Re: Pony talks about Deny Capabilities
Matt Rice <[email protected]> Tue, 12 May 2015 05:36:53 -0700
| Newsgroups | gmane.comp.capabilities.general |
|---|---|
| Message-ID | <CACTLOFpockU2R+Us3xGR_-uC6QuVi67_BGx-qboi4sy3QvQhXw@mail.gmail.com> |
On Mon, May 11, 2015 at 11:14 PM, Sylvan Clebsch <[email protected]> wrote: > On 12 May 2015 at 05:54, Dan Connolly <[email protected]> wrote: >> >> One idea I had when I started looking at rust is: let main programs >> link to whatever the developer likes, but don't let libraries >> (including the standard library) link to ambient authority. > > This is very interesting. > >> while the main program linking to anything is like the privileged scope > > I like this. I suspect this is the route to take for Pony. I was thinking something along these lines as well, except ideally you'd have something like a shell capability where ambient authority is isolated (libraries don't get passed a shell cap, program entry points do, but entry points only can receive caps from the shell), in a capability OS with a real cap shell you could imagine taking out the shell cap entirely and replacing it with the separate shell process... so the shell can give the main program a capability which calls connect() without the authority to call connect directly