🚀 go-pugleaf

eronald@fml.tuwien.ac.at (Edmund Ronald) writes:

>  Several people remarked that virues on Unix machines were "impossible"
>because of the access control separating accounts. [etc.]

Clearly UNIX viruses are possible, but are harder to do than in the MS-DOS
and Mac world.  As several others have noted, access control and memory
management make the job of the virus writer more difficult, but don't
eliminate the possibility.  But on to the main point...

>I was interested in FUTURE systems: How might these be rendered "resistant
> by design"?

The first step is to go back to the dreaded Orange Book...while it doesn't
have anything that talks about viruses, it DOES talk about designing and
developing secure systems.  The reason most systems are so vulnerable
to viruses, trojan horses, bugs, etc., is that they are not designed,
implemented, or tested in a rigorous fashion.  No matter what you're going
to do to avoid viruses, if you don't design and build the system in a
way to ensure that it's right (i.e., with high assurance) the bugs will
exist allowing clever and malicous users to bypass the security.

As to what *mechanisms* work, I'd suggest going back to a lot of work
done in the 60s on capability-based mechanisms, along with some newer
work to update it.  Unlike traditional access control which is based
on a user's identity (and perhaps other attributes), capabilities give
individual *programs*, or even parts of programs, the ability to access
objects (such as files) within the system.  A properly implemented
capability system should be relatively virus-resistant, since the virus
would not have any capabilities, even if the user executes it accidentally.
Of course, if the user can be tricked into assigning capabilities to the
virus, or the virus can obtain the capabilities through a bug in the
system, this doesn't help.

The problem with this approach, and the reason capabilities aren't used 
very much is that it's more complicated and less intuitive (IMHO) to
manage them.  To implement a UNIX-like interface on top of a capability
system every utility would have to be granted access to every possible
file.  That is, if I want to run "grep" on all my files, it's a real
nuisance to first have to invoke a trusted interface to grant grep
all the needed capabilities, and then to run the untrusted grep program.

Like Mr. Roland (the poster of the original question), I'd be interested
in other approaches people would propose.
-- 
Jeremy Epstein			Internet: epstein@trwacs.fp.trw.com
Trusted X Research Group	Voice: +1 703/803-4947
TRW Systems Division
Fairfax Virginia