> Much of this stuff can be cached between grant requests, but some of it will inevitably have to hit the disk (or the network!) for a lookup—in the middle of a

> Much of this stuff can be cached between grant requests, but some of it will inevitably have to hit the disk (or the network!) for a lookup—in the middle of a blocking syscall. Running any kind of I/O during a capability check is a broken design. There is no reason to hit the disk (it should be preloaded), much less the network (such a design will never work if offline).