Re: [Caja] Important new paper: The Need for Capability Policiies

On 11/07/2013 10:41 AM, Ben Laurie wrote:
> Its not clear that this is actually a bad thing - for example, the
> experience with SELinux appears to be that detaching policy from code
> leads to very complex policies that do not stay in step with code. It
> could be argued that capability policies are less likely to suffer
> from this problem, since they are more clearly aligned with the
> objects in the code than the kinds of objects SELinux has to put up
> with. But I think the jury is still out on that one.

Ultimately, I think security policies will either need to be extractable 
from programs ala proof carrying code. Or the programming language must 
be sufficiently powerful that a program and its security policy can be 
extracted from it, ala Coq which can extract OCaml correct programs from 
its proofs.

Sandro