Reflections on UNIX Vulnerabilities Matt Bishop Department of Computer Science University of California at Davis Davis, CA 95616-8562
[email protected] Abstract—The UNIX operating system was developed in composition, or even the proper definition of policy. Instead, a friendly, collaborative environment without any particular it focuses on a particular category of security holes or predefined objectives. As it entered less friendly environments, vulnerabilities for the UNIX1 operating system. Because of expanded its functionality, and became the basis for commer- cial, infrastructure, and home systems, vulnerabilities in the the natural evolution of systems over the years that this paper system affected its robustness and security. This paper presents spans, I construe the terms “UNIX” and “UNIX operating a brief history of UNIX vulnerabilities, beginning with a report system” liberally, to include UNIX-like systems such as written in 1981–1983, but never published. It examines how the Linux. nature of vulnerabilities has (and has not) changed since then, A report I wrote in 1981, and expanded in 1983, motivates and presents some thoughts on the future of vulnerabilities in 2 the UNIX operating system and its variants and other UNIX- this reflection. That report presented several UNIX security like systems. vulnerabilities, and discussed their causes and how to fix them or, where no fixes were available, how to ameliorate Keywords-UNIX security; vulnerabilities; security policy; history; future them. It was circulated among computer security researchers, system administrators, and developers of UNIX systems, but was never published. I. INTRODUCTION This paper examines UNIX vulnerabilities, and their im- In 1981, computer security was not considered a main- pact on UNIX security, in three periods that are roughly stream subdiscipline of computer science.