Re: safe cpu'ing

On Mon, 8 Sep 2003, David Presotto wrote:

> One fear may be what you are giving the other system access to by
> cpu'ing there. If you are cpu'ing to a taken over system, it can get at
> anything on your system via your /mnt/term.  

There are two cases: you trust the remote system to a limited extent 
(you're in the same organization, say) so you are ok using it but don't 
want anyone on that system to see your stuff. In other words, you are 
assuming a non-malicious organization but potentially malicious people. 
For this case, I am assuming that Plan 9 protections are sufficient?

Case two is you really can't verify the remote organization, so want to 
make sure that they have not somehow compromised the machine in such a way 
as to bypass Plan 9 protections. 

> What I'm intending to do is create a program that mounts on '/' (much
> like iostats) and creates a a gui in a window (much like auth/fgui).
> (cool stuff deleted)

This sounds quite neat, and is a demonstration of things easily done on 
Plan 9 that are impossible on Linux. 

Did I get the two cases right? 


> This will take some work to not be a pain in the ass.  However, this is
> a real problem that the Condor people have.  I think this interactive
> solution can be good enough for us.  Condor is trying to solve it by
> analyzing the programs being sent places and making sure that the system
> calls being sent back are 'reasonable'.  That's not really possible in
> our world (or probably in theirs, for that matter).

I've never been a fan of the whole obfuscated system call approach, it 
seemed more like a way to use dyninst that a way to provide useful 
security.

ron