3 ms·
Capabilities? FreeBSD, and other Unix flavors have had caps for decades. No one uses them. Security is useless if no one uses it. Capabilities are too hard, to
by X86BSD 10y ago
Capabilities? FreeBSD, and other Unix flavors have had caps for decades.
No one uses them. Security is useless if no one uses it. Capabilities are too hard, too complex, to manage.
Great idea. Horrible implementation.
- zzzcpan 10y agoFreeBSD got Capsicum only in 10.x and many projects started using them.
- the_why_of_y 10y agoOne interesting thing built on top of that is CloudABI: https://nuxi.nl/ https://nuxi.nl/ https://www.bsdcan.org/2015/schedule/attachments/330_2015-06-13%20CloudABI%20at%20BSDCan.pdf https://www.bsdcan.org/2015/schedule/attachments/330_2015-06...
- rwallace 10y agoI'm curious; do you have any details on exactly why the existing implementations are too complicated to be usable, and on whether this looks likely to be just some specific design flaws or inherent in the concept?
- abecedarius 10y agoUnix 'capabilities' (before Capsicum, iirc) were a different thing with the same name. Confusing. Unix actually does have a different construct that is like a classical capability: an open file descriptor that you can send to another process over a Unix domain socket.
- upboatter 10y agoNot at the kernel level, is it?