openssh unix dev - Jun 2011 - Privilege Separation Design Question

Hello all,

I have a question about the design of the privilege separation aspect of
openSSH. From what I understand, the interface between the privileged
process and the unprivileged one is implemented as a set of well-defined
operations with only a small subset of these operations enabled at any
given time. These operations are enabled and disabled depending on the
task at hand.

What I am wondering is why it was chosen to implement privilege
separation in this fashion, particularly the security implications of
this design. Also, I would like to know if security would be weakened by
allowing a slightly larger subset of operations (namely, PWNAM) to be executed
at any
time.

Thank you in advance for your help, and please respond to my email
address (eanderle at umich.edu) and CC all addresses CC'd here.

Eric

On Thu, 16 Jun 2011, Eric Anderle wrote:
> Hello all,
> 
> I have a question about the design of the privilege separation aspect of
> openSSH. From what I understand, the interface between the privileged
> process and the unprivileged one is implemented as a set of well-defined
> operations with only a small subset of these operations enabled at any
> given time. These operations are enabled and disabled depending on the
> task at hand.
> 
> What I am wondering is why it was chosen to implement privilege
> separation in this fashion, particularly the security implications of
> this design.
The design and motivation of privsep is described in the paper:
http://www.citi.umich.edu/u/provos/papers/privsep.pdf

Operations are generally only exposed when they are needed to limit the
attack surface of the monitor, enforce correct protocol flow and reduce
the opportunities for a compromised slave to reconnoiter through or
request undesirable state changes of the monitor.
> Also, I would like to know if security would be weakened by allowing a
> slightly larger subset of operations (namely, PWNAM) to be executed at
> any time.
getpwnamallow() is used as a state-changing operation in the monitor,
as it is called right before user authentication starts so you'd have to
untangle that to begin with. 

Why would you want to call it more often? The user name isn't supposed
to change during a session.

-d