some capability queries

We have been trying to understand this concept of capability based
security for the past few months. It looks like we still have a few
fundamental queries - so I though of reaching out to this group -to
see if our understanding is correct and whether we are asking the
right questions

1. I see that capabilities being used as unforgeable tokens of fine
grained authority. I have seen this  fact being used to reduce ambient
authority in systems like Capsicum, where in the parent ambient
process creates a sandbox and grants it only the authorities (file
descriptors) it needs. I understand this clearly and its value in
reducing the existing ambient authority existing by virtue of  the
global name space.

2. Then I see EROS and SEL4, which tries to create a formal model
(based on variations of take grant )and formally proves the following
about their mechanisms .
SEL4 -  it is feasible to implement isolated subsystems using seL4 mechanisms,
EROS - formally verifying the correctness of their confinement mechanism

3. From what I understood in KeyKOS (on which EROS is based), the
component called reference monitor, is responsible for validating all
the interaction between compartments . It is where the appropriate
"sharing" rules and policies are defined, and thus where the
discretionary and mandatory rules  are checked and enforced.

4. using confinement(2) and controlled interactions(3) among
compartments - what do we really achieve or how are they different
from other access control models?

5. Can we express anything (policies) more / differently using
capability systems than with other systems/ access control models ?

6. There is this really nice concept of delegation ... however in most
of recent systems , I have only seen the confinement / sandboxing of
this. Delegation is mostly between the ambient parent and the sandbox
. Can you point me to some systems which use delegation more
concretely among multi-parties so that i can understand this better.

7. Can capabilities be as expressive as ABAC , which is said to be
used in medical systems [e.g. access to the patient record can be
restricted to specific cardiologists involved in that patient’s care
as these doctor’s attributes can be included in the ABAC policy of the
record]

8. In simple terms what is the advantage of capability systems .



-- 
Thanks and Regards

Jithu Joseph

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk