From: ochealth@unixg.ubc.ca (ochealth)
Subject: OS/2 Needs a Supervisor mode!
Organization: University of British Columbia, Vancouver, B.C., Canada
Date: Sun, 16 Aug 1992 00:18:19 GMT


Well, some people have complained about OS/2 not having multiuser capabilities
out of the box, but I think IBM should include a "Supervisor" or "root"
mode, and a "User" mode as a bare minimum. A "restricted" mode would also
be nice.

Right now, it is easy for a Trojan Horse program to destroy a system;
it is easy for a buggy program or a novice user to cripple the system.
I can also think of a conceivable, albeit difficult way for a virus to spread.

Right now, any program can modify the Config.sys file. It would be better
to require a password supervisor mode to edit config.sys, delete/change
dll and other drivers etc.

When kernel patches came out, all you had to do was change the file
mode of the kernel, rename it, then copy over the new one. Then reboot
for changes to take effect. So there's nothing to stop another program
from patching the kernel, or maliciously deleteing it. At a minimum, the
kernel should lock its disk file, when it is runnig (this would require
booting from a floppy to change it).

Conceivable virus: an infected program could patch the kernel with its code.
After a reboot, executable files could be infected by storing the 
virus at the start of
the program. To cover its tracks, it could move the original code into
EAs, and the program would look the same size in a DIR listing. Since
most people don't know what's stored in EAs, they wouldn't notice EAs
growing by a few Kb. It could spread by modifying programs on floppies
(since OS/2 floppies retain EAs).

If OS/2 provided some more protection by locking ALL system files (.sys, .dll,
 etc) then this would enhance security.  It would be pretty simple for
IBM to change the kernel to lock all the right files. This would then require
rebooting from the installation disks to make changes. If IBM wanted to make
things nicer, they could add a password protected Supervisor mode, which
would let you change any of those files, and let you edit Config.sys.

Restricted mode: right now there's no ownership of files, and permissions
for deleting, viewing, etc. Adding all of those would be a major task, but
what if IBM let you tag a program as "restricted" or "test" so it could
only read/write/delete files in a certain directory. I don't think this would
be as difficult as adding full ownership and priveleges, as in UNIX.
This would let you test freeware/shareware, or unscrupulous Microsoft programs
(ie Windows, Excel, Word) that "update" things without your consent or knowledge

I'm thinking of writing a program that might prevent accidental modification
of files: all I'd have to do is open all the files I want to protect,
and with the proper sharing options, OS/2 would automatically prevent
other programs deleting or modifying the files. Unfortunately, a malicious
program could simply kill mine, and then do as it pleased. If the kernel
took care of this, then no program could bypass it.

(A lot of DLLs and drivers
can't be changed anyway, since some part of the system is using them.
Some files aren't used all the time, so they remain unprotected.)

This could actually be a selling point! A few *modest* changes would make
OS/2 more secure: great for paranoid companies/governments. Many (all?)
PS/2s and a lot of newer machines have a CMOS boot password, OS/2
could add a deeper level of computer security.


-- 
______________________________________________________________________________
jpm: ochealth@unixg.ubc.ca         
                            Happily using OS/2 2.0 because MS Windows isNT ___
                                                      Insert VapourFeature ^^^
Newsgroups: comp.os.os2.misc