3 ms·

In linux cgroups and namespaces effectively are a better model. I wonder if internally posix capabilities could just be re-implemented over cgroups instead.

• justincormack 11y ago
  They are a limited model. Namespaces do allow you to pass access tokens between processes, but these are limited as mostly you can only be in one namespace at a time, so they are not usefully compositional. You can never be in more than one cgroup of the same type, and you cannot pass your capabilties on. Capsicum is a real capabilities system, as is being discussed in the article, where capabilities are attached to file descriptors. So for example process descriptors in Capsicum are file descriptors that refer to a process, if that design was pervasive you do not need process namespaces as you can only see processes you have a descriptor for.
  • tenfingers 11y ago
    Wouldn't capsicum then allow to effectively implement different user models than root/user? Where the login process would be responsible to just drop capabilities after switching the uid?
    • justincormack 11y ago
      Potentially, although it might need quite a lot of infrastructure to make that work usefully I think, as most of the design in Capsicum has been around reducing capabilities for a single group of programs for security, not a whole system. You can do much of that with Linux capabilities now - see man (7) capabilities and the section "The securebits flags: establishing a capabilities-only environment" which says how to disable suid so root is effectively removed.