I agree that ambient authority is the root issue here, but not necessarily at the OS level. Since logging is just another bit of code intertwined with your oth

I agree that ambient authority is the root issue here, but not necessarily at the OS level. Since logging is just another bit of code intertwined with your other code, it's not clear to me that OS capabilities would help here. Let's say you have an app that needs JNDI and also needs logging, So JNDI is given a network capability, then log4j calls it. Now we just have a confused deputy within your code. Ah - but log4j shouldn't be able to get JNDI without being given it! Or the Network object. Or whatever is the thing you need to get a job done. This is the argument by reachability of capability security. Now you need to ensure that your internal code is structured along those lines, which is really what the OP is getting at.