[Coco] Telnet to your CoCo.. and invite 6 of your friends

[Aaron Wolfe]

You are correct, OS-9 has permissions at the file system level that
can make it possible to control read/write/execute based on the
current user.  It's similar to unix without the concept of groups.
This is quite impressive for a micro operating system of the day.. DOS
had nothing of the sort.

Unfortunately, it is quite simple for one user to become another user
(in the eyes of the system).  If you let any user execute arbitrary
code, they can effectively access any part of the system.  An
environment like a BBS *should* prevent a user from doing this.
However, especially in code written in low(er) level languages like C,
pascal or assembler, it is often possible for a malicious user to
inject executable code into unexpected places.  Buffer overruns are a
classic means of causing the CPU to run foreign code, and I'd bet they
are common in OS-9 apps.  Safe coding just wasn't much of a concern
anywhere back then, especially not on a microcomputer.

Allowing a user to access an OS-9 shell is basically allowing them to
run their own code, so all bets are off if they have bad intentions.

You could probably spend a lot of time auditing system and application
code and make it pretty difficult for the user to exceed their
permissions, but as Willard mentioned the MMU in the Coco cannot
protect memory, so I think a malicious user would always be able to
circumvent controls if they had the ability to introduce executable
code.  In a Coco, all memory is considered executable if I understand
correctly, so preventing this would basically mean preventing the user
from changing anything in RAM.. not very practical.

I think it would be possible to run a pretty safe BBS on a Coco
despite these limitations.  We can filter out any control/break keys
before they reach the Coco if that is a concern (I remember trying to
get a BASIC BBS running on my Coco many, many years ago.  One of the
patches disabled break so that callers could not just stop the program
:)

-Aaron


On Sat, Nov 28, 2009 at 11:37 PM, Wayne Campbell <asa.rand at yahoo.com> wrote:
> I am probably too ignorant to even touch on this topic, but it seems to me it's a matter of permissions. Just like with Unix, OS-9 allows you to set access permissions based on the attributes of the file/folder/program. In order for a user to use a program, they have to have permission to access the directory, and the file and/or program to use it.
>
> With this in mind, one can establish a userlevel that makes it possible to prevent users with lower access levels from using or accessing things requiring higher access levels. Is this not the case with OS-9?
>
> I seem to recall something about userlevel using tsmon. Again, I'm not that educated in this field, so please forgive any implication of understanding on my part.
>
> Wayne
>
>
>
>
> ________________________________
> From: Willard Goosey <goosey at virgo.sdc.org>
> To: CoCoList for Color Computer Enthusiasts <coco at maltedmedia.com>
> Sent: Sat, November 28, 2009 8:31:05 PM
> Subject: Re: [Coco] Telnet to your CoCo.. and invite 6 of your friends
>
> On Sat, Nov 28, 2009 at 05:53:53PM -0500, Aaron Wolfe wrote:
>> "Security" in OS-9 seems to be mostly based on the honor system.
>
> Unfortunately.  I'd always been under the impression that while the
> security wasn't complete, what was there worked properly. This doesn't
> seem to be the case.
>
>>The real limitation is that the Coco cannot protect
>> memory as far as I can tell.
>>
> Correct.  It's a hardware limitation of the MMU, not the operating
> system's fault.
>
>> I mostly guess people would use this feature to run a multiline BBS,
>> which *should* have it's own security,
>
> Yeah, I never did the BBS thing, so I don't really understand it.
> Without shell access, what's the point? ;-)  See, my first experience
> with multi-user machines was UNIX.
>
>> It would also be trivial to add a simple password check before
>> allowing a connection to a port, if that would be useful.
>
> I believe there are replacement login programs with a real(-ish ;)
> password program with them on RTSI.
>
> Willard
> --
> Willard Goosey  goosey at sdc.org
> Socorro, New Mexico, USA
> I search my heart and find Cimmeria, land of Darkness and the Night.
>  -- R.E. Howard
>
> --
> Coco mailing list
> Coco at maltedmedia.com
> http://five.pairlist.net/mailman/listinfo/coco
>
>
>
>
>
> --
> Coco mailing list
> Coco at maltedmedia.com
> http://five.pairlist.net/mailman/listinfo/coco
>