Re: For the AdaOS folks

[Nick Roberts <nick.roberts@acm.org>]

"Warren W. Gay VE3WWG" <ve3wwg@NoSPAM.cogeco.ca> wrote:

> Dmitry A. Kazakov wrote:
> > But the only need in firewall is the policy of trusting behind it.
> 
> That is all I need to keep you from messing with my files ;-)

I think I side with Dmitry on this one.

When reading a variety of authoritative documents, papers, and books on the
subject of computer security, one of the basic principles they all espouse
is that of 'minimum necessary privilege'. In other words, access is denied
by default, of every object (file, database table, etc.) to every subject
(person, program). Access is granted between an object and a subject only
when these is a specific need.

Okay, I think this principle needs to be taken as a guideline, rather than a
strict rule. It's not likely to be practical on a very fine-grained, highly
dynamic level. Nevertheless, I intend to make the security mechanisms
capable of supporting this principle, to a reasonable degree, and to make
the default security policies implement it.

In practice, that means that, for example, when a user creates a new file
(and saves it), the new file is, by default, inaccessible to (and invisible
to) all other unprivileged users.

By the same token, I intend to make it easy to deliberately share things.
For example, a user can create a kind of directory or folder called a 'file
group', share the group with others users (by simple drag-and-drop), and
then make a file part of the group (also by simple drag-and-drop). The other
users can then see and access the file. The group can be made a 'read-only'
type or a 'full access' type.

When somebody uses an internet service in AdaOS, they do so with a certain
'role' of a certain user. This restricts their privileges (to that role of
that user). If that role is not permitted to access a file, the user of the
internet service is not, either. Of course, typically, things will be
arranged to permit minimum necessary access by internet services. For
example, a web server will be permitted to access the files (and other data)
which make up a web site, but nothing else.

The necessity for a separate firewall seems to be obviated by this
arrangement. The whole system is acting as a big firewall in itself. In
particular, AdaOS will not have any holes or back doors in its security. The
security mechanisms will be hermetically sealed. (This may be somewhat in
contrast to other operating systems.)

-- 
Nick Roberts