Re: "Ambient capabilities"

On Mon, Nov 3, 2014 at 8:26 PM, David Barbour <[email protected]> wrote:

> You certainly aren't getting the benefits of precisely indicating which
> authorities you're using for each action. A user is subject to the confused
> deputy problem.
>

Is that important? Must all method calls include a "by what authority"
parameter? That seems unusable and in practice would rapidly degenerate
into a "try everything in my bag" call wrapper.

I imagine a system where one prepares to make a method call by requesting
from the method call preparation service a capability to call method M with
args A given the authorities in bag B, and the
service figures out what will work if anything and responds either "Sorry"
or with a single-use handle of some kind that will do the described thing.

When is that safe or not safe? Should one never even know the names of
methods one hasn't got the authority to access? "By the authority of this
name resolution capability, I request a capability to baz with
to-be-determined parameters" could solve it -- there is no bag to iterate
through. Is that the right way to do it?

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk