4 ms·
Objects as Secure Capabilities
- Natanael_L 11y agoI would love to see a full client OS developed based on a Capabilities model. Imagine if Qubes OS didn't have to settle with VM:s that are essentially large sandboxes, but it could isolate software and grant access directly managed trough these secure tokens. Ideally even regular software packages would then be split up in smaller pieces that in turn had their own capabilities, so that a web browser could restrict the capabilities of the rendering thread/process by simply not giving it all the capabilities of the main thread of the software. Instead of just threading software or using process isolation you'd define capabilities for every sensitive interaction and could be a whole lot more fine-grained.
- p4bl0 11y agoI think you would be interested in the SAFE research project: http://www.crash-safe.org/ http://www.crash-safe.org/.
- Natanael_L 11y agoNice, but it seems to be a very low-pace project from the looks of it (the dates of publications are far apart)
- icebraining 11y agoIdeally even regular software packages would then be split up in smaller pieces that in turn had their own capabilities, so that a web browser could restrict the capabilities of the rendering thread/process by simply not giving it all the capabilities of the main thread of the software. That's exactly what Chrome does, by the way. The rendering processes can't do basically anything beyond communicating with the parent process on a channel. Anything else - files, network, etc - is barred using seccomp-bpf (and equivalent on Windows).
- Natanael_L 11y agoThe difference is that in such an enviroment, that sandbox would be created by - doing nothing. Chrome has to go out of its way to define such a sandbox for rendering processes.