Subject: partial lock security concerns

From: Andy Bierman <[email-masked]>
Date: Fri, 07 Dec 2007 08:46:55 -0800

Hi,

I am somewhat concerned about the security vulnerabilities
created by a partial-lock solution based on arbitrary Xpath expressions.
I assure you that the Security Area Director will be even more
concerned, once he hears about it.

Granting access at the time the Xpath expression is configured,
instead of when access is requested is not good enough security.

Even if the Xpath expression was checked at access request time,
there are still problems.

Consider the possibility that the Xpath expression allows more
nodes that the intended set to be accessed, under spurious conditions.
The operator who wrote the Xpath expression is not aware this hole exists.

Consider the possibility that a hacker knows the security configuration,
and knows when and how to take advantage of the 'extra access'.

The only safe solution is to base the locks on stable information,
which cannot be edited under any circumstances by a user.
Only the 'naming' information (QName path from root) meets this
requirement.

Andy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>

---

From: Martin Bjorklund <[email-masked]>
Date: Fri, 07 Dec 2007 18:29:13 +0100 (CET)

Hi,

> instead of when access is requested is not good enough security.

We don't grant access at the time the XPath expression is evaluated.
We set the lock on the node set returned by the XPath evaluation.
This lock may fail if the user does not have enough priviliges.  After
that, it works just like the global lock - you cannot change something
you don't have access to, even if it is locked.  Just like the global
lock.

/martin