Re: security doc - Definition of Trust

On Monday, July 21, 2003, at 07:58 PM, Jim Pinkerton wrote:

> On the idea of removing the privileged resource manager, I guess I'm 
> unclear on the advantage of it. It's just a reference model to help 
> clarify issues. There are no MUSTs anywhere. Using the text as you 
> describe basically collapses the functionality into the RNIC. To me 
> one of the intentions of the paper was to specifically slice up the 
> security issues into more detail to better explain the issues. How you 
> implement it is your business though.

I'm trying to be inclusive of all possible implementations.

For example, RDMAP/DDP could be implemented as a user-mode library
running on top of a traditional stack. If it only exposed the 
applications
own memory then there is no need for a "Privileged Resource Manager".
The looser rule, that the local interface grant the RNIC Engine no
authority that the caller itself did not have, is met by simply
running within the process.

At the opposite extreme, I have worked with system buses where the
driver was allowed to directly DMA into a user map. (Not that anyone
has done anything like that *recently*, but ideas have a way of
cycling back around. Who knows about 3 years from now?).

So I'd like to recognize that there are multiple ways of ensuring
that an RNIC Engine does not violate the host system's security
rules. The descriptions of the Privileged Resource Manager
presume a multi-process Unix/Windows style OS dealing with
an RNIC Engine implemented primarily in hardware and/or
fully enabled (i.e., kernel) memory space. That's certainly
99.99 whatever % of the world, but it isn't everything.

Perhaps if the principle were established that some form of
access validation would be required, and that it would likely
be required to start from a single root authorizer. The Privileged
Resource Manager described could then be given as an example.


Caitlin Bestler - [email protected] - http://asomi.com/