3 ms·
Why are capabilities restrictions not the norm when the concept is so old and seemingly so sound?
by pxc 2y ago
Why are capabilities restrictions not the norm when the concept is so old and seemingly so sound?
- pjc50 2y agoThey're really annoying to use. Also the "UNIX ideal" is composable tools, which doesn't combine very well with any kind of sandboxing.
- marcosdumay 2y agoThe thing about capabilities is that they compose very well.
- marcosdumay 2y agoLinux doesn't have a good capability system. And no good system makes it into Linux because it has a huge, well supported one, and some 3 other candidates pushing to get there already.
- pxc 2y agoSo something crummy but usable-enough for experts (SELinux?) worse-is-better'd its way onto the Linux scene, and now it has matured enough that on the one hand it can't be displaced but on the other its model is ossified and can't be untangled or simplified. Makes sense. I love Linux and many of the fruits of its messy evolution, but such fruits are certainly not all equally delicious. :(