Subject: mail sandbox wall authority, inward and outbound

From: "James P. Salsman" <[email-masked]>
Date: Thu, 11 May 2000 13:10:15 -0700 (PDT)

A MUA might ask the console operator for permission to proceed when:

1. A mail message wants to run a program.  (e.g., ECMAscripts.)

2. An attachment is executable. (Nearly universal practice.)

3. A program wants to write to a file.  (Usually not trapped more 
than once per execution if at all.)

4. A program wants to read your address book.  (Does any mail system 
that offers this functionality limit it at all?)

5. A program wants to send mail.  (e.g., having MAPI's Send notify 
the user and queue the proposed message as a draft instead of sending.)

All of those precautions would help prevent the destruction and 
spread of worms. (These mail things aren't "VIRUS"es, technically.)

If you had to pick one, #5, asking before sending mail and making 
the user explicitly approve each message, might be the best choice, 
because the resulting messages are easily reviewed and confirmed, 
and the other actions might be more frequently legitimate.

These sorts of things are less common on the more heterogeneous 
Unix world, but Unix mailers are just as culpable.  If I wanted to 
be consistent, I would demand that anything I run on Unix (without 
a special permitted shell) which connects to port 25 should be 
intercepted, wrapped with an "ok queued" SMTP response, and 
forwarded to me instead.  Would anyone argue that isn't reasonable?

Cheers,
James

P.S. this mail sent with /ucb/Mail by Bill Joy c. 1980

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Fri, 12 May 2000 00:12:46 +0200

>forwarded to me instead.  Would anyone argue that isn't reasonable?
Yes, but only because I have 15 different programs that more or less 
indirectly invoke /usr/sbin/sendmail for various reasons.
Most of them are tools invoked from cron.

In a fine-grained capabilities control system, I'd have the "send email" as 
one access control descriptor I could grant these programs.
But that's not been implemented in any widespread system I know of.

                            Harald

--
Harald Tveit Alvestrand, EDB Maxware, Norway
[email-masked]

---

From: "James P. Salsman" <[email-masked]>
Date: Fri, 12 May 2000 16:44:09 -0700 (PDT)

Harald,

> Most of them are tools invoked from cron.

As long as your OS looks at an enviroment-based path for the shared 
net library, you can replace those in standard locations with the 
wrapped versions, and prepend their new location to the head of your 
trusted programs' loader's path. 

> But that's not been implemented in any widespread system I know of.

Are there even cross-platform specs yet?

Cheers,
James

-- 
IMS Q&TI Editor project description: http://www.bovik.org/imsqtied.html
Open-source development:  http://sourceforge.net/project/?group_id=3308