From: burley@geech.gnu.ai.mit.edu (Craig Burley)
Newsgroups: comp.unix.pc-clone.32bit
Subject: Re: Ownership of files prevent Viruses
Date: 2 Oct 92 19:44:26 GMT
	<BCR.92Sep26113735@hpl3sn02.cern.ch>
	<1992Sep27.112655.3832@darwin.ntu.edu.au>
	<BURLEY.92Sep27193140@geech.gnu.ai.mit.edu>
	<KETIL.92Sep29133153@spurv.ii.uib.no>
Organization: Free Software Foundation 545 Tech Square Cambridge, MA 02139
In-reply-to: ketil@spurv.ii.uib.no's message of 29 Sep 92 20:31:53 GMT


      The problem to solve here is to have a system set up so that even unusual
      (demanding) apps require little or no special capabilities beyond what the
      user has, and when they do, are permitted only those capabilities (say,
      during install) that the user explicitly provides given the documentation.
      It's more complicated than this, of course, and there are other problems
      to deal with, but this is a big part of it.

   Is it?  I (and other students without special privileges) have
   installed lots of software here with little problems.  I don't see why
   you should need to be root to install anything but system software...I
   think.

Yes, but you're talking about UNIX, aren't you?  The topic is whether
simply adding file ownership to DOS will solve problems with viruses.
(Also, I wonder -- have you ever installed an X server without logging
in as root?  How many PC UNIX users would be likely to want to install
X given the opportunity (and adequate hardware)?  Now consider that the
reason X wants to be installed as root, at least as I understand it,
is to map video memory, and that the same reasoning applies to almost
every useful and popular WYSIWYG app out there -- they'll _all_ want
to be installed as root.)

From what I've been able to tell, a significant percentage of DOS apps
have installers that assume they can change system-configuration parameters
(CONFIG.SYS or AUTOEXEC.BAT) and many other things.  _All_ of those programs
will need to have instructions saying "login as root" (or whatever it'd
be called uner a file-owning DOS) to continue working.  Else, _any_
program (virus or otherwise) could rewrite them to do their nasty business.

Remember, UNIX is designed to offer each user a fairly secure environment
in the form of a set of processes, and somewhat protect the kernel by
requiring that most or all system-affecting things go through the kernel
in a manner which can be checked by the kernel for legitimacy.  This is
the complete opposite of the overall design of DOS, which seems to be
this: use the kernel call if you can get away with it, otherwise do
direct BIOS calls or twiddle memory yourself if you need the speed/power.

Realize that without running DOS apps in 386 protected mode, even file
ownership wouldn't help against viruses (which would, and probably already
do, just make BIOS calls, circumventing DOS entirely).  Running in
protected mode would introduce so many problems requiring solutions
like "install this app while logged in as root", and probably many
requiring "run this app as root" (or the equivalent of UNIX's setting
the owner id for the executable to root) as well, to do things like access
video RAM and other low-level I/O facilities for maximum (or even
acceptable -- we're talking DOS here :-) speed.

And in this environment, very few users would ever be able to install
useful applications on their system without at some point being told they
had to do something as root.  And in _that_ environment, viruses and such
things are still easy to write.

Ultimately, the point I'm making is this:

    Ownership of files _is one aspect_ of preventing viruses

There are several other important things to do.  Without most or all of them
in place, none of them are of much use in preventing viruses (though
certainly helpful in other contexts).
--

James Craig Burley, Software Craftsperson    burley@gnu.ai.mit.edu
Member of the League for Programming Freedom (LPF)
Newsgroups: comp.unix.pc-clone.32bit