4 ms·

Capability security matters at all layers. Our operating systems would be much more secure if they used capabilities instead of ACLs.

bsder 3y ago
Sadly, nobody cares. Capability-based OSs wind up being significantly slower and very irritating to use. For example, look at all the pissing and moaning about SELinux. We shall see if Fuschia and/or WASM can buck the trend.
- amluto 3y ago
  > Capability-based OSs wind up being significantly slower and very irritating to use. > For example, look at all the pissing and moaning about SELinux. SELinux is not a “Capability-based OS.” It’s giant step in a direction that is pretty much opposite to capabilities. Seriously, try basically anything on Linux that tries to delegate one’s authority to something less privileged (e.g. basically any container runtime). Bind-mount something in, and then watch the kernel grumble about SELinux failures originating inside the container, where the runtime would have appropriate permission but the container processes are labeled differently and don’t. This happens because SELinux is not capabilities; it’s a very complicated and difficult to configure MAC system, which is pretty much at the opposite end of the spectrum. Podman and friends have IMO horrible workarounds built in.
- mikewarot 3y ago
  SELinux isn't Capability Based Security The closest you've likely ever been to capabilities is cash in a wallet. Each banknote is a capability, and you chose from those capabilities, in a secure and transparent manner at the time of transaction. SELinux, by analogy, requires your BANKER to decide what bills you're allowed to use in advance. SELinux sucks, and was likely a diversion to keep people away from capability based security. (As are the permission flags on your smartphone, etc)
titzer 3y ago
Capability security is great, but it isn't native to the Linux kernel. It must be implemented on top. WALI allows that capability security model to be implemented in a Wasm module, rather than built into the Wasm engine. Thus a bug in the implementation of that isn't an engine-level exploit, but is sandboxed as any other Wasm module would be.
- Findecanor 3y ago
  Then I think you are completely missing the point of why WASI was created.

bsder 3y ago

Sadly, nobody cares. Capability-based OSs wind up being significantly slower and very irritating to use. For example, look at all the pissing and moaning about SELinux. We shall see if Fuschia and/or WASM can buck the trend.

amluto 3y ago
> Capability-based OSs wind up being significantly slower and very irritating to use. > For example, look at all the pissing and moaning about SELinux. SELinux is not a “Capability-based OS.” It’s giant step in a direction that is pretty much opposite to capabilities. Seriously, try basically anything on Linux that tries to delegate one’s authority to something less privileged (e.g. basically any container runtime). Bind-mount something in, and then watch the kernel grumble about SELinux failures originating inside the container, where the runtime would have appropriate permission but the container processes are labeled differently and don’t. This happens because SELinux is not capabilities; it’s a very complicated and difficult to configure MAC system, which is pretty much at the opposite end of the spectrum. Podman and friends have IMO horrible workarounds built in.
mikewarot 3y ago
SELinux isn't Capability Based Security The closest you've likely ever been to capabilities is cash in a wallet. Each banknote is a capability, and you chose from those capabilities, in a secure and transparent manner at the time of transaction. SELinux, by analogy, requires your BANKER to decide what bills you're allowed to use in advance. SELinux sucks, and was likely a diversion to keep people away from capability based security. (As are the permission flags on your smartphone, etc)

titzer 3y ago

Capability security is great, but it isn't native to the Linux kernel. It must be implemented on top. WALI allows that capability security model to be implemented in a Wasm module, rather than built into the Wasm engine. Thus a bug in the implementation of that isn't an engine-level exploit, but is sandboxed as any other Wasm module would be.

Findecanor 3y ago
Then I think you are completely missing the point of why WASI was created.