Comment by david-given | Hacker News Reader

Comment by david-given | Hacker News Reader

Parent Full thread

Roughly put: in a capability based system, if you have a valid handle for a service, then you can use that service. But the only way you can get a valid handle is to ask your parent process for one --- handles are unforgeable. So your parent gets to check that you're legitimate.

...but your parent, in turn, has limited permissions, because the only way it can get a handle is to ask its parent. And when you ask your parent for a filesystem handle, your parent doesn't have to give you the handle it has. Your parent might give you a limited filesystem handle which only allows writes to /tmp.

...and when you, in turn, start a subprocess --- say, an instance of sqlite for use as a database --- you have to give it handles for the things it wants to do on your behalf. But your filesystem handle only allows writes to /tmp. That means that your sqlite instance can only write to /tmp too.

There's more to it than that, because in real life you also want to forward capabilities to other running services as part of RPCs, but you tend to end up with a natural container system with multiple redundant layers of isolation, all running at minimum necessary privilege, and all hardware-mediated.

Another really interesting capability-based OS is Genode:

https://genode.org/about/screenshots

https://genode.org/documentation/general-overview/index

It'll allow you to run complete OS kernels as capability-restricted Genode processes, effectively allowing virtual machines as first-class citizens.

That's actually really beautifully simple.

Thanks for this explanation, it really helped the idea "click"

And for another beautiful convergence: nowadays most software development is done in languages that naturally express capability patterns, namely memory-safe languages. That is, if you have a reference to an object or value, you have the authority to invoke any of the methods on that object or call any functions that accept such a value. So object references are capabilities.

Most such languages only go too far by allowing "ambient authority", whereby any component in your program has the ability to turn a reference to a value that carries little authority, into one that carries significantly more authority. For instance, consider the file open API: you're essentially turning a string, which exposes no unsafe or security-critical methods, into an object that can literally destroy your computer. And literally any library or component you use can open files. It's madness!

To make a memory safe language capability secure, you simply remove all sources of ambient authority. This mainly consists of globals that permits transitive access to mutable state, like file system APIs, global static variables that can reference transitively mutable data, etc.

These insecure APIs are then replaced with equivalent object instances which you can pass around, eg. you can only receive the authority to open a file if you're given an instance to the directory object which contains that file. The entry point of your program would then change to accept various capabilities instead of just string parameters.

And as an even deeper correspondence: Once your language is memory-safe and capability-secure, you don't even need a kernel, let alone a microkernel. Rather than use hardware address spaces to separate and modularize components (the primary idea behind microkernels), you just pass capabilities around to your components. One component can't crash the whole system, because all it can access is the APIs you pass in to it. If you want to add isolated processes to your OS, just implement actors in your language: They're equivalent.

Of course, you can always have a bug in your APIs that allows an attack or bug to propagate. But that was always the case even without capability-safety. Capabilities can't give you everything for free. :)

JX Operating System does something like this within a JVM. It runs on a microkernel but I think the mediation is app/language level.

That was the approach taken by Mesa/Cedar, Modula-2+ Topaz, Modula-3 SPIN OS, Oberon Native Oberon, ....

> That is, if you have a reference to an object or value, you have the authority to invoke any of the methods on that object or call any functions that accept such a value.

Except private methods, right? That's where I feel that this analogy breaks down

Yes, you can only invoke the publicly interface of an object. It's not an analogy, object references really are capabilities.

> To make a memory safe language capability secure, you simply remove all sources of ambient authority.

Isn't this more or less what Sun tried to do with Java applets, which in practice turned out not to be so simple while providing a rich API?

> Isn't this more or less what Sun tried to do with Java applets, which in practice turned out not to be so simple while providing a rich API?

I'm not familiar with the Java applet model specifically, but Java's general security model is based on stack inspection, which is nothing like capabilities.

http://www.cs.cornell.edu/home/chichao/sip99.ps

http://www4.cs.fau.de/Projects/JX/

Note: JX takes a different route but shows POLA can be done simply and performant.

It's a simple concept whose flexibility & performing implementations can be hard. Usually takes geniuses to come up with one that works well in concept and practice. It's why Butler Lampson always thought they were a waste of time. I don't. So, here's some examples of successful application. :)

http://www.cl.cam.ac.uk/research/security/ctsrd/cheri.html

https://en.wikipedia.org/wiki/EROS_(microkernel)

Note: Definitely see KeyKOS as it was commercially deployed with both POLA and persistence of app data.

https://www.combex.com/tech/darpaBrowser.html

http://www.cs.washington.edu/homes/levy/capabook/index.html

Note: Especially see System/38 which became AS/400 & IBM i. Still selling. And they run and run and run. Architecture & POLA go a long way there.

So, going back to Win32, it's as if OpenFile also took a HANDLE that represented your abilities (or capabilities if you will ) within the security model, with the explicit ability to forward these handles (or new handles that represent a subset of the original's capabilities) to other processes if you choose.

In Win32, this handle is called the AccessToken https://msdn.microsoft.com/en-us/library/windows/desktop/aa3... and the calling thread's current access token is used by OpenFile to grant or deny the requested access.

Reply on news.ycombinator.com