Re: Capsicum: Object capabilities for Linux

On 10/9/2013 12:56 PM, Tony Arcieri wrote:
> Seems relevant to this list's interests:
>
> https://github.com/google/capsicum-linux

Well...  I see Capsicum (misspelled in the subject - I corrected it in 
this message) has been discussed on this list in the past.  It didn't 
catch my attention before as I've been lurking and not very active.  Now 
that it has caught my attention I'd like to bring up some topics 
(questions, etc.) and see if there are others interested enough to 
comment.  Sorry if the questions are naive.

The first 5 questions refer to this 2010 talk by Robert Watson:

http://www.youtube.com/watch?v=raNx9L4VH2k

1.  At about 13:39 he says, "There are some ways in which our kernel 
capabilities are not fully featured in a true capability system sense.  
For example, we don't support arbitrary interposition of all operations 
on kernel provided capabilities - which leads to some design downsides 
which we'll talk about as well."

He wasn't truthful about that in that he didn't talk about it later.  
So...  Inquiring minds want to know.  Why didn't they allow arbitrary 
interposition of all operations on kernel provided capabilities?  For 
that matter, what are the operations on 'capabilities' (kernel 
"provided" or otherwise)?  I guess I would like to hear about the 
'design downsides' that he refers to, though I think I can pretty well 
imagine at least some of them (see #7 below).

2.  I notice he mentioned JoeE.  Is there any work seeing if JoeE can 
operate in one of these Capsicum sandboxes so as to support a faithful 
mapping between the Capsicum implemented capabilities and JoeE objects?

3.  Same question for E.

4.  He mentioned Power Boxes.  Has any work been done on a windowing 
environment where it's the window manager that creates the "sandboxes" 
for applications that run with capability access only?

5.  He says that Google is working on a port for Linux?  Is that still 
active work?  If so, what is it's state?  If the Linux work is a true 
"port", does that suggest that the interfaces will go over unchanged (no 
hope for a more true object capability interface??

---  Just a mild style comment on the talk:  Dr. Watson seems very 
deferential in his discussion of comparisons with MAC mechanisms - such 
as SELinux.  I have to admit that I have an automatic gag reflex 
whenever I write or speak the word SELinux, but I think that even 
objectively Dr. Watson didn't make clear just how problematic the global 
policy mechanisms of something like SELinux are.  It's like trying to be 
God or a Communist government developing a 10 year plan and tracking, 
via explicit policy, everything that goes on in a computer system (not 
to mention network).  Things change too quickly.  It simply can't be 
done.   With capabilities (access control objects) you allow the 
programmers to manipulate access control where it makes sense through 
the communication channels between what he refers to as "sandboxes" (in 
other contexts processes or domains).  I believe this distinction is 
significantly more than religion.

Now diverging a bit from the talk:

6.  How do people feel about the possibility of, uh, 'moving' (pulling, 
perhaps dragging) security interfaces in the direction of objects by 
transiting code in Unix from ambient authority to capability access 
control through a mechanism like Capsicum?

7.  If there is any hope for such movement, isn't it important to get 
the capability model 'right' (at least supporting 'arbitrary 
interposition' - as Robert puts it) to allow mechanisms like membranes 
and perhaps [dare I say it?] things like network capabilities (trying 
not to wet my pants) and perhaps a mechanism like Horton?

8.  Speaking of network capabilities - does anybody see any 
opportunities for productive synergies between Capsicum and Waterken?

Thanks for any time folks might have to respond.  I'll try to stay tuned 
in for any discussion.  I'd be quite interested in any friam meeting 
that would focus on opportunities and issues presented by Capsicum.

--Jed