Take the following examples:
When I run
sshd
, it can in theory grant access to anything that the process itself has access to, regardless of provided credentials. For example, I could in theory modify a singleif
statement in thesshd
source to grant access to my home directory to anyone.On the other hand, if I encrypt my home directory and it can only be decrypted with my login password,
sshd
(and a localroot
session, for that matter) could only access that information with either my password or some extreme coincidence of poor and malicious programming.
In the first case, my home directory is compromised if a single predicate misbehaves in sshd
. In the second case, a compromise, accidental or otherwise, is extremely unlikely unless my password is compromised or the encryption algorithm is flawed.
We could also include analogous physical scenarios, and (in some sense) "security through obscurity", e.g., ssh
couldn't connect to my machine without knowing its IP address.
Does this distinction occur somewhere in the discourse of access control? For example, if I wanted to refer to a system where an unreliable agent can easily compromise access, vs. one where that is extremely unlikely. (It seems like this is a superset of the DAC vs. MAC distinction.)