RE: Trusted Unices Aren't?

[ICMan <shane_mason () securecomputing com>]

> > B1 and below do not require breaking up root.  B2 and above do.  It 
really
> > has nothing to do with the MLS model.  I believe that CMW+ *does* break 
up
> > root, but I'm not sure of that.  It may also be a configuration option.
>
> "breaking up root" in kernel is useless if you keep running utilities
> and daemons suid root..

That really depends on how root is broken up.  If a separate protection 
mechanism is built into the kernel and all environments, then processes can 
be segregated.  Even system calls can have attributes attached to them. 
 This is a lot of work, but it can certainly be done.

Read "Type Enforcement for Firewalls" at 
http://www.securecomputing.com/TE_WP.pdf

It's not a terribly technical document, but it explains the structure of a 
protection mechanism that restricts the privileges of the root user.  root 
is still root, but can only effect portions of the system at a time, and 
other portions of the system are still unavailable for root to access.

ICMan