5 ms·

That's actually really beautifully simple. Thanks for this explanation, it really helped the idea "click"

naasking 10y ago
And for another beautiful convergence: nowadays most software development is done in languages that naturally express capability patterns, namely memory-safe languages. That is, if you have a reference to an object or value, you have the authority to invoke any of the methods on that object or call any functions that accept such a value. So object references are capabilities. Most such languages only go too far by allowing "ambient authority", whereby any component in your program has the ability to turn a reference to a value that carries little authority, into one that carries significantly more authority. For instance, consider the file open API: you're essentially turning a string, which exposes no unsafe or security-critical methods, into an object that can literally destroy your computer. And literally any library or component you use can open files. It's madness! To make a memory safe language capability secure, you simply remove all sources of ambient authority. This mainly consists of globals that permits transitive access to mutable state, like file system APIs, global static variables that can reference transitively mutable data, etc. These insecure APIs are then replaced with equivalent object instances which you can pass around, eg. you can only receive the authority to open a file if you're given an instance to the directory object which contains that file. The entry point of your program would then change to accept various capabilities instead of just string parameters.
- catern 10y ago
  And as an even deeper correspondence: Once your language is memory-safe and capability-secure, you don't even need a kernel, let alone a microkernel. Rather than use hardware address spaces to separate and modularize components (the primary idea behind microkernels), you just pass capabilities around to your components. One component can't crash the whole system, because all it can access is the APIs you pass in to it. If you want to add isolated processes to your OS, just implement actors in your language: They're equivalent. Of course, you can always have a bug in your APIs that allows an attack or bug to propagate. But that was always the case even without capability-safety. Capabilities can't give you everything for free. :)
  - nickpsecurity 10y ago
    JX Operating System does something like this within a JVM. It runs on a microkernel but I think the mediation is app/language level.
  - pjmlp 10y ago
    That was the approach taken by Mesa/Cedar, Modula-2+ Topaz, Modula-3 SPIN OS, Oberon Native Oberon, ....
- saghm 10y ago
  > That is, if you have a reference to an object or value, you have the authority to invoke any of the methods on that object or call any functions that accept such a value. Except private methods, right? That's where I feel that this analogy breaks down
  - naasking 10y ago
    Yes, you can only invoke the publicly interface of an object. It's not an analogy, object references really are capabilities.
- ptx 10y ago
  > To make a memory safe language capability secure, you simply remove all sources of ambient authority. Isn't this more or less what Sun tried to do with Java applets, which in practice turned out not to be so simple while providing a rich API?
  - naasking 10y ago
    > Isn't this more or less what Sun tried to do with Java applets, which in practice turned out not to be so simple while providing a rich API? I'm not familiar with the Java applet model specifically, but Java's general security model is based on stack inspection, which is nothing like capabilities.
  - nickpsecurity 10y ago
    http://www.cs.cornell.edu/home/chichao/sip99.ps http://www.cs.cornell.edu/home/chichao/sip99.ps http://www4.cs.fau.de/Projects/JX/ http://www4.cs.fau.de/Projects/JX/ Note: JX takes a different route but shows POLA can be done simply and performant.
nickpsecurity 10y ago
It's a simple concept whose flexibility & performing implementations can be hard. Usually takes geniuses to come up with one that works well in concept and practice. It's why Butler Lampson always thought they were a waste of time. I don't. So, here's some examples of successful application. :) http://www.cl.cam.ac.uk/research/security/ctsrd/cheri.html http://www.cl.cam.ac.uk/research/security/ctsrd/cheri.html https://en.wikipedia.org/wiki/EROS_(microkernel) https://en.wikipedia.org/wiki/EROS_(microkernel) Note: Definitely see KeyKOS as it was commercially deployed with both POLA and persistence of app data. https://www.combex.com/tech/darpaBrowser.html https://www.combex.com/tech/darpaBrowser.html http://www.cs.washington.edu/homes/levy/capabook/index.html http://www.cs.washington.edu/homes/levy/capabook/index.html Note: Especially see System/38 which became AS/400 & IBM i. Still selling. And they run and run and run. Architecture & POLA go a long way there.

And for another beautiful convergence: nowadays most software development is done in languages that naturally express capability patterns, namely memory-safe languages. That is, if you have a reference to an object or value, you have the authority to invoke any of the methods on that object or call any functions that accept such a value. So object references are capabilities. Most such languages only go too far by allowing "ambient authority", whereby any component in your program has the ability to turn a reference to a value that carries little authority, into one that carries significantly more authority. For instance, consider the file open API: you're essentially turning a string, which exposes no unsafe or security-critical methods, into an object that can literally destroy your computer. And literally any library or component you use can open files. It's madness! To make a memory safe language capability secure, you simply remove all sources of ambient authority. This mainly consists of globals that permits transitive access to mutable state, like file system APIs, global static variables that can reference transitively mutable data, etc. These insecure APIs are then replaced with equivalent object instances which you can pass around, eg. you can only receive the authority to open a file if you're given an instance to the directory object which contains that file. The entry point of your program would then change to accept various capabilities instead of just string parameters.

catern 10y ago
And as an even deeper correspondence: Once your language is memory-safe and capability-secure, you don't even need a kernel, let alone a microkernel. Rather than use hardware address spaces to separate and modularize components (the primary idea behind microkernels), you just pass capabilities around to your components. One component can't crash the whole system, because all it can access is the APIs you pass in to it. If you want to add isolated processes to your OS, just implement actors in your language: They're equivalent. Of course, you can always have a bug in your APIs that allows an attack or bug to propagate. But that was always the case even without capability-safety. Capabilities can't give you everything for free. :)
- nickpsecurity 10y ago
  JX Operating System does something like this within a JVM. It runs on a microkernel but I think the mediation is app/language level.
- pjmlp 10y ago
  That was the approach taken by Mesa/Cedar, Modula-2+ Topaz, Modula-3 SPIN OS, Oberon Native Oberon, ....
saghm 10y ago
> That is, if you have a reference to an object or value, you have the authority to invoke any of the methods on that object or call any functions that accept such a value. Except private methods, right? That's where I feel that this analogy breaks down
- naasking 10y ago
  Yes, you can only invoke the publicly interface of an object. It's not an analogy, object references really are capabilities.
ptx 10y ago
> To make a memory safe language capability secure, you simply remove all sources of ambient authority. Isn't this more or less what Sun tried to do with Java applets, which in practice turned out not to be so simple while providing a rich API?
- naasking 10y ago
  > Isn't this more or less what Sun tried to do with Java applets, which in practice turned out not to be so simple while providing a rich API? I'm not familiar with the Java applet model specifically, but Java's general security model is based on stack inspection, which is nothing like capabilities.
- nickpsecurity 10y ago
  http://www.cs.cornell.edu/home/chichao/sip99.ps http://www.cs.cornell.edu/home/chichao/sip99.ps http://www4.cs.fau.de/Projects/JX/ http://www4.cs.fau.de/Projects/JX/ Note: JX takes a different route but shows POLA can be done simply and performant.

nickpsecurity 10y ago

It's a simple concept whose flexibility & performing implementations can be hard. Usually takes geniuses to come up with one that works well in concept and practice. It's why Butler Lampson always thought they were a waste of time. I don't. So, here's some examples of successful application. :) http://www.cl.cam.ac.uk/research/security/ctsrd/cheri.html http://www.cl.cam.ac.uk/research/security/ctsrd/cheri.html https://en.wikipedia.org/wiki/EROS_(microkernel) https://en.wikipedia.org/wiki/EROS_(microkernel) Note: Definitely see KeyKOS as it was commercially deployed with both POLA and persistence of app data. https://www.combex.com/tech/darpaBrowser.html https://www.combex.com/tech/darpaBrowser.html http://www.cs.washington.edu/homes/levy/capabook/index.html http://www.cs.washington.edu/homes/levy/capabook/index.html Note: Especially see System/38 which became AS/400 & IBM i. Still selling. And they run and run and run. Architecture & POLA go a long way there.