Messages in this thread | | | Date | Fri, 24 Apr 1998 03:45:30 +0100 | From | David Wragg <> | Subject | Re: [patch 2.1.97] more capabilities support |
| |
Andrej Presern <andrejp@luz.fe.uni-lj.si> writes: > Albert D. Cahalan wrote: > > I'll mail you about the pure capabilities later, but it appears that > > they are fairly useless outside of an environment like EROS: > > persistent system image, long-lived processes, NO FILESYSTEM, and > > every scrap of data is an object associated with some code. > > You haven't even looked at the design:) Most of what you named above is > actually desired by the Linux community, but we are not _able_ to do > what others seem to do without problems on alternative platforms:) Do > you actually know of any pure capability based systems that doesn't have > persistency?:) And how many of the ACL based systems (even those > developed by hi powered companies) sport such features efficiently and > cleanly? > > All the features that you have named are because of a different design > of the operating system, don't you agree? So isn't it perhaps time that > we start to consider alternative concepts for mainstream operating > systems or at least start implementing known solutions to problems that > our systems have?
It seems like what you are saying is "pure capabilities are easy to implement - just make a bunch of other huge fundamental changes to Linux first".
Linux isn't a research project - sure it can be used as a test-bed for OS experimentation, but not the mainstream Linux itself. If something big and fundamentally innovative is added to Linux, and it turns to have problems, we can't just write a paper describing the conclusions. It would waste a huge amount of work, when there are tried-and-tested OS features that need to be added to Linux.
Adding pure capabilities to Linux looks like it would be complicated, and emulating the current permissions would be tricky (consider the chmod syscall). These things would make it difficult to be confident that an implementation did in fact provide robust security. If you disagree, demonstrate at least a concrete design for an implementation of pure capabilities in the current Linux kernel.
I do think that pure capabilities are a great security mechanism in certain contexts; in distributed systems, implemented as digitally-signed tickets, for instance.
> [by the way, every scrap of data _is_ associated with some code that > operates on it, if you don't count wasted resources]
In any non-trivial C program (for instance, the Linux kernel), it is difficult to prove much at all about which pieces of code can access which pieces of data. So the "association" only exists in a loose sense, in the programmer's mind.
-- Dave Wragg
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu
| |