The list of requirements you came up with was a very low-level set of
requirements. This is why Al Viro called it not much better than we
want a bunch of hooks here, here, and here.
What is needed is the high-level set of requirements --- which in the
case of security fixes, really needs to start with a threat model (or
threat models). See my previous message, where I tried to help you
guys out on this. There are scenarios such as "The Linux Desktop",
where the Clueless User may be tricked to run random binaries. Then
there is the "The Linux Fileserver", where users may upload malware
via CIFS, NFS, et. al, but there aren't any Clueless Users to start
the malware running on said Linux Fileserver, etc. When you do threat
analysis you need to know whether the malware is likely to have
compromised root (superuser) access or not. Etc.
Low-level requirements are things like "this code must take the
number, multiply by it 7, and add 42". High-level requirements answer
the question, why the heck are you trying to do this in the first
place?!?
- Ted
--
