Re: Capsicum: Object capabilities for Linux

On Fri, Oct 11, 2013 at 12:58 PM, Jed Donnelley <capability-iCFHVraI1K1Wk0Htik3J/[email protected]>wrote:

>  On 10/10/2013 12:53 AM, Bennie Kloosteman wrote:
>
> Capsicum has always been about getting capabilies into existing apps as
> easy as possible  so its not an ideal implementation but gets the job done.
>
>
> I don't know about "ideal", but I do know the value of what Dr. Robert
> Watson refers to as "arbitrary interposition of all operations".  Without
> that much (most?) of the value of capability systems disappears (in my
> view).  Can you explain (or point to a discussion) of why an interface that
> supports arbitrary interposition was considered to be incompatible with
> 'getting capabilities into existing apps as easy as possible'?  It isn't
> clear to me why there would be a conflict, but I expect I could understand
> the answer if somebody explained it.
>
>
>  One common way which works well is to start the app as normal and than
> activate capsicum mode which requires non powerbox caps being set
> beforehand.  This is pretty easy eg i added it to mono eg load the C# app ,
> jit etc , then activate cap mode and run the program. And then file.iodidnt work which is what i wanted as i wanted a new cap file API (winrt) to
> be used , changing everything to caps would have been far too much workbut
> they support that as well.  ( Capsicum does have a client server mode where
> you split the app into trusted and untrusted but its a big job changing
> existing apps) .
>
>
> I think I can understand the work involved, but not why the amount of work
> depends on the support of non-support of "arbitrary interposition of all
> operations" in the capability interface.
>
> I'd love to hear a bit about how directory capabilities work in Capsicum -
> e.g. compared to the way they work in the Tahoe file system or to GNOSIS or
> any of many other interfaces.  Driven by Unix symantics no doubt, but how
> does access right "masking" work when referencing through a directory
> capability?  How are links (hard and soft) handled?
>


Im not a capsicum designer but have used it for a month about 1-2 years ago
- just trying to help . Suggest you post the why question to the capsicum
list.  My use was basically  allow app to do lots of dirty stuff when
starting then turn on cap mode and pass to user and then everything is via
the powerbox.

This model i think is good because existing apps can become cap apps quite
quickly  and then mature.


>
>
>   4.  He mentioned Power Boxes.  Has any work been done on a windowing
> environment where it's the window manager that creates the "sandboxes"
> for applications that run with capability access only?
>
>  I believe so .. on freebsd and X at any rate . ( check
> gpowerboxserver.cpp).
>
>
> Sorry, but I was unable to find any references by searching for "gpowerboxserver.cpp"
> or any of the many variations I tried.  Can you be a bit more explicit?
>

Sorry   there is gpowerboxserver.cpp in the google rep  ( can remember if
capsicum for linux or  chromium caps ) which has lots of x11 references and
i faintly remember  there were some gui powerbox . CHecking the following
shows some gui elements
A Taste of Capsicum: Practical Capabilities for UNIX
|<http://cacm.acm.org/magazines/2012/3/146252-a-taste-of-capsicum/fulltext>

>
>
>
>   "5.  He says that Google is working on a port for Linux?  Is that still
> active work?  If so, what is it's state?  If the Linux work is a true
> "port", does that suggest that the interfaces will go over unchanged (no
> hope for a more true object capability interface??"
>
>  They have been saying that for years but i havent seen anything .. It
> will be hard getting kernel changes approved.
>
>  https://github.com/google/capsicum-linux
>
>  There does seem to be work on the port.
>
>  At any rate these are not big projects so dont expect too much.
>
>  For the much larger linux community there is a lot of momentum  , so
> hard to change  its not the OS  but getting all the apps to be rewritten  ,
> newer runtimes do have caps eg Android has some capabilites and winrt has
> a really good model
>
>
> Pointers?  Does any one person (or a few people) know enough about these
> capability models to contrast them with historical capability models and,
> in particular, with the "arbitrary interposition of all operations"
> property?
>

Trying to give you some but the commercial vendors dont often publsih
desaign issues etc.  Winrt and Android  have well documented APIs  (winrt
is http://msdn.microsoft.com/en-us/library/windows/apps/hh464936.aspx
http://msdn.microsoft.com/en-us/library/windows/apps/hh967755.aspx)  ,  one
of the android authors has posted to this list why they have a limited
mode.

>
>
>   but both platforms allow traditional apps.
>
>
> That seems entirely reasonable to me, but if they support an object
> capability interface model (e.g. as discussed on this list) then there is
> the opportunity to start building a code base for essentially POLA
> applications, libraries, etc.
>


Winrt Surface / windows phone for example is  basically winrt apps only and
is  not a great success but it means all apps are capability , follows POLA
 meaning its is a very secure platform  . Windows 8  for desktop everyone
complains  and favours desktop  so they never really move to the newer API
nor is there an insentive for the developers.  For touch and tablet they
are using the newer API as thats where the features are so bascially
Microsft is dragging deveopers and users and they are screaming all the way.

The point is developers dont want to make changes unless there is a
compelling reason , phone and touch apis have pulled them along  , Capsicum
is a way  for linux to go forward as it can be a 1 liner ( eg gui app fed
by powerbox but the lack of interest is notable.



>
>   There is hope on the desktop though as Capsicum seems to be the default
> and in the Kernel on FreeBSD making FreeBSD attractive as a secure platform
> .
>
>
> Particularly with children now out of college and a secure retirement, I
> could see spending some time contributing work to such a "secure
> platform".  However, if the interface doesn't have the arbitrary
> interposition of all operations property then it would take quite a bit of
> wind out of my sails.
>

Well the Linux world better get there act together as far as im concernced,
they have a worse security design/ model than Andorid/ Windows Phone 8
..which is embarrasing. However these new phone APIs are so limiting it
requires complete app redesigns  and none of them support 3rd party servers
( eg Daemons , "services") yet .   I think Unix change is hard and that  it
requires revolutionary change  ( and on Android Windows Phone touch apis
force this)  .


> Is anybody doing any programming for any of these platforms who can
> discuss how "object" these capability models are?
>

The capsicum list  and maybe FreeBSD. Capsicum list is about 1 post per
week

https://lists.cam.ac.uk/mailman/listinfo/cl-capsicum-discuss


Ben

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk