1. The Safe-Tcl Security Model John K. Ousterout Jacob Y. Levy Brent B. Welch Present by Yu-Chang SHEN 4 May 2001

2. Outline Introduction on Safe-Tcl Security issues Summary

3. Safe-Tcl Safe-TCL is a mechanism for executing untrusted program written in Tcl scripts safely and for providing mediated access by such scripts to potentially dangerous functionality

4. Aliases Padded Cell Model Master Interpreter Command 1 Command 3 Command 4 Command 5 Command 6 Command 2 Safe Interpreter Command 1 Command 2 Hide Command 4 Command 5

5. Security issues Integrity attacks Privacy attacks Denial of Service attacks

6. Prevent the attacks Denied all operations that modify, read and transmit the state of the host environment Setup security policies Different level of trustiness = Different level of rights

7. Summary Padded Cell model in general is similar to User/Kernel space model Safe-Tcl using padded cell model to prevent integrity and privacy attacks Safe-Tcl can use security policies to regulate permissions that an applet have

8. Questions What is the hardest part of designing Safe-Tcl environment?