Not all bugs in the TCB are exploitable as security holes.
Here the TCB includes the kernel and domain code that is relied upon for some application’s security.
There are two situations regarding the role of the code that implements some sort of object, be it in the kernel or a domain.
- The behavior of an instance of some sort of object depends only on the use that the holder of the instance makes of the instance.
- The behavior depends on the mode of use of other instances of the object.
In my preferred frame of reference I would say that cross talk occurs in the case of shared mutable objects.
This dispenses with any concept of object class or sort.
The plan that I have heard for file logic in Mach presumes that one shared object tends to all of the files.
If I should exploit a bug in the file logic I may well be able to ruin your files.
In Keykos, by contrast, the segment keeper code produces instances that share no mutable objects and my security depends only no not using the segment keeper in a say that provokes the bug.
Further if I do provoke the bug isolation insures that the worst that happens is that my segment misbehaves,
You will not be able to read or influence the state of my broken segment.