Capsicum: Practical Capabilities for Unix | Hacker News Reader

Capsicum: Practical Capabilities for Unix

cl.cam.ac.uk

46 pointslogicprog9 comments

A small thread from 2010: https://news.ycombinator.com/item?id=2043933

ELIF / practical applications / examples?

Haven't read it yet, but here's a link that might have some examples: https://www.links.org/?p=1242.

And here's the OpenBSD pledge(2) patch for bzip2, for comparison. But similarly it already prevents a compromised bzip2 process from accessing the network, executing arbitrary commands, etc. And when used in a pipeline, accessing the filesystem. This port might actually be a great candidate for unveil(2), if anyone wants to help send a patch. :-)

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/ports/a...

And as is typical for FreeBSD, ~7/8 years later these "practical" Capsicum changes were never merged into FreeBSD. :-(

https://github.com/freebsd/freebsd/tree/master/contrib/bzip2

Pledge is different from Capsicum though. Pledge is just your typical Unix style "capabilities", whereas Capsicum is object capabilities (i.e. https://en.wikipedia.org/wiki/Object-capability_model )

If you read the list of features, it's very clear that they are not talking about what most people think of when they hear "capabilities" in the context of operating systems:

> anonymous shared memory objects - an extension to the POSIX shared memory API to support anonymous swap objects associated with file descriptors (capabilities)

File descriptors are a form of object capabilities.

Capsicum is dead outside of FreeBSD, the Linux port went nowhere, and in the handful of places where it is used in FreeBSD base, it's not even utilizing capabilities to its full potential. It wasn't even enabled by default for many years, until 11 or 12?

Meanwhile pledge(2) is protecting a large percentage of the OpenBSD base system, something like 85/90% of all programs. And unlike Capsicum, it is "practical" for developers. And important ports like archivers, and web browsers. The Capsicum project never shipped the much touted Capsicum-ized chrome, but OpenBSD has pledge/unveil chrome packages by default.

The point is that they shouldn't be confused as having the same goal. The reason object capabilities are so difficult to integrate is that you basically have to refactor all of your software to use a different style of programming. I don't think that means that pledge is somehow superior. They do two completely different things.

For an example of an active project using ocaps see:

https://fuchsia.googlesource.com/fuchsia/ https://sel4.systems/

pledge(2), and the traditional OpenBSD privilege dropping model by which pledge(2) expands upon, is demonstrably the superior model by which developers can easily understand and use to design secure programs. Simple interfaces always beat more complicated ones.

Biased source obviously but, uh, "Capability Myths Demolished" has some in-depth information: http://www.erights.org/elib/capability/duals/myths.html

- - - -

See also "macaroons": "Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud"

From the abstract:

> This paper introduces macaroons: flexible authorization credentials for Cloud services that support decentralized delegation between principals. Macaroons are based on a construction that uses nested, chained MACs (e.g., HMACs) in a manner that is highly efficient, easy to deploy, and widely applicable.

> Although macaroons are bearer credentials, like Web cookies, macaroons embed caveats that attenuate and contextually confine when, where, by who, and for what purpose a target service should authorize requests.

https://ai.google/research/pubs/pub41892

Reply on news.ycombinator.com