🚀 go-pugleaf

hotelca@cris.com (Hotel California) writes:
>Well, it depends on what access privileges are given to the user by the
>admin.  If you have go to finder privileges then you can alter anything. 
>If you have access to the Open Other menu command then you can change
>anything you can open as long as you have saving privileges where the file
>is stored.

At what level are these saving privileges implemented?

With Unix, file protection is done at the kernel level.  No program a
user runs can override this, because the system calls to manipulate
files and devices fail if the userid (a number) associated with that
process lacks sufficient privileges.  For example, if Bob's home
directory is unreadable to me, there is no way at all for me to access
his files except by assuming the identity of a more priviliged user.
(There exists a mechanism for doing this, certain files can be tagged
with a bit allowing them to change the userid number as they run.
Someone who runs that program can then assume the priviliges of
whoever placed that 'setuid' bit in place).

The only way for me to access Bob's protected files would be to run a
setuid program owned by Bob or root.  There is nothing I could write
to get around the restrictions.  If one of my programs used the
'open()' system call to try to open Bob's files, it would fail with
"Permission Denied". 

On a Mac with the programs you mention, is the protection done at a
level as low as this?  If not, then it could be circumvented.  Someone
could write a program that open()s a file - would the call to open()
fail because the kernel itself is enforcing the security?  [ Note that
'open()' is the low-level call, it's not the function to pop up that
dialog box. ]  Could a user with access to the C compiler write a
'delete' program and expect it to work?

You say that someone with access to the Finder can 'alter anything'.
This would seem to indicate that the protection is done at the
application level rather than the kernel level, and security is much
weaker.  In Unix, I can run /bin/bash (a shell) as myself or as root.
bash itself doesn't enforce the security, it will attempt to carry out
any command it is given - some of which will fail with 'Permission
Denied' if not root.  Similarly if I wanted to run 'xfilemanager' -
the application does not enforce the security, the kernel does.

Apparently this solution you have mentioned deprives unpriviliged
users of access to an important tool, the Finder.  A great loss.  In
Unix, the same programs that root would use for maintenance (such as
bash and xfilemanager) are available to standard users.  If there is
an area of the system that the average user is not meant to explore,
the security is implemented by walling off that area of the filesystem
(make it unreadable) - not by forcing them to use less-capable tools.

>  You can have save privileges to anywhere, your folder, or to
>floppies only.  Also you can have access to all the At Ease menus or the
>restricted set.  Also if you don't have go to finder or open other
>privileges then the only files and programs you have access to are those
>the admin put on your At Ease account or that are in your folder or on
>your floppy.

I see, it requires an admin to set it up.  Of course, several Mac
advocates in this thread pointed out as an advantage that Macs don't
need sysadmins, while Unix boxes typically require more work to set
up [referencing my examples of aliases an admin could set up to make
certain commands more friendly].  On a Unix machine, immediately upon
setting it up, Bob's files are protected from Fred, and vice versa.

>>     You don't need to logout to login as root.
>You don't have to login as anything.  Just supply a password when turning
>protection off.

I usually log in to the Unix machine on my desk after rebooting.  The
session stays open and idle overnight.  If it was in a less secure
environment, then logging out and in would be required - a process
that takes about ten seconds at the beginning of the day, half that
time at the end.  If I want to turn protection off, I type 'su' and
supply another password, very similar to what you have described. 
[ su means Super User ]

What about your personal files?  If you leave the machine unattended,
are they protected from a malicious person that might walk by?  I can
protect mine by logging out (making the machine unuseable to anyone
without a password).  If you're a regular user, how do you protect
your personal files on a multiuser machine?  Putting them on floppies
is a less-than-ideal solution - floppies are slow, small, and prone to
failure. 

>  If you want protection back on then you don't even need
>to supply a password whereas in unix you'd have to login as non-root.

If I had used 'su' to get an shell that ignored file protection,
merely typing 'exit' would restore the protection for that session
(that is, the priviliged program ends, and the unpriviliged program
resumes control).  No need to log in again or supply more passwords.

>> : Why
>> : should someone have to log in to their own computer?  
>>    They shouldn't, if they don't want to.  But there are advantages to
>> identifying users, and assigning ownership of every object to a user.
>If you are on a system shared by many users each with disk space, yes. 
>Other wise it is more trouble than it is worth.

It can be useful even on a single-user system.  I almost never log in
as 'root', to eliminate the possibility of accidentally damaging some
system file.  I created other accounts so as to have the safety of
file protection.  

You could have several environments, with a different username
associated with each.  Logging in as one brings up your regular
environment, logging in as another brings up one that's more
specialized.  For example, I have an account I use for raytracing -
raytrace-related files are stored in its home directory, and those
environmental variables needed by the raytrace program are set in that
account's profile. 

> The whole point
>of Mac OS, DOS, and Windows is that personal computers are relativly cheap
>so everybody can have one and if you need security you can always add it
>on, but if you don't need it then its not there taking up disk or RAM
>space.

I don't think Windows really has a 'point' other than making money for
Bill. :)

Many of the machines with single-user OS's are used by several people,
such as family members.  In an office environment, there's the
possibility of someone walking by your desk when you're not there and
snooping into things.   Do you want your kids or your janitor looking
at your financial records?  

Implementing the security at the kernel level is safer and more robust
than adding on another program. 

As for taking up disk/RAM space - disk space is cheap, and even with
part of RAM being used for security features my Linux box is faster
and multitasks more smoothly than any Mac/Windows machine I've used.



-- 
"NO ONE expects the Spanish Inquisition!"	hucke@cynico.com
Cynico Network Consulting 			http://www.wwa.com/~hucke
info@cynico.com