team at GCHQ - the spying agency.

This is an issue of trust.  Some may not trust them.
People trusted the the NSA prior to Snowden, mostly
because they didn't know the truth or it couldn't
be proven.

> >> Maybe that also gives the lie to Edward Snowden's claims about the
> >> Smurfs he alleges to be contained within people's phones...?  
> >
> > Are you joking or serious? ...  
> 
> I was serious, though I don't know whether Snowden was
> being truthful or not. For example, see
> 
> [link]
> 

"named after Smurfs"

That I wouldn't doubt.  I wouldn't doubt programs named
after characters from Disney, Tolkien, or Harry Potter.

So, it wasn't a claim of actual Smurfs ...  ;-)


Rod Pemberton

Back to alt.os.development | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-03-29 15:09 +0100
  Re: The morality of operating system security JJ <jj4public@vfemail.net> - 2016-03-30 00:03 +0700
    Re: The morality of operating system security "wolfgang kern" <nowhere@never.at> - 2016-03-29 19:39 +0200
    Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-03-30 23:54 +0100
      Re: The morality of operating system security JJ <jj4public@vfemail.net> - 2016-03-31 06:16 +0700
  Re: The morality of operating system security "wolfgang kern" <nowhere@never.at> - 2016-03-29 20:01 +0200
    Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-03-30 23:59 +0100
      Re: The morality of operating system security Bernhard Schornak <schornak@web.de> - 2016-03-31 17:47 +0200
        Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-01 08:11 +0100
          Re: The morality of operating system security Bernhard Schornak <schornak@web.de> - 2016-04-01 18:25 +0200
            Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-01 23:10 +0100
              Re: The morality of operating system security Bernhard Schornak <schornak@web.de> - 2016-04-02 14:18 +0200
      Re: The morality of operating system security "wolfgang kern" <nowhere@never.at> - 2016-04-01 09:58 +0200
        Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-01 10:06 +0100
  Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-03-29 17:39 -0400
    Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-03-31 00:13 +0100
      Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-03-30 23:18 -0400
        Re: The morality of operating system security "Alexei A. Frounze" <alexfrunews@gmail.com> - 2016-03-31 00:31 -0700
          Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-03-31 16:57 -0400
        Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-01 09:22 +0100
          Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-04-01 20:24 -0400
            Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-09 18:25 +0100
              Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-04-09 18:57 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-26 09:07 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-04-26 23:58 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-27 07:01 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-04-27 05:42 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-05-03 00:05 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-05-03 16:55 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-05-04 09:00 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-05-04 17:22 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-05-05 17:02 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-05-05 17:55 -0400
                Re: The morality of operating system security "Kerr Mudd-John" <admin@127.0.0.1> - 2016-05-09 14:58 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-05-12 17:46 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-05-15 00:11 +0100
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-27 07:44 +0100

csiph-web