🚀 go-pugleaf

In article <21382@rpp386.lonestar.org>, jfh@rpp386.lonestar.org (John F. Haugh II) writes:
|> Given the example you provided, putting something in the mail headers
|> is not an example of a covert channel.  ... 
|> The definition which I have always used for "covert channel" is the one
|> straight out of the Orange Book - "covert channel - A communications
|> channel that allows a process to transfer information in a manner that
|> violates the system's security policy."  If you are permitted to change
|> the mail headers, doing so cannot violate the system's security policy.

John is contradicting himself.  Many systems rely on procedural elements to implement 
portions of the security policy, i.e., there may be many systems which have e-mail software 
that allows the user to change mail headers and also have security policies which prohibit
the transfer outside the organization of specified information.  Any user who uses fields in
the mail header to transfer such information is violating the system security policy.  And,
under the definition given above, such use constitutes a covert channel.

The definition John quotes above is also the one I use and is, I suggest, the most 
appropriate.  Can we agree that, for this thread, this is the one we will use?

-- 
	   _   _
    /_    / ) / ) Jeff Hull          hull@den.mmc.com
   //_) -/- -/-   1544 S. Vaughn Cir
/_/ \_/ /   /	  Aurora, CO 80012   303-977-1061