1997-ns97.ps

%!PS-Adobe-3.0
%%Title: (setuid.ppt)
%%Creator: (Microsoft PowerPoint: PSPrinter 8.1.1)
%%CreationDate: (11:19 AM Sunday, November 30, 1997)
%%For: (Matt Bishop)
%%Pages: 37
%%DocumentFonts: Helvetica Helvetica-Oblique Helvetica-Bold Helvetica-BoldOblique MonotypeSorts Courier Courier-Oblique Palatino-Roman
%%DocumentNeededFonts: Helvetica Helvetica-Oblique Helvetica-Bold Helvetica-BoldOblique MonotypeSorts Courier Courier-Oblique Palatino-Roman
%%DocumentSuppliedFonts:
%%DocumentData: Clean7Bit
%%PageOrder: Ascend
%%Orientation: Portrait
%ADO_PaperArea: -50 -50 3250 2500
%ADO_ImageableArea: 0 0 3200 2450
%%EndComments
/md 218 dict def md begin
/currentpacking where {pop /sc_oldpacking currentpacking def true setpacking}if
%%BeginFile: adobe_psp_basic
%%Copyright: Copyright 1990-1993 Adobe Systems Incorporated. All Rights Reserved.
/bd{bind def}bind def
/xdf{exch def}bd
/xs{exch store}bd
/ld{load def}bd
/Z{0 def}bd
/T/true
/F/false
/:L/lineto
/lw/setlinewidth
/:M/moveto
/rl/rlineto
/rm/rmoveto
/:C/curveto
/:T/translate
/:K/closepath
/:mf/makefont
/gS/gsave
/gR/grestore
/np/newpath
14{ld}repeat
/$m matrix def
/av 81 def
/por true def
/normland false def
/psb-nosave{}bd
/pse-nosave{}bd
/us Z
/psb{/us save store}bd
/pse{us restore}bd
/level2
/languagelevel where
{
pop languagelevel 2 ge
}{
false
}ifelse
def
/featurecleanup
{
stopped
cleartomark
countdictstack exch sub dup 0 gt
{
{end}repeat
}{
pop
}ifelse
}bd
/noload Z
/startnoload
{
{/noload save store}if
}bd
/endnoload
{
{noload restore}if
}bd
level2 startnoload
/setjob
{
statusdict/jobname 3 -1 roll put
}bd
/setcopies
{
userdict/#copies 3 -1 roll put
}bd
level2 endnoload level2 not startnoload
/setjob
{
1 dict begin/JobName xdf currentdict end setuserparams
}bd
/setcopies
{
1 dict begin/NumCopies xdf currentdict end setpagedevice
}bd
level2 not endnoload
/pm Z
/mT Z
/sD Z
/realshowpage Z
/initializepage
{
/pm save store mT concat
}bd
/endp
{
pm restore showpage
}def
/$c/DeviceRGB def
/rectclip where
{
pop/rC/rectclip ld
}{
/rC
{
np 4 2 roll
:M
1 index 0 rl
0 exch rl
neg 0 rl
:K
clip np
}bd
}ifelse
/rectfill where
{
pop/rF/rectfill ld
}{
/rF
{
gS
np
4 2 roll
:M
1 index 0 rl
0 exch rl
neg 0 rl
fill
gR
}bd
}ifelse
/rectstroke where
{
pop/rS/rectstroke ld
}{
/rS
{
gS
np
4 2 roll
:M
1 index 0 rl
0 exch rl
neg 0 rl
:K
stroke
gR
}bd
}ifelse
%%EndFile
level2 startnoload
%%BeginFile: adobe_psp_colorspace_level1
%%Copyright: Copyright 1991-1993 Adobe Systems Incorporated. All Rights Reserved.
/G/setgray ld
/:F/setrgbcolor ld
%%EndFile
level2  endnoload level2 not startnoload
%%BeginFile: adobe_psp_colorspace_level2
%%Copyright: Copyright 1991-1993 Adobe Systems Incorporated. All Rights Reserved.
/G
{
dup dup setcolor
}bd
/setcolor where
{pop/:F/setcolor ld}if
/initializepage
{
/pm save store mT concat
$c setcolorspace
}bd
%%EndFile
level2 not endnoload
%%BeginFile: adobe_psp_uniform_graphics
%%Copyright: Copyright 1990-1993 Adobe Systems Incorporated. All Rights Reserved.
/@a
{
np :M 0 rl :L 0 exch rl 0 rl :L fill
}bd
/@b
{
np :M 0 rl 0 exch rl :L 0 rl 0 exch rl fill
}bd
/arct where
{
pop
}{
/arct
{
arcto pop pop pop pop
}bd
}ifelse
/x1 Z
/x2 Z
/y1 Z
/y2 Z
/rad Z
/@q
{
/rad xs
/y2 xs
/x2 xs
/y1 xs
/x1 xs
np
x2 x1 add 2 div y1 :M
x2 y1 x2 y2 rad arct
x2 y2 x1 y2 rad arct
x1 y2 x1 y1 rad arct
x1 y1 x2 y1 rad arct
fill
}bd
/@s
{
/rad xs
/y2 xs
/x2 xs
/y1 xs
/x1 xs
np
x2 x1 add 2 div y1 :M
x2 y1 x2 y2 rad arct
x2 y2 x1 y2 rad arct
x1 y2 x1 y1 rad arct
x1 y1 x2 y1 rad arct
:K
stroke
}bd
/@i
{
np 0 360 arc fill
}bd
/@j
{
gS
np
:T
scale
0 0 .5 0 360 arc
fill
gR
}bd
/@e
{
np
0 360 arc
:K
stroke
}bd
/@f
{
np
$m currentmatrix
pop
:T
scale
0 0 .5 0 360 arc
:K
$m setmatrix
stroke
}bd
/@k
{
gS
np
:T
0 0 :M
0 0 5 2 roll
arc fill
gR
}bd
/@l
{
gS
np
:T
0 0 :M
scale
0 0 .5 5 -2 roll arc
fill
gR
}bd
/@m
{
np
arc
stroke
}bd
/@n
{
np
$m currentmatrix
pop
:T
scale
0 0 .5 5 -2 roll arc
$m setmatrix
stroke
}bd
%%EndFile
%%BeginFile: adobe_psp_customps
%%Copyright: Copyright 1990-1993 Adobe Systems Incorporated. All Rights Reserved.
/$t Z
/$p Z
/$s Z
/$o 1. def
/2state? false def
/ps Z
level2 startnoload
/pushcolor/currentrgbcolor ld
/popcolor/setrgbcolor ld
/setcmykcolor where
{
pop/currentcmykcolor where
{
pop/pushcolor/currentcmykcolor ld
/popcolor/setcmykcolor ld
}if
}if
level2 endnoload level2 not startnoload
/pushcolor
{
currentcolorspace $c eq
{
currentcolor currentcolorspace true
}{
currentcmykcolor false
}ifelse
}bd
/popcolor
{
{
setcolorspace setcolor
}{
setcmykcolor
}ifelse
}bd
level2 not endnoload
/pushstatic
{
ps
2state?
$o
$t
$p
$s
}bd
/popstatic
{
/$s xs
/$p xs
/$t xs
/$o xs
/2state? xs
/ps xs
}bd
/pushgstate
{
save errordict/nocurrentpoint{pop 0 0}put
currentpoint
3 -1 roll restore
pushcolor
currentlinewidth
currentlinecap
currentlinejoin
currentdash exch aload length
np clippath pathbbox
$m currentmatrix aload pop
}bd
/popgstate
{
$m astore setmatrix
2 index sub exch
3 index sub exch
rC
array astore exch setdash
setlinejoin
setlinecap
lw
popcolor
np :M
}bd
/bu
{
pushgstate
gR
pushgstate
2state?
{
gR
pushgstate
}if
pushstatic
pm restore
mT concat
}bd
/bn
{
/pm save store
popstatic
popgstate
gS
popgstate
2state?
{
gS
popgstate
}if
}bd
/cpat{pop 64 div G 8{pop}repeat}bd
%%EndFile
%%BeginFile: adobe_psp_basic_text
%%Copyright: Copyright 1990-1993 Adobe Systems Incorporated. All Rights Reserved.
/S/show ld
/A{
0.0 exch ashow
}bd
/R{
0.0 exch 32 exch widthshow
}bd
/W{
0.0 3 1 roll widthshow
}bd
/J{
0.0 32 4 2 roll 0.0 exch awidthshow
}bd
/V{
0.0 4 1 roll 0.0 exch awidthshow
}bd
/fcflg true def
/fc{
fcflg{
vmstatus exch sub 50000 lt{
(%%[ Warning: Running out of memory ]%%\r)print flush/fcflg false store
}if pop
}if
}bd
/$f[1 0 0 -1 0 0]def
/:ff{$f :mf}bd
/MacEncoding StandardEncoding 256 array copy def
MacEncoding 39/quotesingle put
MacEncoding 96/grave put
/Adieresis/Aring/Ccedilla/Eacute/Ntilde/Odieresis/Udieresis/aacute
/agrave/acircumflex/adieresis/atilde/aring/ccedilla/eacute/egrave
/ecircumflex/edieresis/iacute/igrave/icircumflex/idieresis/ntilde/oacute
/ograve/ocircumflex/odieresis/otilde/uacute/ugrave/ucircumflex/udieresis
/dagger/degree/cent/sterling/section/bullet/paragraph/germandbls
/registered/copyright/trademark/acute/dieresis/notequal/AE/Oslash
/infinity/plusminus/lessequal/greaterequal/yen/mu/partialdiff/summation
/product/pi/integral/ordfeminine/ordmasculine/Omega/ae/oslash
/questiondown/exclamdown/logicalnot/radical/florin/approxequal/Delta/guillemotleft
/guillemotright/ellipsis/space/Agrave/Atilde/Otilde/OE/oe
/endash/emdash/quotedblleft/quotedblright/quoteleft/quoteright/divide/lozenge
/ydieresis/Ydieresis/fraction/currency/guilsinglleft/guilsinglright/fi/fl
/daggerdbl/periodcentered/quotesinglbase/quotedblbase/perthousand
/Acircumflex/Ecircumflex/Aacute/Edieresis/Egrave/Iacute/Icircumflex/Idieresis/Igrave
/Oacute/Ocircumflex/apple/Ograve/Uacute/Ucircumflex/Ugrave/dotlessi/circumflex/tilde
/macron/breve/dotaccent/ring/cedilla/hungarumlaut/ogonek/caron
MacEncoding 128 128 getinterval astore pop
level2 startnoload
/copyfontdict
{
findfont dup length dict
begin
{
1 index/FID ne{def}{pop pop}ifelse
}forall
}bd
level2 endnoload level2 not startnoload
/copyfontdict
{
findfont dup length dict
copy
begin
}bd
level2 not endnoload
md/fontname known not{
/fontname/customfont def
}if
/Encoding Z
/:mre
{
copyfontdict
/Encoding MacEncoding def
fontname currentdict
end
definefont :ff def
}bd
/:bsr
{
copyfontdict
/Encoding Encoding 256 array copy def
Encoding dup
}bd
/pd{put dup}bd
/:esr
{
pop pop
fontname currentdict
end
definefont :ff def
}bd
/scf
{
scalefont def
}bd
/scf-non
{
$m scale :mf setfont
}bd
/ps Z
/fz{/ps xs}bd
/sf/setfont ld
/cF/currentfont ld
/mbf
{
/makeblendedfont where
{
pop
makeblendedfont
/ABlend exch definefont
}{
pop
}ifelse
def
}def
%%EndFile
%%BeginFile: adobe_psp_derived_styles
%%Copyright: Copyright 1990-1993 Adobe Systems Incorporated. All Rights Reserved.
/wi
version(23.0)eq
{
{
gS 0 0 0 0 rC stringwidth gR
}bind
}{
/stringwidth load
}ifelse
def
/$o 1. def
/gl{$o G}bd
/ms{:M S}bd
/condensedmtx[.82 0 0 1 0 0]def
/:mc
{
condensedmtx :mf def
}bd
/extendedmtx[1.18 0 0 1 0 0]def
/:me
{
extendedmtx :mf def
}bd
/basefont Z
/basefonto Z
/dxa Z
/dxb Z
/dxc Z
/dxd Z
/dsdx2 Z
/bfproc Z
/:fbase
{
dup/FontType get 0 eq{
dup length dict begin
dup{1 index/FID ne 2 index/UniqueID ne and{def}{pop pop}ifelse}forall
/FDepVector exch/FDepVector get[exch/:fbase load forall]def
}/bfproc load ifelse
/customfont currentdict end definefont
}bd
/:mo
{
/bfproc{
dup dup length 2 add dict
begin
{
1 index/FID ne 2 index/UniqueID ne and{def}{pop pop}ifelse
}forall
/PaintType 2 def
/StrokeWidth .012 0 FontMatrix idtransform pop def
/customfont currentdict
end
definefont
8 dict begin
/basefonto xdf
/basefont xdf
/FontType 3 def
/FontMatrix[1 0 0 1 0 0]def
/FontBBox[0 0 1 1]def
/Encoding StandardEncoding def
/BuildChar
{
exch begin
basefont setfont
( )dup 0 4 -1 roll put
dup wi
setcharwidth
0 0 :M
gS
gl
dup show
gR
basefonto setfont
show
end
}def
}store :fbase
}bd
/:mso
{
/bfproc{
7 dict begin
/basefont xdf
/FontType 3 def
/FontMatrix[1 0 0 1 0 0]def
/FontBBox[0 0 1 1]def
/Encoding StandardEncoding def
/BuildChar
{
exch begin
sD begin
/dxa 1 ps div def
basefont setfont
( )dup 0 4 -1 roll put
dup wi
1 index 0 ne
{
exch dxa add exch
}if
setcharwidth
dup 0 0 ms
dup dxa 0 ms
dup dxa dxa ms
dup 0 dxa ms
gl
dxa 2. div dup ms
end
end
}def
}store :fbase
}bd
/:ms
{
/bfproc{
dup dup length 2 add dict
begin
{
1 index/FID ne 2 index/UniqueID ne and{def}{pop pop}ifelse
}forall
/PaintType 2 def
/StrokeWidth .012 0 FontMatrix idtransform pop def
/customfont currentdict
end
definefont
8 dict begin
/basefonto xdf
/basefont xdf
/FontType 3 def
/FontMatrix[1 0 0 1 0 0]def
/FontBBox[0 0 1 1]def
/Encoding StandardEncoding def
/BuildChar
{
exch begin
sD begin
/dxb .05 def
basefont setfont
( )dup 0 4 -1 roll put
dup wi
exch dup 0 ne
{
dxb add
}if
exch setcharwidth
dup dxb .01 add 0 ms
0 dxb :T
gS
gl
dup 0 0 ms
gR
basefonto setfont
0 0 ms
end
end
}def
}store :fbase
}bd
/:mss
{
/bfproc{
7 dict begin
/basefont xdf
/FontType 3 def
/FontMatrix[1 0 0 1 0 0]def
/FontBBox[0 0 1 1]def
/Encoding StandardEncoding def
/BuildChar
{
exch begin
sD begin
/dxc 1 ps div def
/dsdx2 .05 dxc 2 div add def
basefont setfont
( )dup 0 4 -1 roll put
dup wi
exch dup 0 ne
{
dsdx2 add
}if
exch setcharwidth
dup dsdx2 .01 add 0 ms
0 .05 dxc 2 div sub :T
dup 0 0 ms
dup dxc 0 ms
dup dxc dxc ms
dup 0 dxc ms
gl
dxc 2 div dup ms
end
end
}def
}store :fbase
}bd
/:msb
{
/bfproc{
7 dict begin
/basefont xdf
/FontType 3 def
/FontMatrix[1 0 0 1 0 0]def
/FontBBox[0 0 1 1]def
/Encoding StandardEncoding def
/BuildChar
{
exch begin
sD begin
/dxd .03 def
basefont setfont
( )dup 0 4 -1 roll put
dup wi
1 index 0 ne
{
exch dxd add exch
}if
setcharwidth
dup 0 0 ms
dup dxd 0 ms
dup dxd dxd ms
0 dxd ms
end
end
}def
}store :fbase
}bd
/italicmtx[1 0 -.212557 1 0 0]def
/:mi
{
italicmtx :mf def
}bd
/:v
{
[exch dup/FontMatrix get exch
dup/FontInfo known
{
/FontInfo get
dup/UnderlinePosition known
{
dup/UnderlinePosition get
2 index 0
3 1 roll
transform
exch pop
}{
.1
}ifelse
3 1 roll
dup/UnderlineThickness known
{
/UnderlineThickness get
exch 0 3 1 roll
transform
exch pop
abs
}{
pop pop .067
}ifelse
}{
pop pop .1 .067
}ifelse
]
}bd
/$t Z
/$p Z
/$s Z
/:p
{
aload pop
2 index mul/$t xs
1 index mul/$p xs
.012 mul/$s xs
}bd
/:m
{gS
0 $p rm
$t lw
0 rl stroke
gR
}bd
/:n
{
gS
0 $p rm
$t lw
0 rl
gS
gl
stroke
gR
strokepath
$s lw
/setstrokeadjust where{pop
currentstrokeadjust true setstrokeadjust stroke setstrokeadjust
}{
stroke
}ifelse
gR
}bd
/:o
{gS
0 $p rm
$t 2 div dup rm
$t lw
dup 0 rl
stroke
gR
:n
}bd
%%EndFile
/currentpacking where {pop sc_oldpacking setpacking}if
end		% md
%%EndProlog
%%BeginSetup
md begin
/$c[/CIEBasedABC 3 dict dup begin
/WhitePoint[.95 1 1.406]def
/MatrixABC[.381 .207 .021 .32 .68 .143 .248 .112 1.242]def
/DecodeABC[{51 mul{0 .001 .003 .006 .01 .015 .021 .028 .036 .044
.054 .064 .074 .086 .098 .111 .125 .139 .154 .17
.186 .203 .221 .239 .258 .278 .298 .319 .34 .363
.385 .409 .433 .457 .483 .508 .535 .562 .589 .617
.646 .676 .705 .736 .767 .799 .831 .863 .897 .931
.965 1}exch dup dup cvi sub dup 0 eq{pop cvi get}{exch cvi 3 -1 roll dup 2 index get 4 1 roll exch 1 add get 2 index sub mul
add}ifelse}{51 mul{0 .001 .003 .006 .01 .015 .021 .028 .036 .044
.054 .064 .074 .086 .098 .111 .125 .139 .154 .17
.186 .203 .221 .239 .258 .278 .298 .319 .34 .363
.385 .409 .433 .457 .483 .508 .535 .562 .589 .617
.646 .676 .705 .736 .767 .799 .831 .863 .897 .931
.965 1}exch dup dup cvi sub dup 0 eq{pop cvi get}{exch cvi 3 -1 roll dup 2 index get 4 1 roll exch 1 add get 2 index sub mul
add}ifelse}{51 mul{0 .001 .003 .006 .01 .015 .021 .028 .036 .044
.054 .064 .074 .086 .098 .111 .125 .139 .154 .17
.186 .203 .221 .239 .258 .278 .298 .319 .34 .363
.385 .409 .433 .457 .483 .508 .535 .562 .589 .617
.646 .676 .705 .736 .767 .799 .831 .863 .897 .931
.965 1}exch dup dup cvi sub dup 0 eq{pop cvi get}{exch cvi 3 -1 roll dup 2 index get 4 1 roll exch 1 add get 2 index sub mul
add}ifelse}]def
end]def
countdictstack
[
{%stopped
%%BeginFeature: *ManualFeed False

	<</ManualFeed false>> setpagedevice
%%EndFeature
}featurecleanup
countdictstack
[
{%stopped
%%BeginFeature: *PageSize Letter

	<</DeferredMediaSelection true /PageSize [612 792] /ImagingBBox null>> setpagedevice
%%EndFeature
}featurecleanup
(Matt Bishop)setjob
/pT[1 0 0 -1 12 779.968]def/mT[.24 0 0 -.24 12 779.968]def
/sD 16 dict def
300 level2{1 dict dup/WaitTimeout 4 -1 roll put setuserparams}{statusdict/waittimeout 3 -1 roll put}ifelse
%%IncludeFont: Helvetica
%%IncludeFont: Helvetica-Oblique
%%IncludeFont: Helvetica-Bold
%%IncludeFont: Helvetica-BoldOblique
%%IncludeFont: MonotypeSorts
%%IncludeFont: Courier
%%IncludeFont: Courier-Oblique
%%IncludeFont: Palatino-Roman
/f0_1/Helvetica :mre
/f0_288 f0_1 288 scf
/f0_192 f0_1 192 scf
/f0_160 f0_1 160 scf
/f0_128 f0_1 128 scf
/f0_112 f0_1 112 scf
/f0_96 f0_1 96 scf
/f0_72 f0_1 72 scf
/f0_24 f0_1 24 scf
/f0_18 f0_1 18 scf
/f2_1/Helvetica-Oblique :mre
/f2_288 f2_1 288 scf
/f2_192 f2_1 192 scf
/f2_160 f2_1 160 scf
/f2_96 f2_1 96 scf
/f2_24 f2_1 24 scf
/f2_18 f2_1 18 scf
/f3_1/Helvetica-Bold :mre
/f3_192 f3_1 192 scf
/f3_160 f3_1 160 scf
/f3_96 f3_1 96 scf
/f3_18 f3_1 18 scf
/f6_1/Helvetica-BoldOblique :mre
/f6_192 f6_1 192 scf
/f6_160 f6_1 160 scf
/f7_1/MonotypeSorts findfont :ff def /f7_144 f7_1 144 scf
/f8_1/Courier :mre
/f8_192 f8_1 192 scf
/f8_160 f8_1 160 scf
/f8_144 f8_1 144 scf
/f8_96 f8_1 96 scf
/f10_1/Courier-Oblique :mre
/f10_160 f10_1 160 scf
/f10_96 f10_1 96 scf
/f11_1/Palatino-Roman :mre
/f11_192 f11_1 192 scf
/f11_96 f11_1 96 scf
/Courier findfont[10 0 0 -10 0 0]:mf setfont
%%EndSetup
%%Page: 1 1
%%BeginPageSetup
initializepage
(Matt Bishop; page: 1 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
4005.276 5838.777 :M
0 G
f0_128 sf
-.113(Page 1)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
-.017(Why is this hard? A few reasons:)A
825.632 3192.991 :M
(\245)S
936.997 3192.991 :M
-.01(a "bug" here can endanger the system)A
825.632 3342.753 :M
(\245)S
936.997 3342.753 :M
(programs interact with system, environment, one another in )S
936.997 3457.954 :M
(sometimes  unexpected ways)S
825.632 3607.715 :M
(\245)S
936.997 3607.715 :M
(assumptions which are true or irrelevant for regular programs aren't )S
936.997 3722.916 :M
-.053(for these)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
-.087(Slide # 1)A
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2814.83 2025.771 :M
f0_288 sf
(Writing Safe Setuid Programs)S
4204.964 2725.512 :M
f0_192 sf
-.053(Matt Bishop)A
3287.168 3278.346 :M
(Department of Computer Science)S
3379.332 3556.697 :M
(University of California at Davis)S
3721.105 3831.181 :M
(Davis, CA  95616-8562)S
3763.347 4384.015 :M
(phone \(530\) 752-8060)S
3440.774 4658.499 :M
(email bishop@cs.ucdavis.edu)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 2 2
%%BeginPageSetup
initializepage
(Matt Bishop; page: 2 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
4005.276 5838.777 :M
0 G
f0_128 sf
-.113(Page 2)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Key concepts:)S
825.632 3181.471 :M
f2_96 sf
-.041(privilege)A
1401.655 3181.471 :M
f0_96 sf
(running with rights other than those obtained by logging )S
1009.959 3296.672 :M
-.02(in; or running as superuser)A
825.632 3434.914 :M
f2_96 sf
(protection domain)S
1009.959 3571.235 :M
f0_96 sf
(all objects to which the process has access, and the type of access )S
1009.959 3686.436 :M
-.038(the process has)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
-.087(Slide # 2)A
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
(\245)S
2538.339 2725.512 :M
-.008(a change of privilege)A
2611.302 2965.202 :M
f2_160 sf
-.009(example:)A
f0_160 sf
-.008( setuid programs)A
2323.291 3231.955 :M
f0_192 sf
(\245)S
2538.339 3231.955 :M
(an assumption of atomicity of some )S
2538.339 3463.913 :M
-.029(functions)A
2611.302 3703.604 :M
f2_160 sf
(example:)S
f0_160 sf
( check of access permission and opening of a file)S
2323.291 3970.356 :M
f0_192 sf
(\245)S
2538.339 3970.356 :M
-.013(a trust of environment)A
2611.302 4206.18 :M
f2_160 sf
(example:)S
f0_160 sf
( programs which assume they are loaded as compiled)S
3049.079 1677.833 :M
f0_288 sf
(What Do These Programs )S
4178.083 2025.771 :M
-.049(Involve?)A
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 3 3
%%BeginPageSetup
initializepage
(Matt Bishop; page: 3 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
4005.276 5838.777 :M
0 G
f0_128 sf
-.113(Page 3)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(These are from Saltzer and Schroeder:)S
825.632 3192.991 :M
-.017(least privilege: need-to-know)A
825.632 3342.753 :M
-.002(fail-safe defaults by default, deny)A
825.632 3492.514 :M
(economy of mechanism: KISS principle)S
825.632 3642.276 :M
(complete mediation: check every access to an object)S
825.632 3793.957 :M
(open design: don\325t depend on secrecy of design giving additional )S
973.478 3907.238 :M
-.094(security)A
825.632 4058.92 :M
(separation of privilege: make access dependent on multiple conditions, )S
973.478 4172.201 :M
-.018(not just one)A
825.632 4323.882 :M
(least common mechanism: minimize sharing)S
825.632 4473.644 :M
(psychological acceptability: security mechanisms shoud be as easy to )S
973.478 4588.845 :M
(use as not to use; difficult ideal to approach, so come as close as )S
973.478 4702.126 :M
-.011(possible)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
-.087(Slide # 3)A
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
3041.399 2025.771 :M
f0_288 sf
(Security Design Principles)S
2323.291 2725.512 :M
f0_192 sf
(Control design of all security-related programs)S
2323.291 3003.862 :M
f7_144 sf
(l)S
2538.339 3003.862 :M
f0_192 sf
(principle of least privilege)S
2323.291 3278.346 :M
f7_144 sf
(l)S
2538.339 3278.346 :M
f0_192 sf
(principle of fail-safe defaults)S
2323.291 3556.697 :M
f7_144 sf
(l)S
2538.339 3556.697 :M
f0_192 sf
(principle of economy of mechanism)S
2323.291 3831.181 :M
f7_144 sf
(l)S
2538.339 3831.181 :M
f0_192 sf
(principle of complete mediation)S
2323.291 4105.665 :M
f7_144 sf
(l)S
2538.339 4105.665 :M
f0_192 sf
(principle of open design)S
2323.291 4384.015 :M
f7_144 sf
(l)S
2538.339 4384.015 :M
f0_192 sf
(principle of separation of privilege)S
2323.291 4658.499 :M
f7_144 sf
(l)S
2538.339 4658.499 :M
f0_192 sf
(principle of least common mechanism)S
2323.291 4936.849 :M
f7_144 sf
(l)S
2538.339 4936.849 :M
f0_192 sf
(principle of psychological acceptability)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 4 4
%%BeginPageSetup
initializepage
(Matt Bishop; page: 4 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
4005.276 5838.777 :M
0 G
f0_128 sf
-.113(Page 4)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Warnings:)S
825.632 3192.991 :M
(getaudit\(\), getlogin\(\) common for audit/login ID, but be sure getlogin is )S
825.632 3308.192 :M
-.014(the right one!)A
825.632 3457.954 :M
(Some systems do not allow direct access to the saved UID or GID)S
825.632 3607.715 :M
(Setting the UID sets the effective UID unless it\325s root; both real and )S
825.632 3722.916 :M
(effective UID are set. You can use separate system calls to change )S
825.632 3838.117 :M
-.116(either.)A
825.632 3987.879 :M
(When getting information about user or group, the getpwuid, etc. )S
825.632 4103.08 :M
(functions return the first matching entry in the passwd or group )S
825.632 4218.281 :M
(databases. This may or may not be what you want.)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
-.087(Slide # 4)A
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
3544.458 2025.771 :M
f0_288 sf
(Users and Groups)S
2323.291 2725.512 :M
f0_192 sf
(Real UID, GID:)S
4051.358 2725.512 :M
(UID, GID of user running program)S
2323.291 3003.862 :M
-.022(Effective UID, GID:)A
4051.358 3003.862 :M
(UID, GID of user with whose )S
4055.198 3231.955 :M
(privileges the process runs )S
2323.291 3510.305 :M
(Login/Audit UID:)S
4051.358 3510.305 :M
(UID of user who originally logged in)S
2323.291 3784.789 :M
-.036(Saved UID, GID:)A
4051.358 3784.789 :M
(UID, GID before last change by )S
4055.198 4016.748 :M
-.102(program)A
2323.291 4291.232 :M
-.006(Primary GID:)A
4051.358 4291.232 :M
-.006(GID assigned at login)A
2323.291 4565.716 :M
-.043(Secondary GIDs:)A
4051.358 4565.716 :M
(GIDs of groups to which the UID )S
4055.198 4797.674 :M
-.046(belongs)A
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 5 5
%%BeginPageSetup
initializepage
(Matt Bishop; page: 5 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
4005.276 5838.777 :M
0 G
f0_128 sf
-.113(Page 5)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Here, it means program runs with rights not normally associated with )S
825.632 3158.431 :M
-.006(user running it)A
825.632 3457.954 :M
-.007(Example: in )A
1353.653 3457.954 :M
f2_96 sf
-.305(vi)A
1422.776 3457.954 :M
f0_96 sf
(, user cannot write to buffer storage area where file is to )S
825.632 3573.155 :M
(be put when user hangs up so the process is given privileges )S
825.632 3688.356 :M
(\(additional rights\) to do it)S
825.632 3987.879 :M
-.028(setuid vs. a )A
f2_96 sf
-.04(root)A
1501.499 3987.879 :M
f0_96 sf
-.042( \(owner\) process)A
898.595 4137.64 :M
(\245)S
1046.441 4137.64 :M
f2_96 sf
-.117(root)A
1211.567 4137.64 :M
f0_96 sf
-.001( process starts in root's environment; need not worry about )A
1048.361 4252.842 :M
-.014(change of environment)A
898.595 4402.603 :M
(\245)S
1046.441 4402.603 :M
(setuid process starts in user's environment; must worry about )S
1048.361 4517.804 :M
-.014(change of environment)A
825.632 4817.327 :M
(How important?)S
898.595 4969.009 :M
(\245)S
1048.361 4969.009 :M
-.005(in theory: major, as you assume )A
f2_96 sf
(root)S
2599.782 4969.009 :M
f0_96 sf
( is trusted and users aren\325t)S
898.595 5118.77 :M
(\245)S
1048.361 5118.77 :M
-.001(in practise, not very, as you need to guard against poorly set up )A
1048.361 5233.971 :M
f2_96 sf
-.117(root)A
1213.487 5233.971 :M
f0_96 sf
-.062( environments)A
gR
0 G
473 323 1504 1129 rC
373.5 223.5 1703 1328 rS
1 G
474 323 1504 1129 rF
gS
.26 .262 scale
6770.184 5351.979 :M
0 G
f0_112 sf
-.087(Slide # 5)A
2496.097 5111.655 :M
-.023(Matt Bishop)A
2496.097 5245.169 :M
-.01(Dept. of Computer Science)A
2496.097 5378.682 :M
(University of California at Davis)S
gR
0 G
530 1315 94 92 rC
530 1315 :M
1225 887 :T
psb
currentpoint
pse
-1225 -887 :T
624 1407 :M
1225 887 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 473 323 1504 1129 rC
gS
.26 .262 scale
2315.61 2674.082 :M
f0_192 sf
(Setuid program gives privileges for the life of the )S
2315.61 2902.962 :M
(process, plus any descendants)S
2315.61 3456.089 :M
(Effect is same as if owner \(not user\) ran it)S
2315.61 4009.216 :M
(So \311 owner must dictate initial protection domain)S
3870.871 1972.183 :M
f0_288 sf
(Starting Safe)S
gR
373.5 223.5 1703 1328 rS
gR
4 lw
gS 100 100 2250 3000 rC
471 321 1508 1133 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 6 6
%%BeginPageSetup
initializepage
(Matt Bishop; page: 6 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
4005.276 5838.777 :M
0 G
f0_128 sf
-.113(Page 6)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(What could be done?)S
825.632 3181.471 :M
f0_72 sf
(\245)S
969.638 3181.471 :M
f0_96 sf
(Trust the Users)S
1113.643 3319.712 :M
(Claim there is no problem as no user would ever do anything )S
1113.643 3434.914 :M
-.013(untoward in that case)A
1113.643 3571.235 :M
-.003(Overlooks nasty people who may gain access to your site)A
825.632 3709.476 :M
f0_72 sf
(\245)S
969.638 3709.476 :M
f0_96 sf
-.032(Delete the Games)A
1113.643 3847.718 :M
(Lots of support for this, but students had their own copies, and )S
1113.643 3962.919 :M
(would have given one another setuid privileges ...)S
825.632 4101.16 :M
f0_72 sf
(\245)S
969.638 4101.16 :M
f0_96 sf
(Create a Restricted User)S
825.632 4239.401 :M
f0_72 sf
(\245)S
969.638 4239.401 :M
f0_96 sf
-.005(Create a Restricted Group)A
825.632 4515.884 :M
-.028(Riules of thumb:)A
825.632 4652.205 :M
(If no need to log in, use group \(not user\), as groups generally more )S
969.638 4767.407 :M
-.005(restricted than owner)A
825.632 4905.648 :M
(If group compromised, usually much less dangerous; this is due to )S
969.638 5020.849 :M
(usual system configuration; not inherent in the system)S
825.632 5297.332 :M
-.006(Application of privilege of least principle)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
-.087(Slide # 6)A
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
-.017(Games very popular, owned as )A
f2_192 sf
-.02(root)A
2611.302 2965.202 :M
f0_160 sf
(\310)S
2791.789 2965.202 :M
(Needed to be setuid to update high score files)S
2323.291 3510.305 :M
f0_192 sf
(Discovered that effective UID not reset when a subshell )S
2323.291 3738.397 :M
-.047(spawned)A
2611.302 3978.088 :M
f0_160 sf
(\310)S
2791.789 3978.088 :M
(So we could start a game which kept a high score file, and )S
2791.789 4171.386 :M
-.025(run a subshell \320 as )A
f2_160 sf
-.034(root)A
4454.574 4171.386 :M
f0_160 sf
(!)S
2864.752 1677.833 :M
f0_288 sf
(Example: the Purdue Games )S
4208.804 2025.771 :M
-.051(Incident)A
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 7 7
%%BeginPageSetup
initializepage
(Matt Bishop; page: 7 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
4005.276 5838.777 :M
0 G
f0_128 sf
-.113(Page 7)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(But setgid does not guarantee one can\325t do nasty things; it\325s usually a )S
825.632 3158.431 :M
-.027(matter of degree \311 )A
825.632 3457.954 :M
-.007(This attack is hard and takes some knowledge of the output of )A
f2_96 sf
(ps)S
3588.62 3457.954 :M
f0_96 sf
-.128( to )A
825.632 3573.155 :M
(interpret. Tricking )S
1593.662 3573.155 :M
f2_96 sf
(ps)S
f0_96 sf
-.011( into reading the data is easy; interpreting the )A
825.632 3688.356 :M
-.012(output is the hard part.)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
-.087(Slide # 7)A
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f2_192 sf
(Goal)S
f0_192 sf
(: read any location in kernel memory)S
2323.291 3278.346 :M
f2_192 sf
(ps)S
f0_192 sf
-.022( accesses process table by:)A
2611.302 3518.037 :M
f0_160 sf
(opening symbol table in )S
f2_160 sf
(/vmunix)S
2611.302 3746.129 :M
f0_160 sf
(looking up location of variable _proc)S
2323.291 4016.748 :M
f2_192 sf
-.032(ps)A
f0_192 sf
-.03( setgid to group kmem)A
2323.291 4291.232 :M
-.022(User can specify where )A
f2_192 sf
-.025(vmunix)A
f0_192 sf
-.017( file is)A
2323.291 4565.716 :M
-.023(So supply your own )A
4051.358 4565.716 :M
f2_192 sf
-.022(/vmunix)A
f0_192 sf
-.019( and read any file that )A
2323.291 4797.674 :M
-.014(group kmem can read ...)A
3014.518 2025.771 :M
f0_288 sf
-.017(Example: The )A
f2_288 sf
(ps)S
f0_288 sf
-.017(\(1\) Attack)A
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 8 8
%%BeginPageSetup
initializepage
(Matt Bishop; page: 8 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
4005.276 5838.777 :M
0 G
f0_128 sf
-.113(Page 8)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(This applies to the user environment as well; we\325ll get to that later.)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
-.087(Slide # 8)A
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
(Distrust anything the user provides)S
2323.291 3003.862 :M
f2_192 sf
-.427(ps)A
f0_192 sf
(:)S
2607.462 3003.862 :M
-.057(if using )A
3271.808 3003.862 :M
f2_192 sf
(/vmunix)S
f0_192 sf
(, namelist is \(probably\) okay; if using )S
2611.302 3231.955 :M
(something else, namelist is \(probably\) not okay)S
2684.265 3471.645 :M
f0_160 sf
(Why? Because first assumed writeable only by trusted user )S
2972.276 3664.944 :M
(\(who can read memory \(root; this should be checked both )S
2972.276 3854.377 :M
(at /vmunix and at /dev/kmem\). Assumption for other users )S
2972.276 4047.675 :M
(is likely to be wrong at both points.)S
2684.265 4279.634 :M
(Effectively, above fix allows user to supply alternate namelist )S
2972.276 4469.067 :M
(only if user could read memory file anyway)S
3049.079 2025.771 :M
f0_288 sf
(Validation and Verification)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 9 9
%%BeginPageSetup
initializepage
(Matt Bishop; page: 9 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
4005.276 5838.777 :M
0 G
f0_128 sf
-.113(Page 9)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
-.007(Actually, these are all different \311)A
825.632 3192.991 :M
(\245)S
967.718 3192.991 :M
(login bug changed data in the data segment)S
825.632 3342.753 :M
(\245)S
967.718 3342.753 :M
(fingerd and the rest overwrite the stack)S
825.632 3492.514 :M
(Works on RISC systems; just requires some more work)S
825.632 3793.957 :M
(One vendor made the stack pages non-executable; but many programs )S
825.632 3907.238 :M
f2_96 sf
(malloc)S
f0_96 sf
( space for input or arguments, and data on  the heap could be )S
825.632 4022.439 :M
-.02(executed \311)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
-.087(Slide # 9)A
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
(\245)S
2538.339 2725.512 :M
f2_192 sf
-.105(login)A
2945.395 2725.512 :M
f0_192 sf
-.01(, V6 UNIX \(apocryphal?\))A
2323.291 3003.862 :M
(\245)S
2538.339 3003.862 :M
f2_192 sf
(fingerd)S
3125.882 3003.862 :M
f0_192 sf
( as exploited by the Worm)S
2323.291 3278.346 :M
(\245)S
2538.339 3278.346 :M
f2_192 sf
(syslogd)S
3191.165 3278.346 :M
f0_192 sf
-.049(, )A
f2_192 sf
-.096(identd)A
3820.949 3278.346 :M
f0_192 sf
-.344(, \311)A
2323.291 3556.697 :M
(\245)S
2538.339 3556.697 :M
(lots of program argument lists)S
2323.291 4105.665 :M
(All cail to check bounds adequately)S
4074.399 2025.771 :M
f0_288 sf
(Overflows)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 10 10
%%BeginPageSetup
initializepage
(Matt Bishop; page: 10 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 10)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Assume any input \(or file names, or environment variable values, or )S
825.632 3158.431 :M
(arguments, \311\) supplied by the user or under the user\325s control will be )S
825.632 3273.632 :M
-.025(set to cause problems.)A
825.632 3548.195 :M
(In general, don\325t trust input to be of the right length or form. Assume it )S
825.632 3663.396 :M
-.044(could overflow )A
f2_96 sf
-.079(any)A
1620.543 3663.396 :M
f0_96 sf
( buffer, and program defensively!)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 10)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
(Use a function that respects buffer bounds)S
2611.302 2965.202 :M
f0_160 sf
-.028(Avoid these:)A
2611.302 3197.161 :M
f2_160 sf
-.115(gets)A
3471.496 3197.161 :M
-.128(strcpy)A
4623.541 3197.161 :M
-.019(strcat)A
5199.563 3197.161 :M
( )S
5779.426 3197.161 :M
-.091(sprintf)A
2611.302 3425.253 :M
f0_160 sf
(Use these instead:)S
2611.302 3657.212 :M
f2_160 sf
-.2(fgets)A
3475.336 3657.212 :M
-.097(strncpy)A
4627.381 3657.212 :M
(strncat)S
2611.302 3885.304 :M
f0_160 sf
-.027(\(no real good replacement for )A
f2_160 sf
-.024(sprintf)A
f0_160 sf
(; )S
5276.366 3885.304 :M
f2_160 sf
-.07(snprintf)A
5802.467 3885.304 :M
f0_160 sf
-.048( on some )A
2611.302 4078.603 :M
(systems\))S
2323.291 4345.355 :M
f0_192 sf
(To find good \(bad\) functions, look in the manual for )S
2323.291 4573.448 :M
(those which handle arrays and do not check length)S
2611.302 4813.138 :M
f0_160 sf
(\310)S
2699.625 4813.138 :M
(  checking for termination character is )S
5403.091 4813.138 :M
f2_160 sf
-.043(not)A
f0_160 sf
-.056( enough)A
3686.544 2025.771 :M
f0_288 sf
-.009(Handling Arrays)A
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 11 11
%%BeginPageSetup
initializepage
(Matt Bishop; page: 11 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 11)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
-.008(The user may control non-obvious things:)A
825.632 3192.991 :M
(\245)S
967.718 3192.991 :M
(for network services, the user can control anything from the network)S
825.632 3342.753 :M
(In the above example, theprogram trusts the results of )S
f2_96 sf
(gethostbyaddr)S
3759.507 3342.753 :M
f0_96 sf
(; it )S
825.632 3457.954 :M
-.088(shouldn\325t.)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 11)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
3936.154 2025.771 :M
f0_288 sf
(Invalid Input)S
2323.291 2725.512 :M
f0_192 sf
(Get IP address 555.1212.555.1212; want host name)S
2323.291 3003.862 :M
-.029(Use )A
f2_192 sf
-.028(gethostby addr)A
3986.076 3003.862 :M
f0_192 sf
(, which uses Directory Name Server)S
2323.291 3278.346 :M
-.018(Response p used as:)A
2611.302 3518.037 :M
f8_160 sf
(sprintf\(cmd, \322echo %s | mail bishop\323, p\);)S
2611.302 3746.129 :M
(if \(msystem\(cmd\) != BAD\) ...)S
2323.291 4016.748 :M
f0_192 sf
(Say host name resolves to)S
3271.808 4291.232 :M
f8_192 sf
(info.mabell.com; rm -rf *)S
2323.291 4565.716 :M
f0_192 sf
(Command executed is)S
2611.302 4805.406 :M
f8_160 sf
(echo info.mabell.com; rm -rf * | mail bishop)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 12 12
%%BeginPageSetup
initializepage
(Matt Bishop; page: 12 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 12)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Whenever data is read from a source the process \(or a trusted user\) )S
825.632 3158.431 :M
-.022(does not control, )A
f2_96 sf
-.032(always)A
1854.792 3158.431 :M
f0_96 sf
-.005( perform sanity checking)A
1113.643 3296.672 :M
(\310)S
1167.406 3296.672 :M
-.012(for buffers, check length of data)A
1113.643 3434.914 :M
(\310)S
1167.406 3434.914 :M
-.008(for numbers, check magnitude, sign)A
1113.643 3571.235 :M
(\310)S
1167.406 3571.235 :M
(for network infrastructure data, check validity as allowed by the )S
1113.643 3686.436 :M
(relevant RFCs; in DNS example, ; * \324 \324 all illegal characters in )S
1113.643 3801.637 :M
(name)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 12)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2389.172 :M
f0_192 sf
(Need to check any string being used as a command )S
2323.291 2621.131 :M
(and originating elsewhere)S
2611.302 2860.821 :M
f0_160 sf
(Good example: when user supplies value for environmental )S
2611.302 3050.254 :M
-.018(variable DISPLAY)A
2323.291 3317.006 :M
f0_192 sf
(Say string has any metacharacter meaningful to shell)S
2611.302 3556.697 :M
f0_160 sf
-.012(Examples:  | ^ & ; ` < >)A
2323.291 3823.449 :M
f0_192 sf
(If user gives a recipient for mail as)S
2465.376 4101.799 :M
f8_192 sf
(bishop | cp /bin/sh .sh; chmod 4755 .sh)S
2323.291 4376.283 :M
f0_192 sf
(then using this as an address  to mail command gives a )S
2323.291 4608.242 :M
(setuid to \(process EUID\) shell)S
2611.302 4844.066 :M
f0_160 sf
(Bug in Version 7 UUCP, some versions of )S
5625.82 4844.066 :M
f2_160 sf
-.037(sendmail)A
f0_160 sf
-.04(, some )A
2611.302 5037.365 :M
-.004(versions of Web browsers)A
2761.068 2025.771 :M
f0_288 sf
(User Specifying Arbitrary Input)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 13 13
%%BeginPageSetup
initializepage
(Matt Bishop; page: 13 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 13)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
-.003(Where is the privilege?)A
825.632 3192.991 :M
(\245)S
969.638 3192.991 :M
-.026(vi is not setuid to )A
1710.787 3192.991 :M
f2_96 sf
-.117(root)A
1875.913 3192.991 :M
f0_96 sf
(; you don't need that to edit your files)S
825.632 3342.753 :M
(\245)S
969.638 3342.753 :M
-.007(expreserve is setuid to )A
f2_96 sf
(root)S
2121.683 3342.753 :M
f0_96 sf
( as the buffer is saved in a protected )S
969.638 3457.954 :M
(area so expreserve needs enough privileges to copy the file there)S
825.632 3607.715 :M
(\245)S
969.638 3607.715 :M
(mail is run by expreserve so unless reset, it runs with )S
f2_96 sf
(root)S
3411.973 3607.715 :M
f0_96 sf
( privileges)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 13)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
(vi )S
2515.298 2725.512 :M
f2_192 sf
-.099(file)A
2611.302 2965.202 :M
f0_160 sf
(\311 edit it, then hang up without saving it \311)S
2323.291 3510.305 :M
f0_192 sf
(\245)S
2538.339 3510.305 :M
(vi invokes expreserve, which saves buffer in )S
2538.339 3738.397 :M
(protected area)S
2611.302 3978.088 :M
f0_160 sf
(... which is inaccessible to ordinary users, including editor of )S
2791.789 4171.386 :M
-.03(the file)A
2323.291 4438.139 :M
f0_192 sf
(\245)S
2538.339 4438.139 :M
(expreserve invokes mail to send letter to user)S
3302.529 2025.771 :M
f0_288 sf
(Environment Example)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 14 14
%%BeginPageSetup
initializepage
(Matt Bishop; page: 14 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 14)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
-.001(Apparent lesson \(it\325s one of the real ones \311\))A
825.632 3181.471 :M
-.007(Don't trust the setting of the user's )A
f3_96 sf
(PATH)S
2563.3 3181.471 :M
f0_96 sf
-.087( variable)A
825.632 3331.233 :M
(\245)S
969.638 3331.233 :M
(if your program will run any system commands, either give the full )S
969.638 3446.434 :M
(path name or reset this variable explicitly)S
969.638 3584.675 :M
(Instead of resetting )S
f3_96 sf
(PATH,)S
2100.562 3584.675 :M
f0_96 sf
-.084( change)A
1401.655 3722.916 :M
f8_96 sf
-.007(system\("mail user"\))A
969.638 3859.238 :M
f0_96 sf
(to)S
1401.655 3997.479 :M
f8_96 sf
-.003(system\("/bin/mail user"\))A
825.632 4135.72 :M
f0_96 sf
(\245)S
967.718 4135.72 :M
(This by itself is not enough, however ...)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 14)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f8_192 sf
($ cat > ./mail)S
2323.291 2957.47 :M
(#! /bin/sh)S
2323.291 3185.563 :M
(cp /bin/sh /usr/attack/.sh)S
2323.291 3417.521 :M
(chmod 4755 /usr/attack/.sh)S
2323.291 3645.614 :M
-.344(^D)A
2323.291 3877.572 :M
($ PATH=.:$PATH)S
2323.291 4105.665 :M
-.019($ export PATH)A
2538.339 4658.499 :M
f0_192 sf
-.003(\311 and then run vi and hang up.)A
3705.745 2025.771 :M
f0_288 sf
-.004(The First Attack)A
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 15 15
%%BeginPageSetup
initializepage
(Matt Bishop; page: 15 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 15)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(You want to disable all environment variables, and enable only those )S
825.632 3158.431 :M
(you need -- after you have senity checking. Principle of fail-safe )S
825.632 3273.632 :M
-.054(defaukkts.)A
825.632 3548.195 :M
-.003(Look for any code using environment variables:)A
1113.643 3824.677 :M
f8_96 sf
(main\(argc, argv, envp\))S
1113.643 3962.919 :M
-.016(extern char **environ)A
1113.643 4101.16 :M
-.033(getenv\("variable"\))A
1113.643 4239.401 :M
-.033(putenv\("variable"\))A
825.632 4515.884 :M
f0_96 sf
-.002(The only time you should use them is when they do not affect the )A
825.632 4629.165 :M
-.019(security of the program)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 15)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
(Bourne shell determines whitespace with )S
f3_192 sf
(IFS)S
2323.291 3003.862 :M
f0_192 sf
(Using same program as before, but called )S
5940.712 3003.862 :M
f2_192 sf
-.417(m)A
f0_192 sf
-.244(, do:)A
2323.291 3556.697 :M
f8_192 sf
(% IFS="/binal\\t\\n "; export IFS)S
2323.291 3831.181 :M
(% PATH=.:$PATH; export PATH)S
2323.291 4384.015 :M
f0_192 sf
-.003(\311 and then run vi and hang up.)A
3494.536 2025.771 :M
f0_288 sf
(The Second Attack)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 16 16
%%BeginPageSetup
initializepage
(Matt Bishop; page: 16 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 16)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(This is a very common error \(one of my early -- 1985 -- TRs on the )S
825.632 3158.431 :M
-.032(subjecthad it\).)A
825.632 3308.192 :M
(Note )S
f2_96 sf
-.011(system)A
f0_96 sf
-.01( spawns a Bourne shell, then executs te command.)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 16)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
(Fix given in most books is:)S
2323.291 2949.739 :M
f8_144 sf
(system\("IFS='\\n\\t ';PATH=/bin:/usr/bin;\\)S
2323.291 3158.501 :M
(         export IFS PATH;command"\);)S
2611.302 3382.728 :M
f0_160 sf
-.102(This sets )A
f3_160 sf
-.186(IFS)A
3544.458 3382.728 :M
f0_160 sf
-.906(, )A
3632.782 3382.728 :M
f3_160 sf
-.015(PATH)A
f0_160 sf
-.01(; you may want to fix more)A
2323.291 3649.48 :M
f6_192 sf
-.032(WRONG)A
gR
605 951 -3 3 805 948 3 605 948 @a
gS
.26 .259 scale
2611.302 3869.84 :M
f8_144 sf
(% IFS=\322I$IFS\323)S
2611.302 4078.603 :M
-.004(% PATH=\322.:$PATH\323)A
2611.302 4287.366 :M
-.109(% plugh)A
2323.291 4550.252 :M
f0_192 sf
(Now your IFS is unchanged since the Bourne shell )S
2323.291 4778.344 :M
(interprets the I in )S
f8_192 sf
(IFS='\\n\\t ')S
5072.838 4778.344 :M
f0_192 sf
( as a blank, and reads )S
2323.291 5010.303 :M
-.011(the first part as )A
f8_192 sf
-.02(FS='\\n\\t )A
4016.797 2025.771 :M
f0_288 sf
(Fixing This)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 17 17
%%BeginPageSetup
initializepage
(Matt Bishop; page: 17 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 17)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 2995.229 :M
f0_96 sf
(This is somewhat system dependent \311)S
825.632 3294.752 :M
-.035(What to do? Use )A
1566.781 3294.752 :M
f2_96 sf
(execve)S
f0_96 sf
(\(2\) and reset what parts of the environment )S
825.632 3409.953 :M
-.099(you want:)A
1113.643 3559.715 :M
-.017(envp[0] = NULL;)A
1113.643 3709.476 :M
(if \(execve\(path_name, argv, envp\) < 0\) ...)S
825.632 3859.238 :M
(Note: may have to set TZ on System V based systems.)S
825.632 4147.24 :M
(Programs run with more privileges but in an environment set up by a )S
825.632 4262.442 :M
(user with fewer privileges. This means programs trust and \(implicitly or )S
825.632 4377.643 :M
(explicitly\) use this environment)S
825.632 4677.166 :M
(Similar problem: when dynamic loading is used and load path is under )S
825.632 4792.367 :M
-.025(user\325s control.)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 17)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2999.157 1677.833 :M
f0_288 sf
(Programming Tip: More on )S
3264.127 2025.771 :M
(Environment Variables)S
2369.373 2536.079 :M
f0_192 sf
(Can add them directly to environment, so multiple )S
2369.373 2764.172 :M
(instances of a variable may occur:)S
2945.395 3042.522 :M
f8_192 sf
(PATH=/bin:/usr/bin:/usr/etc)S
2945.395 3317.006 :M
(TZ=PST8PST)S
2945.395 3591.49 :M
-.019(SHELL=/bin/sh)A
2945.395 3869.84 :M
(PATH=.:/bin:/usr/bin)S
2369.373 4144.325 :M
f0_192 sf
(Now which PATH is used for the search path?)S
2657.384 4384.015 :M
f0_160 sf
(Answer varies but it is usually the second)S
2369.373 4650.767 :M
f0_192 sf
(If PATH is deleted or replaced, which one is affected?)S
2657.384 4890.458 :M
f0_160 sf
-.007(Usually the first ...)A
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 18 18
%%BeginPageSetup
initializepage
(Matt Bishop; page: 18 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 18)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Where is this new routine obtained from?  Possibly an environment )S
825.632 3158.431 :M
(variable \311 for example, on Suns: check libraries in directories named in )S
825.632 3273.632 :M
-.017(the variables)A
f3_96 sf
-.024( LD_LIBRARY_PATH)A
f0_96 sf
(, )S
2371.293 3273.632 :M
f3_96 sf
-.067(LD_PRELOAD)A
3022.198 3273.632 :M
f0_96 sf
-.005(; those directories )A
825.632 3388.833 :M
-.011(are searched in order, just like )A
f3_96 sf
-.024(PATH)A
2398.174 3388.833 :M
f0_96 sf
-.011(  Other systems have similar )A
825.632 3502.114 :M
-.028(mechanism \()A
1374.774 3502.114 :M
f3_96 sf
-.088(ELF_ )A
1635.904 3502.114 :M
f0_96 sf
-.037(variables, )A
2073.681 3502.114 :M
f2_96 sf
-.15(etc)A
f0_96 sf
-.206(.\))A
825.632 3778.597 :M
(This puts execution of parts of a setuid program under user control as )S
825.632 3893.798 :M
(the user controls what is loaded and run)S
825.632 4170.281 :M
-.004(So, build a dynamic library with your own version of )A
3033.718 4170.281 :M
f2_96 sf
-.02(fgets.o)A
3321.73 4170.281 :M
f0_96 sf
(:)S
1113.643 4308.522 :M
f8_96 sf
(fgets\(char *buf, int n, FILE *fp\))S
1113.643 4446.763 :M
({)S
1401.655 4585.005 :M
(execl\("/bin/sh", "-sh", 0\);)S
1113.643 4721.326 :M
(})S
825.632 4859.567 :M
f0_96 sf
-.005(and put it into a library )A
f2_96 sf
(libme.so)S
2154.324 4859.567 :M
f0_96 sf
-.008( in current directory.  Then, execute the )A
825.632 4974.769 :M
-.045(following)A
1401.655 5113.01 :M
f8_96 sf
-.009(% LD_PRELOAD=.:$LD_PRELOAD)A
1401.655 5251.251 :M
-.172(% )A
1516.859 5251.251 :M
f10_96 sf
(setuid_program_calling_fgets)S
1401.655 5389.493 :M
f8_96 sf
(#)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 18)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
(General assumption: programs loaded as written)S
2611.302 2965.202 :M
f0_160 sf
(this means parts of it don't change once it is compiled)S
2323.291 3231.955 :M
f0_192 sf
(Dynamic loading has the opposite intent)S
2611.302 3471.645 :M
f0_160 sf
(load the most current versions of the libraries, or allow users to )S
2611.302 3664.944 :M
(create their own versions of the libraries)S
2473.057 2025.771 :M
f0_288 sf
(Dynamic Loading and Environment)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 19 19
%%BeginPageSetup
initializepage
(Matt Bishop; page: 19 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 19)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(There\325s a catch: the program can\325t just ignore the variables, it must )S
825.632 3158.431 :M
(purge them from its environment lest they be passed to a non-setuid )S
825.632 3273.632 :M
(subprocess running on behalf of the setuid process. Example: /bin/login )S
825.632 3388.833 :M
(spawning /bin/sync. This was a Sun bug for a time.)S
825.632 3688.356 :M
(Because of all this, I recommend that security-related code be statically )S
825.632 3803.557 :M
(linked. Dynamically linked code can be secure, but it is affected more )S
825.632 3918.758 :M
(by the environment and the run-time libraries than is static code.)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 19)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f2_192 sf
-.109(Problem)A
3037.559 2725.512 :M
f0_192 sf
(: Dynamic loading allows an unprivileged user )S
2323.291 2957.47 :M
(to ater a privileged process by controlling what is loaded)S
2323.291 3231.955 :M
f2_192 sf
(Idea)S
f0_192 sf
(: Disallow this control by having setuid programs )S
2323.291 3463.913 :M
(ignore environment variables)S
2611.302 3703.604 :M
f0_160 sf
(Here, they would dynamically load libraries from a preset set of )S
2611.302 3893.036 :M
(directories only)S
2323.291 4159.789 :M
f2_192 sf
(Reasoning)S
f0_192 sf
(: Users can control what is dynamically )S
2323.291 4391.747 :M
(loaded on their programs, but not on anyone else\325s, )S
2323.291 4619.84 :M
(since everything you do is executed under your UID or )S
2323.291 4851.798 :M
-.008(is setuid to someone else \311)A
3663.503 2025.771 :M
f0_288 sf
-.016(The Obvious Fix)A
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 20 20
%%BeginPageSetup
initializepage
(Matt Bishop; page: 20 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 20)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(This is critical, as security is in large part knowing \(and validating\) your )S
825.632 3158.431 :M
-.039(assumptions.)A
825.632 3457.954 :M
-.039(Moral of all this?)A
825.632 3757.477 :M
(There's more to an environment than environment variables)S
1401.655 3895.718 :M
-.093(UIDs)A
2340.571 3895.718 :M
-.018(root directory of process)A
1401.655 4033.959 :M
-.216(GIDs)A
2338.651 4033.959 :M
-.006(file system paths of referenced files)A
1401.655 4172.201 :M
-.17(umask)A
2340.571 4172.201 :M
-.021(network information)A
1401.655 4310.442 :M
(open file descriptors)S
2340.571 4310.442 :M
-.069(process name)A
825.632 4460.204 :M
(Essentially, environment is the protection state of the system plus )S
825.632 4575.405 :M
-.016(anything that affects that state)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 20)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
(Know where your trust is!)S
2323.291 3003.862 :M
(\245)S
2538.339 3003.862 :M
(if dynamic loading is a possibility, and you can )S
2538.339 3231.955 :M
(disable it, do so)S
2323.291 3510.305 :M
(\245)S
2538.339 3510.305 :M
(if you can eliminate dependence on environment, or )S
2538.339 3738.397 :M
(check assumptions about the environment, do so)S
2323.291 4016.748 :M
(\245)S
2538.339 4016.748 :M
(if you can't, warn the installer and/or user)S
2323.291 4565.716 :M
(Moral: identify trust points in design )S
f2_192 sf
(and)S
5706.463 4565.716 :M
f0_192 sf
( implementation)S
3314.049 2025.771 :M
f0_288 sf
(Know What You Trust)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 21 21
%%BeginPageSetup
initializepage
(Matt Bishop; page: 21 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 21)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Goal: read any file on the system)S
825.632 3192.991 :M
f2_96 sf
(sendmail)S
1209.647 3192.991 :M
f0_96 sf
-.035( ran setuid to )A
1791.43 3192.991 :M
f2_96 sf
-.117(root)A
825.632 3342.753 :M
f0_96 sf
(\320C option used to test \(and debug\) )S
f2_96 sf
(sendmail.cf )S
2841.711 3342.753 :M
f0_96 sf
-.216(file)A
825.632 3492.514 :M
(excellent error diagnostics, giving line and pointer to the error)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 21)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f8_192 sf
(sendmail \320C protected_file)S
2323.291 3003.862 :M
f0_192 sf
-.058(Output is:)A
2611.302 3243.553 :M
f8_160 sf
(when in the course of human events)S
2611.302 3471.645 :M
(---error: bad format)S
2611.302 3703.604 :M
(it becomes necessary for a people to declare)S
2611.302 3931.696 :M
(---error: bad format)S
2323.291 4198.448 :M
f0_192 sf
(so delete every other line!)S
3671.183 2025.771 :M
f0_288 sf
-.029(Sendmail Attack)A
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 22 22
%%BeginPageSetup
initializepage
(Matt Bishop; page: 22 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 22)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(When checking for access, check for file type also; if file is symbolic )S
825.632 3158.431 :M
(link, check access on each component in the links until you reach the )S
825.632 3273.632 :M
-.051(end)A
825.632 3411.873 :M
(When checking for ability to write, check ancestor directories also; more )S
825.632 3525.154 :M
-.006(on this later)A
825.632 3663.396 :M
(When checking for ability to read or write, check for real UID's \(GID\325s\) )S
825.632 3778.597 :M
(access, not effective UID's \(GID\325s\) access)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 22)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
-.12(use )A
f2_192 sf
-.159(access)A
3283.328 2725.512 :M
f0_192 sf
-.031(\(2\) system call:)A
2611.302 2965.202 :M
f8_160 sf
(access\(config_file, R_OK\))S
2323.291 3231.955 :M
f0_192 sf
(if < 0, real user can't read file; so )S
f2_192 sf
(sendmail)S
5917.671 3231.955 :M
f0_192 sf
( shouldn't )S
2538.339 3463.913 :M
(read it on his/her behalf)S
2323.291 4016.748 :M
f2_192 sf
(Warning: this solution is probably flawed!)S
gR
605 1046 -3 3 1514 1043 3 605 1043 @a
gS
.26 .259 scale
2611.302 4252.572 :M
f0_160 sf
(The hole exists only under very specific conditions and is much )S
2611.302 4445.871 :M
-.018(smaller, but still exists)A
3759.507 2025.771 :M
f0_288 sf
-.004(One Partial Fix)A
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 23 23
%%BeginPageSetup
initializepage
(Matt Bishop; page: 23 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 23)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Want to check permissions and open as a single operation; cannot be )S
825.632 3158.431 :M
(done unless check is for effective UID/GID)S
1113.643 3296.672 :M
(checking for access based on real UID/GID requires )S
f2_96 sf
(access)S
f0_96 sf
(\(2\) )S
1113.643 3411.873 :M
-.07(followed by )A
1620.543 3411.873 :M
f2_96 sf
-.156(open)A
1833.672 3411.873 :M
f0_96 sf
(\(2\), and there is a window of vulnerability )S
1113.643 3525.154 :M
(between the two; no guarantee that the object opened is the )S
1113.643 3640.356 :M
(same as the one checked)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 23)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
(Previous fix is roughly)S
2611.302 2965.202 :M
f8_160 sf
(if \(access\(config_file, R_OK\) < 0\) )S
5971.433 2965.202 :M
f10_160 sf
(error)S
2611.302 3197.161 :M
f8_160 sf
(fp = fopen\(config_file, "r"\);)S
2323.291 3463.913 :M
f0_192 sf
(But may not be good enough ...)S
2323.291 4016.748 :M
-.008(Attack: change files between )A
f2_192 sf
-.011(access)A
5418.452 4016.748 :M
f0_192 sf
-.016( and )A
f2_192 sf
-.022(fopen)A
3602.061 2025.771 :M
f0_288 sf
(The Smaller Hole)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 24 24
%%BeginPageSetup
initializepage
(Matt Bishop; page: 24 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 24)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
-.003(File descriptors are not synonyms for file names!)A
825.632 3319.712 :M
-.005(File \(data + inode information\) is object)A
825.632 3457.954 :M
-.004(File descriptor is variable containing object)A
1113.643 3594.275 :M
(Bound once, at file descriptor creation; hence, once open, a file's )S
1113.643 3709.476 :M
-.001(name being changed doesn't affect what the descriptor refers to)A
825.632 3847.718 :M
(File name is pointer to object, with loose binding)S
1113.643 3985.959 :M
(Name rebound at every reference)S
825.632 4273.962 :M
(Note: order of fopen and access can be switched and same problem )S
825.632 4389.163 :M
-.058(occurs.)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 24)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
-.015(In something like)A
2323.291 3003.862 :M
f8_192 sf
(if \(access\("xyz", R_OK\) == 0\))S
2323.291 3278.346 :M
(       fp = fopen\("xyz", "r"\);)S
2323.291 3556.697 :M
f0_192 sf
(if user can change binding of )S
f2_192 sf
(xyz)S
5118.92 3556.697 :M
f0_192 sf
-.016( between the check )A
2323.291 3784.789 :M
-.132(\()A
f2_192 sf
-.246(access)A
2983.797 3784.789 :M
f0_192 sf
(\) and the use \()S
f2_192 sf
(open)S
f0_192 sf
(\), the check becomes )S
2323.291 4016.748 :M
-.031(irrelevant)A
3152.763 2025.771 :M
f0_288 sf
(Race Condition Problem)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 25 25
%%BeginPageSetup
initializepage
(Matt Bishop; page: 25 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 25)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Just because you can do it doesn't mean you should!)S
825.632 3181.471 :M
(\245)S
973.478 3181.471 :M
-.008(Don't rely on access in general)A
1113.643 3319.712 :M
(you can in the specific case where no untrusted user can write to )S
1113.643 3434.914 :M
(a directory or any of its ancestor directories)S
1113.643 3571.235 :M
-.004(If directory or any ancestor is symbolic link, check link, then )A
1113.643 3686.436 :M
-.143(repeat )A
f2_96 sf
-.137(full)A
1534.14 3686.436 :M
f0_96 sf
-.011( check on referent)A
825.632 3824.677 :M
(\245)S
973.478 3824.677 :M
(Use subprocesses freely)S
825.632 4101.16 :M
-.027(ReUse )A
f2_96 sf
-.019(trustfile)A
1453.497 4101.16 :M
f0_96 sf
-.15( from)A
825.632 4239.401 :M
(ftp://nob.cs.ucdavis.edu/pub/sec-tools/trustfile.tar)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 25)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
3087.481 2025.771 :M
f0_288 sf
(A Classic Race Condition)S
2323.291 2536.079 :M
f0_192 sf
(Problem:)S
2323.291 2810.563 :M
(\245)S
2538.339 2810.563 :M
(access control check done on object bound to name)S
2323.291 3085.048 :M
(\245)S
2538.339 3085.048 :M
(open done on object bound to name)S
2538.339 3363.398 :M
f6_192 sf
(no assurance this binding has not changed!!!)S
2323.291 3869.84 :M
f0_192 sf
(Solution: use file descriptors whenever possible, as )S
2538.339 4097.933 :M
(once object is bound to file descriptor the binding )S
2538.339 4329.891 :M
(does not change.)S
2323.291 4604.376 :M
(Warning:)S
2538.339 4882.726 :M
f6_192 sf
(names and file descriptors don\325t mix!!!)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 26 26
%%BeginPageSetup
initializepage
(Matt Bishop; page: 26 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 26)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(These are not closed across fork or exec)S
825.632 3181.471 :M
(\245)S
973.478 3181.471 :M
(Threat is when privileged parent opens sensitive file and then )S
975.398 3296.672 :M
-.012(spawns a subshell)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 26)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2485.822 :M
f8_192 sf
(main\(\))S
2323.291 2764.172 :M
({)S
2899.313 3038.656 :M
-.035(int fd;)A
2899.313 3270.614 :M
(fd = open\(priv_file, 0\); dup\(9, fd\);)S
2899.313 3498.707 :M
(\(void\) msystem\("/bin/sh"\);)S
2323.291 3773.191 :M
(})S
2323.291 4326.025 :M
f0_192 sf
(Running this and typing)S
2611.302 4565.716 :M
f8_160 sf
(% cat <&9)S
2323.291 4832.468 :M
f0_192 sf
-.009(prints the contents of )A
4158.882 4832.468 :M
f2_192 sf
-.033(priv_file)A
2480.737 2025.771 :M
f0_288 sf
(File Descriptors and Subprocesses)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 27 27
%%BeginPageSetup
initializepage
(Matt Bishop; page: 27 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 27)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(File descriptors are essentially capabilities; once you have one, you can )S
825.632 3158.431 :M
(read/write the file eve if it is deleted.)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 27)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
-.005(Access privileges checked on )A
f2_192 sf
(open)S
5322.448 2725.512 :M
f0_192 sf
-.1( or )A
f2_192 sf
-.155(creat)A
6025.195 2725.512 :M
f0_192 sf
-.105( only)A
2611.302 2965.202 :M
f0_160 sf
-.011(not checked on read, write, )A
f2_160 sf
(etc)S
4788.667 2965.202 :M
f0_160 sf
(.)S
2323.291 3510.305 :M
f0_192 sf
(This is how pipes work; also useful for log files)S
2611.302 3746.129 :M
f0_160 sf
(\310)S
2791.789 3746.129 :M
(open rotected log file as )S
4535.217 3746.129 :M
f2_160 sf
-.195(root)A
2611.302 3978.088 :M
f0_160 sf
(\310)S
2791.789 3978.088 :M
(drop privileges to user)S
2611.302 4206.18 :M
(\310)S
2791.789 4206.18 :M
(can still log data in protected file)S
2768.748 2025.771 :M
f0_288 sf
(File Descriptors and Privileges)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 28 28
%%BeginPageSetup
initializepage
(Matt Bishop; page: 28 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 28)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Between second and third step, replace script with file of your choosing)S
1113.643 3181.471 :M
(cp /bin/sh .sh; chmod 4755 .sh)S
825.632 3319.712 :M
-.008(You've now compromised the user)A
825.632 3594.275 :M
(In general, don't use setuid scripts;  too easy to create a security hole)S
825.632 3732.516 :M
(If you must, provide a wrapper which is setuid and which will honor the )S
825.632 3847.718 :M
(setuid bits on the script.  Then simply exec the interpreter yourself, )S
825.632 3962.919 :M
-.014(open the script, and use )A
f2_96 sf
-.015(fstat)A
2058.32 3962.919 :M
f0_96 sf
-.012( to check the bits)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 28)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
-.003(How executed on most systems:)A
2323.291 3003.862 :M
(Kernel picks out interpreter)S
2611.302 3243.553 :M
f0_160 sf
(first line of script is #! /bin/sh)S
2323.291 3510.305 :M
f0_192 sf
(Kernel starts interpreter with setuid bits applied)S
2323.291 3784.789 :M
(Kernel gives interpreter the script as argument)S
2784.109 1677.833 :M
f0_288 sf
(Another Race Condition: Shell )S
4274.087 2025.771 :M
(Scripts)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 29 29
%%BeginPageSetup
initializepage
(Matt Bishop; page: 29 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 29)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Good example is shell scripts. Even if the kernel bug above is fixed, )S
825.632 3158.431 :M
(shells often base actions uipon the name of the shell; if the first char of )S
825.632 3273.632 :M
(arg 0 is \322-\323, it\325s a login shell. )S
825.632 3573.155 :M
(Just write a 4-line C program to do this, and call the subsequent shell \322-)S
825.632 3688.356 :M
f2_96 sf
-.146(xyz)A
f0_96 sf
-.179(\323.)A
825.632 3987.879 :M
-.033(Other interpreters \()A
1635.904 3987.879 :M
f2_96 sf
-.336(awk)A
1806.791 3987.879 :M
f0_96 sf
-.005(, etc.\) have this same problem.)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 29)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
(Interaction with environment too complex:)S
2323.291 3003.862 :M
(\245)S
2538.339 3003.862 :M
(need to handle environment variables)S
2323.291 3278.346 :M
(\245)S
2538.339 3278.346 :M
(need to worry about loaded routines)S
2323.291 3556.697 :M
(Goal: minimize interactions)S
2611.302 3792.521 :M
f0_160 sf
(make the program as self-contained as possible)S
2323.291 4337.623 :M
f0_192 sf
(Example of the )S
f2_192 sf
(principle of least common mechanism)S
2630.503 2025.771 :M
f0_288 sf
(Keep It Small and Simple \(KISS\))S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 30 30
%%BeginPageSetup
initializepage
(Matt Bishop; page: 30 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 30)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Don't base user's ability to control actions of program on program name)S
825.632 3192.991 :M
(\245)S
973.478 3192.991 :M
(Okay to have name determine what program does)S
825.632 3342.753 :M
(\245)S
973.478 3342.753 :M
(Not okay to allow user to alter program's actions during run based )S
975.398 3457.954 :M
-.036(solely on name)A
825.632 3757.477 :M
(Example of Principle of Separation of Privilege)S
825.632 3907.238 :M
(\245)S
973.478 3907.238 :M
(base such permission on more than one check, such as name and )S
975.398 4022.439 :M
-.103(password)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 30)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2698.45 :M
f8_160 sf
(% ls \320l /etc/reboot)S
2323.291 2926.543 :M
(\320rwsr\320xr\320x 1 root   17 Jul 1992 /etc/reboot)S
2323.291 3158.501 :M
(% ln /etc/reboot /tmp/-x)S
2323.291 3386.594 :M
(% cd /tmp)S
2323.291 3618.552 :M
(% \320x)S
2323.291 3846.645 :M
(#)S
2430.815 2025.771 :M
f0_288 sf
(Possible Side Effect of Shell Scripts)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 31 31
%%BeginPageSetup
initializepage
(Matt Bishop; page: 31 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 31)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Bb Morris thinks this is either apocryphal orcomes from a local )S
825.632 3158.431 :M
-.028(modification of )A
1470.777 3158.431 :M
f2_96 sf
-.367(su)A
1572.541 3158.431 :M
f0_96 sf
-.034(\(1\), as he wrote the V6 )A
f2_96 sf
-.082(su)A
2670.824 3158.431 :M
f0_96 sf
( and did not put this in.)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 31)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
-.112(If )A
f2_192 sf
-.427(su)A
2684.265 2725.512 :M
f0_192 sf
( could not open password file, assumed )S
2323.291 2957.47 :M
(catastrophic problem and gave you root to let you fix )S
2323.291 3185.563 :M
(system)S
2323.291 3738.397 :M
-.028(Attack: open 19 files, then )A
f2_192 sf
-.036(exec)A
f0_192 sf
( )S
5042.117 3738.397 :M
f2_192 sf
-.13(su root)A
2611.302 3978.088 :M
f0_160 sf
-.003(At most 19 open files per process, so \311)A
2323.291 4519.324 :M
f0_192 sf
(Note: Possibly apocryphal; a non-standard Version 6 )S
2323.291 4751.283 :M
(UNIX system, if true)S
2738.027 2025.771 :M
f0_288 sf
(That Old )S
f2_288 sf
(su)S
f0_288 sf
( Bug \(Apocryphal?\))S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 32 32
%%BeginPageSetup
initializepage
(Matt Bishop; page: 32 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 32)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Track what can cause an error as you write the program)S
825.632 3342.753 :M
-.002(Ask "What should be done if this does go wrong?")A
825.632 3642.276 :M
(If you can't handle all cases, or determine precisely why )S
825.632 3757.477 :M
-.006(the error occurred, or make assumptions that can't be verified, )A
f3_96 sf
(STOP)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 32)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
(With privileged programs, it's very simple:)S
4051.358 3003.862 :M
f6_192 sf
-.126(DON'T)A
gR
1055 784 -3 3 1212 781 3 1055 781 @a
gS
.26 .259 scale
2323.291 3278.346 :M
f0_192 sf
(Why? Because assumptions made to recover may not )S
2323.291 3510.305 :M
-.018(be right)A
2323.291 4059.273 :M
(In above, error was to assume open fails only because )S
2323.291 4291.232 :M
-.022(password file gone)A
2323.291 4844.066 :M
(Example of Principle of Fail-Safe Defaults)S
3744.146 2025.771 :M
f0_288 sf
(Error Recovery)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 33 33
%%BeginPageSetup
initializepage
(Matt Bishop; page: 33 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 33)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Checking the cause of an error:)S
1113.643 3331.233 :M
f8_96 sf
-.033(#include <errno.h>)A
1113.643 3469.474 :M
(extern int errno;)S
825.632 3768.997 :M
f0_96 sf
(Precise cause of failure often put in here)S
1113.643 3918.758 :M
-.219(for )A
1251.889 3918.758 :M
f2_96 sf
-.367(su)A
1353.653 3918.758 :M
f0_96 sf
-.032(, example sets )A
1998.798 3918.758 :M
f2_96 sf
(errno)S
2223.447 3918.758 :M
f0_96 sf
-.092( to )A
f3_96 sf
-.194(EMFILE)A
1113.643 4068.52 :M
f0_96 sf
-.006(for su, no password file sets )A
f2_96 sf
(errno)S
2553.7 4068.52 :M
f0_96 sf
-.023( to )A
f3_96 sf
-.055(ENOENT)A
825.632 4218.281 :M
f0_96 sf
(Warning: not automatically cleared, so program must clear it \(set it to )S
825.632 4333.482 :M
-.031(ENONE or 0\))A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 33)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2864.752 2025.771 :M
f0_288 sf
(General Use of System Calls)S
2534.499 4078.603 :M
f0_192 sf
(\245)S
5533.656 4264.17 :M
(.)S
2323.291 2725.512 :M
(Never assume a system call will succeed!!!)S
2323.291 3278.346 :M
(If the success of a system call \(such as )S
f2_192 sf
(read)S
6086.638 3278.346 :M
f0_192 sf
-.009(\) is crucial )A
2538.339 3510.305 :M
(to the program's success or failure, check the return )S
2538.339 3738.397 :M
(code to be sure it is not -1.)S
2323.291 4016.748 :M
(This applies to library calls, functions defined within the )S
2538.339 4244.84 :M
-.015(program, and )A
f2_192 sf
-.016(everything)A
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 34 34
%%BeginPageSetup
initializepage
(Matt Bishop; page: 34 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 34)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Now for some odds and ends \311)S
825.632 3192.991 :M
(\245)S
973.478 3192.991 :M
(file cannot be accessed by any other user; if they can get to the raw )S
975.398 3308.192 :M
(device and find the inode, they can get the data directly; but that )S
975.398 3423.393 :M
(means you\325re compromised anyway)S
825.632 3573.155 :M
(\245)S
973.478 3573.155 :M
(at end of program, temp file automatically deleted)S
1113.643 3722.916 :M
(  good: ciel cleanup automatic)S
1113.643 3872.678 :M
(  bad: may make PM analysis harder on abnormal termination)S
825.632 4022.439 :M
(+)S
973.478 4022.439 :M
-.021(race condition eliminated)A
825.632 4172.201 :M
(\320)S
973.478 4172.201 :M
-.029(hides use of disk space)A
1401.655 4323.882 :M
(you see it is gone, but not where)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 34)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
3248.767 2025.771 :M
f0_288 sf
(Secure Temporary File)S
2323.291 2439.43 :M
f0_192 sf
(create file, open for reading and writing \(descriptor )S
f2_192 sf
(fd)S
6816.266 2439.43 :M
f0_192 sf
(\))S
2323.291 2713.914 :M
-.036(delete file \(use )A
f2_192 sf
-.04(unlink)A
f0_192 sf
(\))S
2611.302 2953.605 :M
f0_160 sf
(as file is open, its directory entry is removed but the file is not )S
2611.302 3146.903 :M
(yet actually deleted \(only files not open used can be deleted\))S
2323.291 3413.655 :M
f0_192 sf
-.014(write data to the file)A
2323.291 3688.14 :M
-.008(rewind the file)A
2611.302 3927.83 :M
f0_160 sf
-.047(do this with )A
3456.135 3927.83 :M
f2_160 sf
-.037(fseek)A
f0_160 sf
-.028( or )A
f2_160 sf
-.046(rewind)A
4539.057 3927.83 :M
f0_160 sf
-.906(; )A
4627.381 3927.83 :M
f6_160 sf
-.02(do not)A
f0_160 sf
-.016( close andre open it, or it )A
2611.302 4121.129 :M
(will go away!)S
2323.291 4387.881 :M
f0_192 sf
(read data back from the file)S
2323.291 4662.365 :M
(close the file)S
2611.302 4902.056 :M
f0_160 sf
(this will delete it automatically)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 35 35
%%BeginPageSetup
initializepage
(Matt Bishop; page: 35 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 35)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Also, clean out files by overwriting if they contain sensitive data; on )S
825.632 3158.431 :M
-.052(some systems, )A
1491.898 3158.431 :M
f2_96 sf
-.088(trunc)A
1705.027 3158.431 :M
f0_96 sf
(\(2\) or )S
f2_96 sf
(ftrunc)S
2200.406 3158.431 :M
f0_96 sf
(\(2\)zaps the data, too.)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 35)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2323.291 2725.512 :M
f0_192 sf
(Note: cleartext password left in memory)S
2323.291 3003.862 :M
(Bad news if there\325s a core dump, so \311)S
2538.339 3278.346 :M
f8_192 sf
(for\(g = given; *g; g++\))S
2899.313 3556.697 :M
(*g = \324\\0\325;)S
2323.291 4105.665 :M
f0_192 sf
(Can also use )S
f2_192 sf
(bzero)S
3974.555 4105.665 :M
f0_192 sf
(\(3\) or )S
4489.135 4105.665 :M
f2_192 sf
-.038(memset)A
f0_192 sf
-.03(\(3\) if you know)A
2323.291 4384.015 :M
(that the password is under some specific length:)S
2323.291 4658.499 :M
(\()S
f8_192 sf
(void\) bzero\(given, sizeof\(given\)\))S
3897.752 2025.771 :M
f0_288 sf
(Memory Use)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 36 36
%%BeginPageSetup
initializepage
(Matt Bishop; page: 36 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 36)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
-.001(Also, check quality of PRNG if it\325s used for anything sensitive, like )A
825.632 3158.431 :M
(cryptographic keys.)S
825.632 3434.914 :M
f11_96 sf
-.01(Bug in a routine on some systems:)A
825.632 3709.476 :M
f8_96 sf
(int rand\(\))S
825.632 3985.959 :M
f0_96 sf
(Generates a pseudorandom integer between 0 and 2147483647 \( = 2   )S
825.632 4101.16 :M
-.156(\3211\))A
825.632 4377.643 :M
(Warning: low order bits not very random)S
825.632 4515.884 :M
-.112(Use )A
f2_96 sf
-.136(rand48)A
1321.012 4515.884 :M
f0_96 sf
-.343(, )A
1374.774 4515.884 :M
f2_96 sf
(random)S
f0_96 sf
( instead.  Even these are not suitable for )S
825.632 4629.165 :M
-.013(cryptographic purposes, though)A
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 36)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
3486.856 2025.771 :M
f0_288 sf
(Seeding the PRNG)S
2323.291 2725.512 :M
f0_192 sf
-.264(Do )A
f2_192 sf
-.354(not)A
2887.793 2725.512 :M
f0_192 sf
( use time of day, process ID, or any function of )S
2323.291 2957.47 :M
(known \(or easily obtained\) information)S
2323.291 3510.305 :M
(Attacker can guess the seed, and regenerate the )S
2323.291 3738.397 :M
(sequence, and use that as a key to regerate the )S
2323.291 3970.356 :M
(relevant random numbers.)S
gR
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
1 lw
0.5 0.5 2449 3199 rS
endp
%%Page: 37 37
%%BeginPageSetup
initializepage
(Matt Bishop; page: 37 of 37)setjob
%%EndPageSetup
gS 0 0 2450 3200 rC
100 100 2250 3000 rC
0.5 0.5 2449 3199 rS
1 G
100 100 2250 3000 rF
gS
.521 .521 scale
3934.234 5838.777 :M
0 G
f0_128 sf
-.12(Page 37)A
1397.815 418.564 :M
(Writing Safe Privileged Programs)S
464.658 5794.617 :M
-.02(Network Security \32497)A
825.632 3043.23 :M
f0_96 sf
(Conclude: we need to face this problem. As the good doctor \(Seuss\) )S
825.632 3158.431 :M
(says,)S
1113.643 3296.672 :M
(But I\325ve bought a big bat.)S
1113.643 3434.914 :M
-.02(I\325m all ready, you see;)A
1113.643 3571.235 :M
-.019(Now my troubles are going)A
1113.643 3709.476 :M
-.032(To have troubles with )A
f2_96 sf
-.05(me)A
f0_96 sf
(!)S
gR
0 G
477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
1 G
478 328 1500 1124 rF
gS
.26 .259 scale
6777.865 5404.632 :M
0 G
f0_112 sf
(Slide # 37)S
2503.778 5164.942 :M
-.023(Matt Bishop)A
2503.778 5300.251 :M
-.01(Dept. of Computer Science)A
2503.778 5431.694 :M
(University of California at Davis)S
gR
0 G
534 1315 94 92 rC
534 1315 :M
1227 889 :T
psb
currentpoint
pse
-1227 -889 :T
628 1407 :M
1227 889 :T
psb
/picTop exch def
/picLeft exch def
currentpoint
/picBottom exch def
/picRight exch def
[ 283 374 327 417]
1 dict begin /s exch def
picLeft picTop translate
picRight picLeft sub s 2 get s 0 get sub div
picBottom picTop sub s 1 get s 3 get sub div
scale
s 0 get neg s 3 get neg translate
end
/showpage {} def
/copypage {} def
%!PS-Adobe-2.0 EPSF-1.2
%%BoundingBox: 283 374 327 417
%%BeginPreview: 45 44 1 44
% 0001f8000000
% 000fe0000000
% 001f00000000
% 007300000000
% 00c300000000
% 00e300000000
% 003f78000000
% 0007f8000000
% 000300000000
% 000301fe0000
% 0003e0fe0000
% 00033c200000
% 000303b00000
% 000300f00000
% 001fe0380000
% 0067180c0000
% 018706060000
% 020705030000
% 040308818000
% 0c0308408000
% 120310204000
% 210310306000
% 208320d02000
% 404321083000
% 402372081000
% 80137c041000
% 800bd0041800
% 8007e0040800
% 8003c0040800
% fffffffc0c00
% 8003c0040400
% 8005b0040f80
% 800e4c041e40
% 403a23082a60
% 407220c84690
% 20921030c688
% 21021010a778
% 120208209f88
% 0c0204409f88
% 04020480e678
% 020203004510
% 01820e002920
% 0062180018c0
% 001fe0000f80
%%EndImage
%%EndPreview
/InitDictCount countdictstack def
gsave
save
mark
newpath
/showpage {} def
%!PS-Adobe-2.0 EPSF-2.0
%%Title: bike.ps
%%Creator: XV Version 3.01  Rev: 3/30/93  -  by John Bradley
%%BoundingBox: 281 371 331 421
%%Pages: 1
%%DocumentFonts:
%%EndComments
%%EndProlog

%%Page: 1 1

% remember original state
/origstate save def

% build a temporary dictionary
20 dict begin

% define string to hold a scanline's worth of data
/pix 7 string def

% lower left corner
281 371 translate

% size of image (on paper, in 1/72inch coords)
49.96800 49.96800 scale

% dimensions of data
50 50 1

% mapping matrix
[50 0 0 -50 0 50]

{currentfile pix readhexstring pop}
image
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffffffffffffff
ffff81ffffffff
fffc07ffffffff
fff83fffffffff
ffe33fffffffff
ffcf3fffffffff
ffc73fffffffff
fff021ffffffff
fffe01ffffffff
ffff3fffffffff
ffff3f807fffff
ffff07c07fffff
ffff30f7ffffff
ffff3f13ffffff
ffff3fc3ffffff
fff807f1ffffff
ffe639fcffffff
ff9e3e7e7fffff
ff7e3ebf3fffff
feff3ddf9fffff
fcff3defdfffff
fb7f3bf7efffff
f7bf3bf3e7ffff
f7df37cbf7ffff
efef37bdf3ffff
eff7237dfbffff
dffb20fefbffff
dffd0bfef9ffff
dffe07fefdffff
dfff0ffefdffff
c0000000fcffff
dfff0ffefeffff
dffe93fefc1fff
dffc6cfef86fff
eff1773df567ff
efe377cdee5bff
f7db7bf3ce5dff
f7bf7bfbd621ff
fb7f7df7d81dff
fcff7eefd81dff
feff7edfc661ff
ff7f7f3feebbff
ff9f7c7ff5b7ff
ffe779fff9cfff
fff807fffc1fff
ffffffffffffff
ffffffffffffff


showpage

% stop using temporary dictionary
end

% restore original state
origstate restore

%%Trailer
countdictstack InitDictCount sub { end } repeat
cleartomark
restore
grestore
pse
gR
gS 477 327 1500 1125 rC
gS
.26 .259 scale
2807.15 2095.358 :M
f0_288 sf
(Programming Tip: Good Style)S
gR
649 750 1151 456 rC
gS
2.048 2.054 scale
317.389 385.58 :M
f0_24 sf
(\245)S
344.245 385.58 :M
-.04(use a system like )A
534.679 385.58 :M
f2_24 sf
-.221(lint)A
565.441 385.58 :M
f0_24 sf
-.003( to check your code)A
360.359 416.251 :M
f0_18 sf
-.001(If using ANSI C, the GNU compiler has many wonderful options)A
360.359 435.238 :M
(that have a similar effect; I recommend -Wall -Wshadow)S
360.359 454.225 :M
-.033(-Wpointer-arith -Wcast-qual -W)A
317.389 487.331 :M
f0_24 sf
(\245)S
344.245 487.331 :M
-.011(test using random input and any bogosities you)A
344.245 511.186 :M
-.052(can think about)A
360.359 542.344 :M
f0_18 sf
-.007(See the marvelous article "An Empirical Study of the Reliability of)A
360.359 561.331 :M
-.008(Unix Utilities," by Miller, Fredriksen, and So in  )A
733.413 561.331 :M
f2_18 sf
(Communications)S
360.359 580.318 :M
(of the ACM)S
f0_18 sf
( )S
f3_18 sf
(33)S
475.107 580.318 :M
f0_18 sf
(\(12\) pp. 32-45 \(Dec. 1990\))S
gR
gR
gS 477 327 1500 1125 rC
377.5 227.5 1699 1324 rS
gR
4 lw
gS 100 100 2250 3000 rC
475 325 1504 1129 rS
gS
.521 .521 scale
2640.103 3584.675 :M
f11_192 sf
(\245)S
gR
1 lw
0.5 0.5 2449 3199 rS
endp
%%Trailer
end		% md
%%EOF