Automated programs check protection
settings of all protected resources in a system to verify that they are
properly set. Examples include:
several Unix-based tools,
NID and similar multi-platform tools, and
network security management tools.
Complexity: If proper protection settings can be decided by a fixed time
algorithm, it takes linear time to check (and/or set) all of the protection
bits in a system. Making a decision of the proper setting may be quite
complex and may interact in non-trivial ways with the design of programs. In
many cases, commonly used programs operate in such a way that it is
impossible to set privileges properly with regard to the rest of the system
- for example database engines may require unlimited read access to the
database while internal database controls limit access by user. Since
external programs can directly read the entire database, protection should
prohibit access by non-privileged users, but since the database fails under
this condition, protection has to be set incorrectly in order for other
functions to work.
fc@red.a.net
