Thursday, July 17, 2008

UNIX privilege protection

Recently I am developing a feature where I need to protect a file from all users including the root. Most of the kernels do this by restricting the permissions stuff and/or attaching some special flags with the files notifying that this file should not be touched. While shaving this morning, I had a weird idea.
I want to protect a file, so restricting the permissions to root is an obvious thing to do here. But still root can modify this file. If I want to block root user as well, what if I had an another internal root like user? This would also be a root user, say a root cousin which is invisible to outside world. So in this case, root can read the file but can not modify it. I know this breaks the standard UNIX legacy we have that there is only one powerful god and that is root. What if we shatter this? There would be more than one god, so would there be a clash of titans? No, the rule is one god does not interfere with other god. The gods are read-only while interfering with another god. In this case, it gives an impression that root user is not able to modify certain file. Since internally this file is owned by root cousin, root is not able to change/modify it. So the change of behavior is quite noticeable. I don't know if this would be acceptable.
Since this root cousin is invisible to end user, he/she can not inherit root cousin privileges. And a root user can not change/modify the files that need to be protected.
This is a very simple idea and might have occurred to a lot of people. The moment I struck it, I felt like noting it down somewhere and thats why I am posting it here. I still need to figure out how to implement this. Will update about it soon.
Few basics on how to implement this. This root cousin needs a dedicated uid and gid at least for UNIX. This uid and gid can not be used by end user. Kernel uses this identifiers for its own protection. So there is no way an end user can make a file owned by root cousin. Only the kernel is able to use these dedicated uid and gid in order to protect some files even from root. So it is quite obvious that we should not use these root cousin privileges everywhere. Rather, its use should be kept to minimal. For files, we don't want even root to change/modify, we should make them own by root cousin. While displaying the file properties (ls command), should we display the dedicated uid and gid for root cousin or should we show root uid and gid instead? If we show root uid and gid, the end user will still have the illusion that these files are owned by root but they can not be changed/modified. Great!! This goes well with the UNIX methodology. Lots of questions are popping in my head. Will update again as I have more answers.

Thursday, July 10, 2008

This is not easy


Today we had the pleasure to listen to a talk from a reputed personality Dr Deepak Phatak from IIT-Bombay at our company. For those who don't know, Dr Phatak is an honorable name in Computer Science in India and abroad. He is known for his contribution to Databases, Information Systems and Software Engineering. Today's topic was
Innovation. In precise words, Dr Phatak told the basics of living life. Few key things of his talk are summarized here. The things mentioned below are as per my perspective. If I have misinterpreted Dr Phatak somehow, that is totally a fault of mine. Please step up to correct things if so.

1. Always keep learning : Since early schooling, the students are groomed to mug up the study materials and throw it up in the exams. In this way, we kill the creativity in ourselves. Another important point he raised is to ask questions. Even I have observed that most of us are scared to ask a question in public or more over scare to question something that is going on for ages. Dr Phatak strongly recommended to question the orthodox, conventional methods. Even if it is right, that will satisfy your conscious. Statistics does not always interpret a person completely. Each person is unique in its own way. What matters is his/her thinking line and not his statistics.
2. Don't kill the child (curiosity) in you : As a child is always curious about everything, he is eager to know why certain things are the way they are. Dr Phatak suggested that we should keep alive the curiosity in ourselves. This curiosity will help us find answers to questions that we face. And sometimes, it helps us find better answers that can be categorized as Innovation. So we need to make a habit of being curious so that at least we can answer our own questions. in my opinion, every person has a fear of unknown and this curiosity will definitely help in overcoming this fear. Another point Dr Phatak raised is not to compartmentalize knowledge. Most of us, even I do the same, we try to categorize problems as per their domains like automobiles belong to mechanical engineering, operating systems belong to computer science and so forth. This would have a negative impact on our learning approach. Dr Phatak encouraged to treat every thing as same and not categorize them as per their domains. This will help us to learn about everything around us and not only our domains.
3. Think different : According to Dr Phatak, most of the individuals tend to behave like ox-cart bullocks in a sense that they only know to walk a known path. They do not dare to venture on an unknown path. Came a certain problem, this is the way to solve it, this is their approach. Dr Phatak strongly encouraged to align your thinking patterns on different lines. Conventional wisdom is not always right or rather appropriate to solve certain problems. People who go out of the way, those who think different can make things happen. This does not apply only to Computer Science but to each and every field.
4. Passion for work : In order to innovate, one must have passion that is the driving factor for your thing to work. Without passion, there would be no energy, no enthusiasm in your venture. Only passion can keep alive your venture in rough times. In short, without passion, your venture will be like a body with no soul.
5. Persistence and commitment : Started a venture, persistence and commitment are another properties that can lead it to completion. Like they say, starting a venture is very easy but grooming it, maintaining it is very difficult. Hardwork is definitely a part of life but it is only with persistence and commitment, it can survive your venture.

After listening to Dr Phatak's speech, I realized that he has pointed the very basic things that we have conveniently forgotten. As for myself, by this time, I know what my flaws, my weak points are (not all of them) and I am trying to over come them. But it has been very difficult so far. With the points Dr Phatak mentioned, I think I need to go back to basics. If you build a strong foundation, the structure will thrive.