Commit c7ae5497 authored by Kees Cook's avatar Kees Cook Committed by Valerie Aurora (Bow Shock)
Browse files

MI-USR*: Add tests for DAC and "seat count" 

Do we want to have explict tests for RF-NUSR and RF-CUSR? I imagine it
would look like this. This kind of feels redundant, but we don't seem
to call out these things yet in the MI section.
parent 15e4404a

EN-304-626.md

+24 −0
Original line number Diff line number Diff line
@@ -938,6 +938,30 @@ Each mitigation is described with the following fields: 


Threat: attacker tries to access memory that belongs to another user or the kernel in an unauthorized manner.



#### 5.2.X.x **MI-USRSEP**: User account separation



Use case: system where multiple users are expected to concurrently share the system's resources or services



* Mitigation: use user identifiers, discretionary access control, or mandatory access control to separate user data and processes

* Test: with the privileges of 1 user, attempt to read and modify stored private data and process memory owned by another user

* Result: failure to read or modify stored data, failure to access process memory

* Output: error message logged by the test

* False positive test: read public data owned by another user

* Requirements: way to read log output on product as shipped

* Documentation: source code of test, log output during test



#### 5.2.X.x **MI-USRCON**: Non-concurrent account usage



Use case: system where only a single user is expected to be logged in at a time



* Mitigation: reject a user account from logging in if another user is already logged in

* Test: with 1 logged in, attempt to log in as a second user

* Result: failure to log in

* Output: error message logged to system log

* False positive test: log in after a free system boot

* Requirements: way to read log output on product as shipped

* Documentation: source code of test, log output during test



#### 5.2.X.x **MI-SSCA**: Static source code analysis for memory protection



Use case: operating systems where all executables share a single address space, memory protection settings, and processor privilege level (e.g. embedded, low power, special purpose, unikernel)