Re: Pony talks about Deny Capabilities

On Mon, May 11, 2015 at 11:45 AM, Scott Moore <[email protected]>
wrote:

>
>
>> Yeah. File systems. Ugh. This is a huge ambient authority problem, and we
>> don't have a clear idea of how to handle it better.
>>
>> I think there's been a fair amount of progress on this front with
> projects like Capsicum (
> https://www.cl.cam.ac.uk/research/security/capsicum/) and (my own) Shill
> language (http://shill-lang.org). In particular, more and more
> capability-friendly system call interfaces like openat are being added to
> various POSIX systems that are making it easier to implement a
> "capability-safe" API for the filesystem. That said, there's a lot left to
> be desired still. (E.g., for Shill, we had to add a number of additional
> system calls to BSD as part of our kernel module for things like atomically
> creating and getting a capability for a directory).
>

Agree with Scott. But see also how previous ocap languages running on
unmodified legacy non-ocap OSes handled these issues, including E, Joe-E,
and Emily. See also how Caja/SES handles access to ambient browser
authority such as the DOM.


-- 
  Cheers,
  --MarkM

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk