2 ms·

I don't believe that Linux capabilities are correctly named. They describe an ambient privilege, whereas capabilities represent explicit authorisation i.e. one

I don't believe that Linux capabilities are correctly named. They describe an ambient privilege, whereas capabilities represent explicit authorisation i.e. one invokes a capability to use it, and this is why entire classes of security vulnerabilities aren't possible in true capability-based systems. Unfortunately capabilities have long been misunderstood as equivalent to access control lists, and therefore ignored or misnamed due to the difficulty of building working capability-based systems Vs ACL-based systems. (ACL-based systems should be built on top of a capability-based core, and only apply to a smallest possible domain of objects - a single global namespace with an ACL-based access control mechanism is where the common security vulnerabilities of modern operating systems begin.) Smartphone permissions are also ambient privileges, but that's not the reason they get hacked: they get hacked because the operating systems are not designed around capabilities from boot and up, and have shared critical global namespaces with an ambient authority access control mechanism. Capabilities provide defense in depth, they don't make a system automatically unhackable but they do make it so that a critical attack path is highly unlikely to exist.

maxbond 3y ago
Hmm, I'm not sure we share an understanding of "ambient." Smartphone permissions are scoped to the app. It's been a while since I've messed with SELinux, but iirc, the rules can be scoped to an executable. Whereas in my mind, an ambient permission is scoped to a broad category, like a user or group.
- mikewarot 3y ago
  Ambient here is defined as the programmer assumes that they don't have to ask permission, nor does the runtime, you can just open any file at will that the user is allowed to access, without restrictions. So if an image viewer is given permissions to access your photos, it includes a broad swath of permissions, including the ability to just corrupt them all. With a capabilities based system, the image viewer would get access to a single photo, or a folder of them, and perhaps read-only access, decided by the user at run time, instead of the system administrator at some earlier time, or the manufacturer as a category choice.

maxbond 3y ago

Hmm, I'm not sure we share an understanding of "ambient." Smartphone permissions are scoped to the app. It's been a while since I've messed with SELinux, but iirc, the rules can be scoped to an executable. Whereas in my mind, an ambient permission is scoped to a broad category, like a user or group.

mikewarot 3y ago
Ambient here is defined as the programmer assumes that they don't have to ask permission, nor does the runtime, you can just open any file at will that the user is allowed to access, without restrictions. So if an image viewer is given permissions to access your photos, it includes a broad swath of permissions, including the ability to just corrupt them all. With a capabilities based system, the image viewer would get access to a single photo, or a folder of them, and perhaps read-only access, decided by the user at run time, instead of the system administrator at some earlier time, or the manufacturer as a category choice.