Re: [cap-talk] RumpelTree++

On Fri, July 25, 2014 20:51, Raoul Duke wrote:
>> Would anyone be interested in contributing a security-oriented
>> code-review
>> on my library? Its C++11 code and I took extra effort to make sure
>> memory
>> containing security sensitive authority tokens gets wiped after usage
>> while maintaining the friendly almost fully string like interface.
>
> this is a sincere but neophyte question, i do not mean it in a snarky
> way, but is anything written in C++ able to be considered safe or
> secure? or are the definitions of safe and secure meant to be taken
> relative to the fact that it is all written in C++?
>
> thank you.

Fair question. The security measures I took were with respect to malloc
attacks. I think that from the perspective of malloc attacks, low level
memory insecure languages might actually be the only ones available to
allow any defence. The library is providing a sparse cap frame for DAG
shaped hierarchies. The thread model is: other processes gaining access to
these authoritative tokens. If at any time a process holding such
sparse-caps ends and a hostile process manages to malloc a page that still
holds the old process its sparsecaps, than the relevant security property
would have been broken. If in C++ I can manage to clear the relevant
memory location prior to deallocation and thus most importantly, prior to
pages being reassigned to hostile processes, while in a memory safe or
even ocap language I could not guarantee this, than memory insecurity in
my specific case paradoxaly seems to actually be a virtue.

(sidenote: if swap is enabled all efforts could be futile)

I hope the above makes some sense.

Rob

> _______________________________________________
> e-lang mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/e-lang
>
>