Re: [9fans] So What is P9 good for.....

["Douglas A. Gwyn" <DAGwyn@null.net>]

Ronald G. Minnich wrote:
> On Fri, 14 Feb 2003, Douglas A. Gwyn wrote:
>>The use of set-UID-0 *applications* on Unix was extremely
>>short-sighted.
> Hey, it was worth a patent. ...

Perhaps you missed the point I was making.  The
capability of executing a process with enhanced
privilege was fine, but should have been used
only to implement an access control layer or
service, not to elevate every operation in a
high-level application to superuser privilege.
At BRL we spent many man-months fixing security
holes in Research Unix but even more for BSD,
where evidently the quickest implementation was
usually the one chosen, without much regard for
security ramifications.  That would have been
adequate for a single trusted error-free user,
but not in a networked timesharing environment.
CERT still receives security problem reports for
bind, sendmail, etc., and many of them can be
directly attributed to a set-UID process having
at some point during execution more privilege
than it needs to perform its intended function.

It's experiences like that that make me a big
fan of capability-based systems architecture.