3 ms·

Would you mind helping me understand your idea better, then? I gleaned my (mistaken) assumption from your Capabilities Digest: > The principle of least privile

Would you mind helping me understand your idea better, then? I gleaned my (mistaken) assumption from your Capabilities Digest: > The principle of least privilege is the solution to this whole mess, but it has to be applied from the kernel all the way up the stack. This is a lot of forking work to do.[0] [0]: http://capabilitiesdigest.blogspot.com/2015/10/the-root-cause-of-our-security-woes.html?m=1 http://capabilitiesdigest.blogspot.com/2015/10/the-root-caus...

mikewarot 6y ago
Forking the Linux kernel would just result in another monolithic Linux kernel, with all the drivers all tied in. There are microkernels, which is the specific thing Linus Torvalds didn't want to do when he started Linux. In capability based systems, not even the drivers have access to everything. Any given process is giving a list of capabilities, like file handles to resources, and those are the ONLY things that process can access. Consider a word processor... under Windows, Linux, etc the application calls a system dialog box to select the directory/file name, the uses that name to open a handle to the files, because the assumption is that any program you run should have full access to all of your stuff. The fork of that word processor in a capabilities based OS would call the OS, and the OS would show you a similar dialog box, but the OS would then return the file capability to the word processor... it wouldn't be able to access anything else. Consider the Linux model as handing over your wallet at a checkout, and the Capabilities model as handing over exact change. People are used to handling actual money and thinking in terms of risk like that... thus they would do well in a capabilities based system, and from their perspective not a lot has changed. From the application programmer perspective, opening/saving files is a bit different, but everything else stays the same. The big plus is that no matter how bad any application crashes, due to bug or deliberate fuzzing, etc... it can't be used to take over the system, like it could in Linux. We could stop having to worry about security when writing applications, and only worry about it in systems programming, where it belongs. Does that help?
- walleeee 6y ago
  That helps a lot. So would it just require an open standard for microkernel implementations, then, or would hardware need to change?
  - mikewarot 6y ago
    Genode runs on a variety of microkernels, the nice thing about them is they only do a very few things, so adapting to a new one shouldn't be hard, nor dangerous.

mikewarot 6y ago

Forking the Linux kernel would just result in another monolithic Linux kernel, with all the drivers all tied in. There are microkernels, which is the specific thing Linus Torvalds didn't want to do when he started Linux. In capability based systems, not even the drivers have access to everything. Any given process is giving a list of capabilities, like file handles to resources, and those are the ONLY things that process can access. Consider a word processor... under Windows, Linux, etc the application calls a system dialog box to select the directory/file name, the uses that name to open a handle to the files, because the assumption is that any program you run should have full access to all of your stuff. The fork of that word processor in a capabilities based OS would call the OS, and the OS would show you a similar dialog box, but the OS would then return the file capability to the word processor... it wouldn't be able to access anything else. Consider the Linux model as handing over your wallet at a checkout, and the Capabilities model as handing over exact change. People are used to handling actual money and thinking in terms of risk like that... thus they would do well in a capabilities based system, and from their perspective not a lot has changed. From the application programmer perspective, opening/saving files is a bit different, but everything else stays the same. The big plus is that no matter how bad any application crashes, due to bug or deliberate fuzzing, etc... it can't be used to take over the system, like it could in Linux. We could stop having to worry about security when writing applications, and only worry about it in systems programming, where it belongs. Does that help?

walleeee 6y ago
That helps a lot. So would it just require an open standard for microkernel implementations, then, or would hardware need to change?
- mikewarot 6y ago
  Genode runs on a variety of microkernels, the nice thing about them is they only do a very few things, so adapting to a new one shouldn't be hard, nor dangerous.