4 ms·
The observation that programs have distinct init and main phases is one reason why capability-based permissions exist. You can do initial work - read a config f
by pradn 6y ago
The observation that programs have distinct init and main phases is one reason why capability-based permissions exist. You can do initial work - read a config file, open ports - and then drop the capabilities to do those things. This way, a buffer-overflow that occurs after the init phase ends up being less harmful. The program no longer has the capabilities to open new files or new ports or cause more havoc.
- richard_todd 6y agoYes, or on a more primitive level how traditional UNIX lets a process drop setuid-root permissions once you've done what you need to do with them. In some managed languages, you can define classes with constant members, but obviously they let you write to them during the constructor for the objects. That's the kind of restricted-scope global-state setup phase I am after in an advanced systems programming language. It would be an interesting experiment, anyway.
- kstrauser 6y agoI really like the OpenBSD "pledge" API (https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2). At any point, a program can promise that it will only make specific syscalls from then on, and subsequent pledges can only further restrict that list of syscalls. Once a process has given up rights to open a local file, for instance, it can't get it back. I think that's beautiful.