4 ms·
Creation of those objects is also implicit on checking the current thread's access token and the current process's job (if present). So I think it has the same
by dblohm7 9y ago
Creation of those objects is also implicit on checking the current thread's access token and the current process's job (if present). So I think it has the same concerns that you outlined in an earlier comment about Fuchsia's creator functions.
- naasking 9y agoInteresting that the fuchsia kernel design seems to mimic the NT kernel in this regard...
- naasking 9y agoThere are also other issues I just remembered. Handles in a capability OS have no access control applied to them, ie. if you hold a handle, then you have permission to invoke operations on that handle. Attenuating authority involves deriving a new handle from an existing one with reduced rights, then passing that around. I believe the NT kernel still checks permissions against ACLs for handles. This violates capability security, but you can build a capability OS on top of ACLs: http://www.webstart.com/jed/papers/Managing-Domains/ http://www.webstart.com/jed/papers/Managing-Domains/