4 ms·

Sadly, nobody cares. Capability-based OSs wind up being significantly slower and very irritating to use. For example, look at all the pissing and moaning abou

• amluto 3y ago
  > Capability-based OSs wind up being significantly slower and very irritating to use. > For example, look at all the pissing and moaning about SELinux. SELinux is not a “Capability-based OS.” It’s giant step in a direction that is pretty much opposite to capabilities. Seriously, try basically anything on Linux that tries to delegate one’s authority to something less privileged (e.g. basically any container runtime). Bind-mount something in, and then watch the kernel grumble about SELinux failures originating inside the container, where the runtime would have appropriate permission but the container processes are labeled differently and don’t. This happens because SELinux is not capabilities; it’s a very complicated and difficult to configure MAC system, which is pretty much at the opposite end of the spectrum. Podman and friends have IMO horrible workarounds built in.
• mikewarot 3y ago
  SELinux isn't Capability Based Security The closest you've likely ever been to capabilities is cash in a wallet. Each banknote is a capability, and you chose from those capabilities, in a secure and transparent manner at the time of transaction. SELinux, by analogy, requires your BANKER to decide what bills you're allowed to use in advance. SELinux sucks, and was likely a diversion to keep people away from capability based security. (As are the permission flags on your smartphone, etc)