4 ms·
> The focus on handles overall is good though. Some capability security lessons have finally seeped into common knowledge! Huh? NT has done this for 25 years.
by dblohm7 9y ago
> The focus on handles overall is good though. Some capability security lessons have finally seeped into common knowledge!
Huh? NT has done this for 25 years.
- naasking 9y agoI don't think these are the same thing, but please do provide a link discussing NT's use of handles.
- dblohm7 9y agohttps://msdn.microsoft.com/en-us/library/windows/desktop/ms724485(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/ms7...
- naasking 9y agoThanks. None of the creator functions take the handles needed, which is contrary to capability security. This leaves the system vulnerable to DoS attacks at the very least.
- dblohm7 9y agoCreation of those objects is also implicit on checking the current thread's access token and the current process's job (if present). So I think it has the same concerns that you outlined in an earlier comment about Fuchsia's creator functions.
- naasking 9y agoInteresting that the fuchsia kernel design seems to mimic the NT kernel in this regard...
- naasking 9y agoThere are also other issues I just remembered. Handles in a capability OS have no access control applied to them, ie. if you hold a handle, then you have permission to invoke operations on that handle. Attenuating authority involves deriving a new handle from an existing one with reduced rights, then passing that around. I believe the NT kernel still checks permissions against ACLs for handles. This violates capability security, but you can build a capability OS on top of ACLs: http://www.webstart.com/jed/papers/Managing-Domains/ http://www.webstart.com/jed/papers/Managing-Domains/