Re: if file exist

["David Thompson" <david.thompson1@worldnet.att.net>]

Larry Kilgallen <Kilgallen@SpamCop.net> wrote :
> In article <g99o9.6469$k_2.489840@bgtnsc05-news.ops.worldnet.att.net>, "David
Thompson" <david.thompson1@worldnet.att.net> writes:
> > Mark Biggar <mark.a.biggar@attbi.com> wrote :
...
> >> No, from a computer security point of view, this is exactly what is
> >> wanted.  A user should see absolutely no difference between "file does
> >> not exist" and "you don't have permission to see the file".  Otherwise,
> >> you have introduced a covert information channel.
> >>
> > First this only matters if you want/need nondiscretionary controls.
>
> Non-discretionary controls, known as MAC for Mandatory Access Controls,
> are when the direct data owner (e.g., file owner) does not have full
> rights to control protection, for instance no right to disclose.
>
Yes, and not just the owner, but also other users who are authorized
to read and/or write, if any.

> The inability to tell whether an inaccessible file exists is _NOT_
> restricted to MAC situations.  Under DAC (Dicretionary Access Controls)
> the data owner may very well wish to restrict knowledge of file existence.
> Whether the desire for non-disclosure comes from the data owner or some
> higher authority has nothing to do with what characteristics are required
> in order to avoid disclosing the presence of a file.

But only MAC really needs to be concerned about covert channels,
since a DAC-authorized user is permitted to use open channels.
AFAICT it is rare(r?) in DAC situations to care about disclosing
existence, only contents, but if it is, it is common (and I am
assuming possible) to put the file in a directory which is restricted
against unauthorized probing for member's names and existence.

--
- David.Thompson 1 now at worldnet.att.net