From owner-freebsd-security Mon Sep 20 8:35:39 1999 Delivered-To: freebsd-security@freebsd.org Received: from gndrsh.dnsmgr.net (GndRsh.dnsmgr.net [198.145.92.4]) by hub.freebsd.org (Postfix) with ESMTP id C04AD15314 for ; Mon, 20 Sep 1999 08:35:34 -0700 (PDT) (envelope-from freebsd@gndrsh.dnsmgr.net) Received: (from freebsd@localhost) by gndrsh.dnsmgr.net (8.9.3/8.9.3) id IAA59102; Mon, 20 Sep 1999 08:34:00 -0700 (PDT) (envelope-from freebsd) From: "Rodney W. Grimes" Message-Id: <199909201534.IAA59102@gndrsh.dnsmgr.net> Subject: Re: Real-time alarms In-Reply-To: <199909201507.PAA30804@loki.ideaglobal.com> from Kiril Mitev at "Sep 20, 1999 03:07:41 pm" To: kiril@ideaglobal.com (Kiril Mitev) Date: Mon, 20 Sep 1999 08:34:00 -0700 (PDT) Cc: ark@eltex.ru, security@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL54 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > Ouch. > > do you REALLY suggest things along the lines > > set proc/priv=(... , .... , .... ) Yes, at least the functionality, we don't have to use the VMS DCL interface to it. set proc/priv= just flips bits in the process header area. You have a better idea?? > > > > > > Hmmm, i think it is a good idea to have 2 kernel interfaces: > > > > > > 1) audit - one way communication system that lets kernel and possibly > > > some user processes to inform an audit daemon or whatever that something > > > important happened > > > > By definision a secure audit trail can only be generated by a secure > > code base, that pretty much precludes any user processes from being > > a source of data at this time. > > > > > 2) acl device that will provide 2-way communication to a daemon that will > > > allow or deny things to happen? > > > > This is no longer auditing, that would be under another thread, one about > > security control, and goes hand in hand with the proposal I tossed out > > about VMS like per process priviledges. > > -- Rod Grimes - KD7CAX - (RWG25) rgrimes@gndrsh.dnsmgr.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message