4 ms·

I think Capsicum is a good start, but it does not have revocation built in — which I think is essential for a system in which capabilities can be held by long-l

I think Capsicum is a good start, but it does not have revocation built in — which I think is essential for a system in which capabilities can be held by long-lived apps or services. There are approaches where revocation is expressed as a network of capabilities, but that just makes using it more complex. Also, revocation should be cascading: revoking also derived capabilities. The system would need to store a delegation-tree. Then there's the issue processor time for cascading revocation, which could depend on the size of the tree.

Ericson2314 3y ago
Yes that would be good, but I'm OK delaying it. People are used to capabilities without revocation from functional programming, Rust, WASI, etc., and don't mind so much in that context. (Well, weak references allow revocation, but they are relatively rare.) Yes, interprocess vs intraprocess is different, but the above makes me at least think there is some juice and first exposing the lower-hanging fruit that people are already familiar with and seem to like, and then using the success of that to motivate/fund revocation.