Microsoft Says Other OSes Should Imitate UAC

COA writes "Many Vista adopters find User Account Control irritating, but Microsoft thinks it's an approach other OSes should emulate. Microsoft Australia's Chief Security Adviser Peter Watson calls UAC a great idea and 'strategically a direction that all operating systems and all technologies should be heading down.' He also believes Microsoft is charting new territory with UAC. 'The most controversial aspect of Watson's comments all center around the idea that Microsoft is a leader with UAC, and that other OSes should follow suit. UAC is a cousin of myriad "superuser" process elevation strategies, of which Mac OS X and all flavors of Linux already enjoy. The fact is that Microsoft is late to the party with their Microsoftized version of sudo. That's really what UAC is, after all: sudo with a fancy display mechanism (to make it hard to spoof) and extra monitoring to pick up on "suspicious" behavior.'"

Comments

Re:Or not?

[frankie]

How about UAC starts imitating better designed privilege escalation mechanisms from Linux or OS X?

I'm a card-carrying Mac cultist, but I really can't agree that the root password prompt in OS X is well designed. It could easily be severalfold better if they tried. For starters, it's all or nothing, with insufficient information. The little detail dropdown arrow should open up to an elegantly indented list of what privileged actions the app intends to do. Copy a plugin into /Library/foo? Install a kernel extension? Delete all user documents?

Also, if memory serves, there are still situations where an installer app is allowed to simply take root access for itself without asking. Only Lord Steve knows why no one has abused that yet. And MAC on Mac awaits its Leopardly debut...

Re:Obligatory

[truthsearch]

It's no joke. They really do believe they invented the idea:

Patent #6,775,781

Re:Hello Microsoft

[toadlife]

I manage several labs and have had to deal with this type of crap software for ages. There are better solutions than giving students admin rights and using expensive band-aides like deepfreeze.

Repackage those programs into msi installers using wininstall (or admin studio if your boss will spring for it). Set permissions on files/directories with a machine startup script using cacls and set registry permissions via group policy or the command line. You can find out where the programs are trying to write with process monitor by sysinternals.

Students in my labs log on as guests and all of the crap software they have to run works just fine. It takes a lot of work up front, but once you get a piece of software repackaged and proper permissions script worked out, you can deploy it using GPOs and never have to think about it again. Most of my labs, I have not visited in over a year.

We should go beyond sudo

[TheLink]

A modern OS should be having something that's much better than sudo.

Modern desktop class OSes should have sandbox _templates_, with apps being allowed to "suggest" a template.

Then if an app claims to be a "plain old screen saver", it only gets "plain old screen saver" rights - which means no network access, no access to the user's files etc.

If it claimed to be a "standard network game" then it gets different sort of access - file system access to its own "app specific data folder" in the user's home directory, access to full-screen graphics, sound _playback_ (not recording[1]), limited network access (as per requested).

If some flash applet "game" somehow requires "full administrative system privileges", go figure...

[1] Only a few apps should be allowed to record sound - stuff like skype, voice chat app for games. Your word processor should not be recording sound. The O/S should handle the voice control stuff if you like that sort of crap. And by default you may not wish to allow an app to record sound while backgrounded or just sitting in the "systray".

Re:We should go beyond sudo

[fritsd]

A great idea!
Let's call it "Role-Based Access Control". I believe that's what SElinux does (and several other systems too).
According to the wikipedia, also Microsoft Active Directory, so why didn't they use their own existing implementation to put it in MS Vista's UAC?
Now that I'm posting anyway, can a kind soul explain why spamassassin (scontext=system_u:system_r:spamd_t) gives so many audit errors? Should I add something in its macros?

Re:Obligatory

[IWannaBeAnAC]

Right, but that is not why Microsoft have the patent. There is no way they would bother trying to enforce it, they wanted it because it gives them one more patent to say "Linux infringes on N+1 Microsoft patents. It isn't legally safe to use Linux."... And then demonstrate how benevolent they are by choosing not to sue you.

Aside: what makes you think 'sudo' dates from 1989? Isn't it more like 30 years' prior art?

Re:Obligatory

[Hijacked Public]

I certainly hope so. If this is the direction security needs to go it will have to stop being so annoying.

I have a collegue (photographer) who bought a new machine with Vista. Had it about a month and called me because he couldn't get Photoshop CS3 to install. We figured out that the problem was that CS3 wants Firefox.exe to close before it will install, which is annoying in the first place because I can't imagine a really good reason a photo editor needs to make modifications to your web browser.

Anyway, despite shutting down FF and even rebooting CS3 always told him it was running. Turns out he had some variant of a Poison Ivy trojan than resulted in a persistant Firefox.exe process. While he may well have clicked past a UAC prompt in the process of letting this trojan get in Vista still didn't stop it, his AV software didn't detect it, and neither did Windows Defender. While it took a CS3 install to alert him to a problem the very fact that most bits of Windows software all want to modify your registry, play with your browser settings, etc., is why he let it infect him in the first place.

If you can't stop that stuff with 3 layers of software and who knows how many user prompts then something has to change. It isn't going to be the user.

A Brief History of Sudo

[Kadin2048]

As referenced in the manpage; available online here

A Brief history of sudo(8):

Sudo was first conceived and implemented by Bob Coggeshall and Cliff Spencer around 1980 at the Department of Computer Science at SUNY/Buffalo. It ran on a VAX-11/750 running 4.1BSD. An updated version, credited to Phil Betchel, Cliff Spencer, Gretchen Phillips, John LoVerso and Don Gworek, was posted to the net.sources newsgroup in December of 1985.

In the Summer of 1986, Garth Snyder released an enhanced version of sudo. For the next 5 years, sudo was fed and watered by a handful
of folks at CU-Boulder, including Bob Coggeshall, Bob Manchek, and Trent Hein.

In 1991, Dave Hieb and Jeff Nieusma wrote a new version of sudo with an enhanced sudoers format under contract to a consulting firm called "The Root Group". This version was later released under the GNU public license. ...

The original post to Usenet is available in Google's archive here, although I don't know if that URL is stable or not. But the whole thing is there, including the source, all in plaintext, dated Dec 15, 1985. From reading the discussion it looks as if some other people had similar programs earlier, though, including one called "asroot" which seems a lot less robust.

Re:Obligatory

[r3m0t]

The original plan was to require Ctrl+Alt+Del *and* the user's password on every UAC prompt. (See the Vista team blog.) They removed this requirement after user testing, also taking a more lax view of what should require UAC. (In my view, in the Control Panel, not lax enough.)