lkml.org 
[lkml]   [1998]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch 2.1.97] more capabilities support
Andrej Presern <andrejp@luz.fe.uni-lj.si> writes:
> Albert D. Cahalan wrote:
> > I'll mail you about the pure capabilities later, but it appears that
> > they are fairly useless outside of an environment like EROS:
> > persistent system image, long-lived processes, NO FILESYSTEM, and
> > every scrap of data is an object associated with some code.
>
> You haven't even looked at the design:) Most of what you named above is
> actually desired by the Linux community, but we are not _able_ to do
> what others seem to do without problems on alternative platforms:) Do
> you actually know of any pure capability based systems that doesn't have
> persistency?:) And how many of the ACL based systems (even those
> developed by hi powered companies) sport such features efficiently and
> cleanly?
>
> All the features that you have named are because of a different design
> of the operating system, don't you agree? So isn't it perhaps time that
> we start to consider alternative concepts for mainstream operating
> systems or at least start implementing known solutions to problems that
> our systems have?

It seems like what you are saying is "pure capabilities are easy to
implement - just make a bunch of other huge fundamental changes to
Linux first".

Linux isn't a research project - sure it can be used as a test-bed for
OS experimentation, but not the mainstream Linux itself. If something
big and fundamentally innovative is added to Linux, and it turns to
have problems, we can't just write a paper describing the
conclusions. It would waste a huge amount of work, when there are
tried-and-tested OS features that need to be added to Linux.

Adding pure capabilities to Linux looks like it would be complicated,
and emulating the current permissions would be tricky (consider the
chmod syscall). These things would make it difficult to be confident
that an implementation did in fact provide robust security. If you
disagree, demonstrate at least a concrete design for an implementation
of pure capabilities in the current Linux kernel.

I do think that pure capabilities are a great security mechanism in
certain contexts; in distributed systems, implemented as
digitally-signed tickets, for instance.

> [by the way, every scrap of data _is_ associated with some code that
> operates on it, if you don't count wasted resources]

In any non-trivial C program (for instance, the Linux kernel), it is
difficult to prove much at all about which pieces of code can access
which pieces of data. So the "association" only exists in a loose
sense, in the programmer's mind.

--
Dave Wragg

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:42    [W:0.081 / U:0.204 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site