Subject: RE: script extensibility I-D

From: "Wallis, David" <[email-masked]>
Date: Fri, 22 Jun 2001 12:00:42 -0500

This solves the insecurity of storing the script in the filesystem as well.
If the runtime engine receives the script over stdin, there is no filename
that must be mapped to a physical location.

-----Original Message-----
From: Juergen Schoenwaelder [mailto:[email-masked]]
Sent: Friday, June 22, 2001 8:02 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: script extensibility I-D

>>>>> Wallis, David writes:

David> 2) Environment variables are not access protected.

David> On the bottom of page 5 it states: The security assumption here
David> is that access to the process environment is protected by the
David> operating system.  This assumption is invalid on many (most?)
David> operating systems. The statement on page 23 that "well
David> maintained UNIX operating systems have this property."  is
David> erroneous, unless "well maintained" means removal/replacement
David> of the BSD ps command (try "/usr/ucb/ps eaww" on Solaris).

Our current thinking on this problem is to drop the TCP transport
altogether. Instead, we will specify that SMX 1.1 is being run over
POSIX pipes. Runtime engines talk SMX over stdin/stdout and the agent
is responsible to setup appropriate pipes before creating runtime
engines. Runtime engines are not required anymore to connect back to
the agent and hence there is no need anymore to pass cookies around.

/js

-- 
Juergen Schoenwaelder      Technical University Braunschweig
<[email-masked]>  Dept. Operating Systems & Computer Networks
Phone: +49 531 391 3289    Bueltenweg 74/75, 38106 Braunschweig, Germany
Fax:   +49 531 391 5936    <URL:http://www.ibr.cs.tu-bs.de/~schoenw/>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Sat, 23 Jun 2001 17:00:55 +0200

>>>>> Wallis, David writes:

David> This solves the insecurity of storing the script in the
David> filesystem as well.  If the runtime engine receives the script
David> over stdin, there is no filename that must be mapped to a
David> physical location.

(a) I still do not believe there is an insecurity of storing scripts
    in the filesystem.

(b) We did not propose to send the script code over standard input.
    I just said the SMX is carried over a POSIX pipe.

/js