Subject: RE: script extensibility I-D

From: "Wallis, David" <[email-masked]>
Date: Mon, 25 Jun 2001 14:48:43 -0500

>From: Juergen Schoenwaelder [mailto:[email-masked]]:
>(a) I still do not believe there is an insecurity of storing scripts
>    in the filesystem.

In that case, I suggest you contact the Unix security expert of your choice,
and ask him/her to study the possible security problems in what your
propose. I only know that it has similarities to the "setuid script"
problem. See Question 11 at
http://www.geocities.com/SiliconValley/Bay/9952/alt_sec.txt where the known
insecurities of setuid scripts are discussed. Note that it is you as a
proposer of a new standard who has the obligation to convince me, a possible
user of that standard, that you have examined the security implications of
what you propose and can vouch that the standard is safe. It is not my
obligation to convince you that it is unsafe.

>(b) We did not propose to send the script code over standard input.
>    I just said the SMX is carried over a POSIX pipe.

Then may I humbly suggest that you consider the possibility of sending the
script over standard input to the runtime engine.

David Wallis

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 26 Jun 2001 12:20:27 +0200

>>>>> Wallis, David writes:

>> From: Juergen Schoenwaelder [mailto:[email-masked]]: (a) I
>> still do not believe there is an insecurity of storing scripts in
>> the filesystem.

David> In that case, I suggest you contact the Unix security expert of
David> your choice, and ask him/her to study the possible security
David> problems in what your propose. 

You brought this issue up. I think it is just fair to ask you to make
your point. I am really willing to learn and to fix the bug if there
is one.

David> I only know that it has similarities to the "setuid script"
David> problem. See Question 11 at
David> http://www.geocities.com/SiliconValley/Bay/9952/alt_sec.txt
David> where the known insecurities of setuid scripts are
David> discussed.

There scripts are not setuid root and the text cited above does not
apply. Please tell me where the problem.

[If there is a problem, then I would argue that the whole /etc/init.d
 Unix concept (or rc.local if you prefer BSD) suffers from the same
 problem. These are also scripts that are execute by a privileged
 shell.]

David> Note that it is you as a proposer of a new standard who has the
David> obligation to convince me, a possible user of that standard,
David> that you have examined the security implications of what you
David> propose and can vouch that the standard is safe. It is not my
David> obligation to convince you that it is unsafe.

As Randy noted, SMX is not standards-track at this point in time. And
even if it were, I would still expect that people who want us to make
protocol changes come up with a convincing argument for the change.

/js

-- 
Juergen Schoenwaelder      Technical University Braunschweig
<[email-masked]>  Dept. Operating Systems & Computer Networks
Phone: +49 531 391 3289    Bueltenweg 74/75, 38106 Braunschweig, Germany
Fax:   +49 531 391 5936    <URL:http://www.ibr.cs.tu-bs.de/~schoenw/>