[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: Capsicum: practical capabilities for UNIX
On Fri, 24 Sep 2010 14:46:10 -0500 David Young <dyoung%pobox.com@localhost>
> A couple of weeks ago I read a paper on Capsicum, a
> "lightweight OS capability and sandbox framework,"
It won best paper at Usenix Security, and the creators have lots of
experience with previous systems that fed in to how they designed
> looks like a giant step in the right direction for UNIX security
> research. I'd like to see a similar function in NetBSD. What are
> others' impressions of Capcisum? Is anybody working on a port?
A port would be good -- superior to a reinvention. I'm reasonably
convinced that Robert Watson, Ben Laurie, etc. know what they're doing
> I have a couple of concerns about Capsicum at its current level of
> development. First, I'm wary of "self-compartmentalization" of
> programs and libraries. It seems like it could be a lot of work to
> add self-compartmentalization to just the programs in NetBSD's base
> system, and when it was finished, I doubt that so many changes
> would be both trustworthy and consistent.
Actually, the amount of work for any given subsystem is pretty small,
but I don't think the intent of the architecture is to go through
libraries doing this. For a program like ntp or bozo-httpd or what
have you, it is worthwhile, and not a very large effort.
> The second concern is
> related to the first: a Capsicum sandbox doesn't simulate access to
> the global namespace for the purpose of unmodified programs
> calling, e.g., open(2)---can it?
The whole point of a capability system is to remove access to such
namespaces -- you eliminate the security properties if you do. If the
desire is a system based on more global policies, you want a MAC
system of some sort (systrace was a sort of MAC system), not a
I suggest reading Jonathan Shapiro's introduction to capability
systems, found here:
One of the interesting features of Capsicum is that it allows a nice
hybrid of the capability architecture with a normal Unix environment
for most programs. However, once you're really living in capability
world, you don't want global namespaces, they destroy the security of
Perry E. Metzger perry%piermont.com@localhost
Main Index |
Thread Index |