3 ms·
Unix permissions become increasingly complicated while usage moves in the other direction. Complex permissions were a must-have in the era of time-shared syste
by cturner 11y ago
Unix permissions become increasingly complicated while usage moves in the other direction.
Complex permissions were a must-have in the era of time-shared systems. You'll find some slow-moving multinationals that still have people shelled into production unix boxes, and where they have thick policy manuals around who is allowed to become what kind of user. But it's on the way out.
Two use-cases dominate now: unix servers that nobody ever shells into. They boot into a prepared image, or have configuration pushed to them. And - single-user workstations.
- lmz 11y agoWhat about mobile devices with partially trusted (or even untrusted) apps?
- cturner 11y agoYour comment raises a solid use-case I hadn't mentioned: unix running underneath a single-user mobile device. You do need permission systems for that scenario. But they don't have to be in the OS. You could implement them in the application container. A difficulty with security services being tied to the OS is that you're tied to the featureset of the OS, which tends to have a slow-moving API. Much better to implement security via library, so it can move at the same pace as your application platform. There are many ways to build a unix. Unix is strong at hardware interaction (drivers, filesystems), IPC, process control. Security models dilute it. This includes chmod-style filesystems permissions in that. It's lots of complexity that delivers little value. Curious: Stallman built GNU on unix. He's an open guy himself, and had spent a lot of time with MIT systems that didn't implement security in the OS level.
- anon4 11y agoAndroid does it by giving each application a different user and then granting that user certain privileges.
- vhffm 11y agoI'd like to point out that large-memory/many-core multi-user machines are very much alive in Computational Science (Computational Physics, Computational Chemistry, etc). Usually as test-beds (before deploying on clusters), visualisation system, or simply front-end nodes for clusters.