Re: [patch 2.1.97] more capabilities support

Andrej Presern (andrejp@luz.fe.uni-lj.si)
Wed, 22 Apr 1998 01:52:13 +0200


Albert D. Cahalan wrote:
>
> >> The real problem here is that it is hard to defend against poorly
> >> written code that requires privilege. The benefit from capabilities
> >> over the setuid case is that you can limit the damage...
> >
> > Actually, it's very easy. Just don't give it more authority than it
> > needs. If you give the program only one direction where it can shoot at,
> > it doesn't matter that much anymore if the code is right or wrong from
> > the security perspective, because the program can't shoot anywhere else
> > than in that one direction anyway. The only thing that it can do then is
> > shoot a faulty bullet that won't reach the target (or will blow up the
> > gun, killing the shooter, which is a good thing because it will point
> > out the bug so that it can be fixed).
>
> I believe we were discussing POSIX capabilities, not pure capabilities.
>
> I'll mail you about the pure capabilities later, but it appears that
> they are fairly useless outside of an environment like EROS:
> persistent system image, long-lived processes, NO FILESYSTEM, and
> every scrap of data is an object associated with some code.

You haven't even looked at the design:) Most of what you named above is
actually desired by the Linux community, but we are not _able_ to do
what others seem to do without problems on alternative platforms:) Do
you actually know of any pure capability based systems that doesn't have
persistency?:) And how many of the ACL based systems (even those
developed by hi powered companies) sport such features efficiently and
cleanly?

All the features that you have named are because of a different design
of the operating system, don't you agree? So isn't it perhaps time that
we start to consider alternative concepts for mainstream operating
systems or at least start implementing known solutions to problems that
our systems have?

[by the way, every scrap of data _is_ associated with some code that
operates on it, if you don't count wasted resources]

> That persistent system image is nice for hardware failures,
> but it means you get to repeat software crashes at every reboot!
> Removal of the persistent system image is a reinstall.

This is a fixation:) You actually get more control over the objects in
the system and the interaction among them, so you can quickly and
painlessly isolate the problematic object and replace/repair it:) It's
like successfully doing surgery on the pacient while the pacient is
taking a walk:)

> I hope everyone has seen this by now:
> http://agn-www.informatik.uni-hamburg.de/people/1ott/rsbac/index.htm

Yes, we have seen it, but the thesys is in German (the author says he'll
maybe try a translation one day (it's written in the second paragraph of
the first section on the homepage)).

Andrej

-- 
Andrej Presern, andrejp@luz.fe.uni-lj.si

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu