Sample Midterm

These are sample questions that are very similar to the ones I will ask on the midterm. I expect the midterm will be approximately the same length.

1. Why is a precise statement of security requirements critical to the determination of whether a given system is secure?

2. This function’s purpose is to copy a string from one buffer to another. It is not robust. Find the problems and say how to fix them. Note that the passing of pointers here is defined in the specification of the interface, and so cannot be changed.

   
   void mystrcpy(char *s, char *t)
   {
   	while(*t != '\0')
   		*s++ = *t++;
   	*t = '\0';
   }
   

3. Which of the following demonstrate violations of the principle of least privilege? Please justify your answer.
   1. The Linux root account?
   2. A user whose function is to maintain and install system software. This user has access to the source files and directories, access to only those programs needed to build and maintain software, and can copy executables into system directories for other users. This user has no other special privileges.

4. Into which category or categories of the Program Analysis classification do the following fall?
   1. Buffer overflow causing a return into the stack?
   2. Allowing an ordinary user to alter the password file?
   3. Simultaneous writes to a shared database?
   4. Reading a UNIX file by directly accessing the raw device and reading first the superblock, then the file’s inode, and finally the file’s data blocks?

5. Represent a security compartment label using the notation (security level, set of categories) According to the Bell-LaPadula model, can a user cleared for (secret, {dog, cat, pig }) have read or write access (or both) to documents classified in each of the following ways under the military security model?
   1. (top secret, {dog})
   2. (secret, {dog})
   3. (secret, {dog, cow})
   4. (secret, {moose})
   5. (confidential, {dog, pig, cat})