OntheSecurityofUNIX DennisM.Ritchie Recentlytherehasbeenmuchinterestinthesecurityaspectsofoperatingsystemsandsoftware.Atissueistheabilitytopreventundesireddisclosureofinformation,destructionofinformation,andharmtothefunctioningofthesystem.Thispaperdiscussesthedegreeofsecurity whichcanbeprovidedundertheUNIX◯rsystemandoffersanumberofhintsonhowtoimprove security. ThefirstfacttofaceisthatUNIXwasnotdevelopedwithsecurity,inanyrealisticsense,in mind;thisfactaloneguaranteesavastnumberofholes.(Actuallythesamestatementcanbe madewithrespecttomostsystems.)TheareaofsecurityinwhichUNIXistheoreticallyweakest isinprotectingagainstcrashingoratleastcripplingtheoperationofthesystem.Theproblem hereisnotmainlyinuncriticalacceptanceofbadparameterstosystemcalls—theremaybebugs inthisarea,butnoneareknown—butratherinlackofchecksforexcessiveconsumptionof resources.Mostnotably,thereisnolimitontheamountofdiskstorageused,eitherintotalspace allocatedorinthenumberoffilesordirectories.Hereisaparticularlyghastlyshellsequence guaranteedtostopthesystem: while:;do mkdirx cdx done Eitherapanicwilloccurbecauseallthei-nodesonthedeviceareusedup,orallthediskblocks willbeconsumed,thuspreventinganyonefromwritingfilesonthedevice. Inthisversionofthesystem,usersarepreventedfromcreatingmorethanasetnumberof processessimultaneously,sounlessusersareincollusionitisunlikelythatanyonecanstopthe systemaltogether.However,creationof20orsoCPUordisk-boundjobsleavesfewresources availableforothers.Also,ifmanylargejobsarerunsimultaneously,swapspacemayrunout, causingapanic. Itshouldbeevidentthatexcessiveconsumptionofdiskspace,files,swapspace,andprocessescaneasilyoccuraccidentallyinmalfunctioningprogramsaswellasatcommandlevel.In factUNIXisessentiallydefenselessagainstthiskindofabuse,noristhereanyeasyfix.Thebest thatcanbesaidisthatitisgenerallyfairlyeasytodetectwhathashappenedwhendisaster strikes,toidentifytheuserresponsible,andtakeappropriateaction.Inpractice,wehavefound thatdifficultiesinthisareaareratherrare,butwehavenotbeenfacedwithmalicioususers,and enjoyafairlygeneroussupplyofresourceswhichhaveservedtocushionusagainstaccidental overconsumption. Thepictureisconsiderablybrighterintheareaofprotectionofinformationfromunauthorizedperusalanddestruction.Herethedegreeofsecurityseems(almost)adequatetheoretically, andtheproblemsliemoreinthenecessityforcareintheactualuseofthesystem. EachUNIXfilehasassociatedwithitelevenbitsofprotectioninformationtogetherwitha useridentificationnumberandauser-groupidentificationnumber(UIDandGID).Nineofthe protectionbitsareusedtospecifyindependentlypermissiontoread,towrite,andtoexecutethe filetotheuserhimself,tomembersoftheuser’sgroup,andtoallotherusers.EachprocessgeneratedbyorforauserhasassociatedwithitaneffectiveUIDandarealUID,andaneffective andrealGID.Whenanattemptismadetoaccessthefileforreading,writing,orexecution,the userprocess’seffectiveUIDiscomparedagainstthefile’sUID;ifamatchisobtained,accessis grantedprovidedtheread,write,orexecutebitrespectivelyfortheuserhimselfispresent.Ifthe -2-UIDforthefileandfortheprocessfailtomatch,buttheGID’sdomatch,thegroupbitsare used;iftheGID’sdonotmatch,thebitsforotherusersaretested.Thelasttwobitsofeachfile’s protectioninformation,calledtheset-UIDandset-GIDbits,areusedonlywhenthefileisexe-cutedasaprogram.If,inthiscase,theset-UIDbitisonforthefile,theeffectiveUIDforthe processischangedtotheUIDassociatedwiththefile;thechangepersistsuntiltheprocessterminatesoruntiltheUIDchangedagainbyanotherexecutionofaset-UIDfile.Similarlytheeffec-tivegroupIDofaprocessischangedtotheGIDassociatedwithafilewhenthatfileisexecuted andhastheset-GIDbitset.TherealUIDandGIDofaprocessdonotchangewhenanyfileis executed,butonlyastheresultofaprivilegedsystemcall. Thebasicnotionoftheset-UIDandset-GIDbitsisthatonemaywriteaprogramwhichis executablebyothersandwhichmaintainsfilesaccessibletoothersonlybythatprogram.The classicalexampleisthegame-playingprogramwhichmaintainsrecordsofthescoresofitsplayers. Theprogramitselfhastoreadandwritethescorefile,butnoonebutthegame’ssponsorcanbe allowedunrestrictedaccesstothefilelesttheymanipulatethegametotheirownadvantage.The solutionistoturnontheset-UIDbitofthegameprogram.When,andonlywhen,itisinvoked byplayersofthegame,itmayupdatethescorefilebutordinaryprogramsexecutedbyothers cannotaccessthescore. Thereareanumberofspecialcasesinvolvedindeterminingaccesspermissions.Sinceexecutingadirectoryasaprogramisameaninglessoperation,theexecute-permissionbit,fordirecto-ries,istakeninsteadtomeanpermissiontosearchthedirectoryforagivenfileduringthescan-ningofapathname;thusifadirectoryhasexecutepermissionbutnoreadpermissionforagiven user,hemayaccessfileswithknownnamesinthedirectory,butmaynotread(list)theentire contentsofthedirectory.Writepermissiononadirectoryisinterpretedtomeanthattheuser maycreateanddeletefilesinthatdirectory;itisimpossibleforanyusertowritedirectlyintoany directory. Another,andfromthepointofviewofsecurity,muchmoreseriousspecialcaseisthatthere isa‘‘superuser’’whoisabletoreadanyfileandwriteanynon-directory.Thesuper-userisalso abletochangetheprotectionmodeandtheownerUIDandGIDofanyfileandtoinvokeprivilegedsystemcalls.Itmustberecognizedthatthemerenotionofasuper-userisatheoretical, andusuallypractical,blemishonanyprotectionscheme. Thefirstnecessityforasecuresystemisofcoursearrangingthatallfilesanddirectories havetheproperprotectionmodes.Traditionally,UNIXsoftwarehasbeenexceedinglypermissive inthisregard;essentiallyallcommandscreatefilesreadableandwritablebyeveryone.Inthecurrentversion,thispolicymaybeeasilyadjustedtosuittheneedsoftheinstallationortheindividualuser.Associatedwitheachprocessanditsdescendantsisamask,whichisineffectand-ed withthemodeofeveryfileanddirectorycreatedbythatprocess.Inthisway,userscanarrange that,bydefault,alltheirfilesarenomoreaccessiblethantheywish.Thestandardmask,setby login,allowsallpermissionstotheuserhimselfandtohisgroup,butdisallowswritingbyothers. Tomaintainbothdataprivacyanddataintegrity,itisnecessary,andlargelysufficient,to makeone’sfilesinaccessibletoothers.Thelackofsufficiencycouldfollowfromtheexistenceof set-UIDprogramscreatedbytheuserandthepossibilityoftotalbreachofsystemsecurityinone ofthewaysdiscussedbelow(oroneofthewaysnotdiscussedbelow).Forgreaterprotection,an encryptionschemeisavailable.Sincetheeditorisabletocreateencrypteddocuments,andthe cryptcommandcanbeusedtopipesuchdocumentsintotheothertext-processingprograms,the lengthoftimeduringwhichcleartextversionsneedbeavailableisstrictlylimited.Theencryptionschemeusedisnotoneofthestrongestknown,butitisjudgedadequate,inthesensethat cryptanalysisislikelytorequireconsiderablymoreeffortthanmoredirectmethodsofreadingthe encryptedfiles.Forexample,auserwhostoresdatathatheregardsastrulysecretshouldbe awarethatheisimplicitlytrustingthesystemadministratornottoinstallaversionofthecrypt commandthatstoreseverytypedpasswordinafile. Needlesstosay,thesystemadministratorsmustbeatleastascarefulastheirmostdemandingusertoplacethecorrectprotectionmodeonthefilesundertheircontrol.Inparticular,itis necessarythatspecialfilesbeprotectedfromwriting,andprobablyreading,byordinaryusers -3-whentheystoresensitivefilesbelongingtootherusers.Itiseasytowriteprogramsthatexamine andchangefilesbyaccessingthedeviceonwhichthefileslive. Ontheissueofpasswordsecurity,UNIXisprobablybetterthanmostsystems.Passwords arestoredinanencryptedformwhich,intheabsenceofseriousattentionfromspecialistsinthe field,appearsreasonablysecure,provideditslimitationsareunderstood.Inthecurrentversion,it isbasedonaslightlydefectiveversionoftheFederalDES;itispurposelydefectivesothateasilyavailablehardwareisuselessforattemptsatexhaustivekey-search.Sinceboththeencryption algorithmandtheencryptedpasswordsareavailable,exhaustiveenumerationofpotentialpasswordsisstillfeasibleuptoapoint.Wehaveobservedthatuserschoosepasswordsthatareeasy toguess:theyareshort,orfromalimitedalphabet,orinadictionary.Passwordsshouldbeat leastsixcharacterslongandrandomlychosenfromanalphabetwhichincludesdigitsandspecial characters. Ofcoursetherealsoexistfeasiblenon-cryptanalyticwaysoffindingoutpasswords.For example:writeaprogramwhichtypesout‘‘login:’’onthetypewriterandcopieswhateveristyped toafileofyourown.Theninvokethecommandandgoawayuntilthevictimarrives. Theset-UID(set-GID)notionmustbeusedcarefullyifanysecurityistobemaintained. Thefirstthingtokeepinmindisthatawritableset-UIDfilecanhaveanotherprogramcopied ontoit.Forexample,ifthesuper-user(su)commandiswritable,anyonecancopytheshellonto itandgetapassword-freeversionofsu.Amoresubtleproblemcancomefromset-UIDprograms whicharenotsufficientlycarefulofwhatisfedintothem.Totakeanobsoleteexample,thepreviousversionofthemailcommandwasset-UIDandownedbythesuper-user.Thisversionsent mailtotherecipient’sowndirectory.Thenotionwasthatoneshouldbeabletosendmailto anyoneeveniftheywanttoprotecttheirdirectoriesfromwriting.Thetroublewasthatmailwas ratherdumb:anyonecouldmailsomeoneelse’sprivatefiletohimself.Muchmoreseriousisthe followingscenario:makeafilewithalinelikeoneinthepasswordfilewhichallowsonetologin asthesuper-user.Thenmakealinknamed‘‘.mail’’tothepasswordfileinsomewritabledirec-toryonthesamedeviceasthepasswordfile(say/tmp).Finallymailthebogusloginlineto /tmp/.mail;Youcanthenloginasthesuper-user,cleanuptheincriminatingevidence,andhave yourwill. Thefactthatuserscanmounttheirowndisksandtapesasfilesystemscanbeanotherway ofgainingsuper-userstatus.Onceadiskpackismounted,thesystembelieveswhatisonit. Thusonecantakeablankdiskpack,putonitanythingdesired,andmountit.Thereareobvious andunfortunateconsequences.Forexample:amounteddiskwithgarbageonitwillcrashthe system;oneofthefilesonthemounteddiskcaneasilybeapassword-freeversionofsu;otherfiles canbeunprotectedentriesforspecialfiles.Theonlyeasyfixforthisproblemistoforbidtheuse ofmounttounprivilegedusers.Apartialsolution,notsorestrictive,wouldbetohavethemount commandexaminethespecialfileforbaddata,set-UIDprogramsownedbyothers,andaccessible specialfiles,andbalkatunprivilegedinvokers.