By 'true capabilities' he means what information security literature
refers to when discussing 'capability systems'. This is in contrast to
'capability lists' which is a protection mechanism often implemented in
'access control list systems', and which happens to be what Linux
contains support for.
> If you mean
> military grade security, where one can restrict a user to be able only to
> execute the 'nop' assembly instruction, then you are right, Linux's doesnt
> want to do that. Linux has a capability model that splits up _system_
> priviledges (thus risks) so that eg. a security hole in 'ping' doesnt mean
> a full system compromise.
Linux does not have a capability model!
Again (yes, I've pointed this out on several occasions so far, on this
list), by using incorrect terms you are introducing a lot of confusion
(as is evident above) and a false sense of security. Capability lists
ARE NOT true capabilities. They are not even a capability model. They
are an access control list model.
If you look at individual privileges in Linux, you will find that there
is a finite list of exactly specified items, and that the object always
receives the _whole_ list in which individual items are either enabled
or disabled. This is an access control list that tells the object what
it can do and what it can't do (notice the 'what it can't do'). A
capability system on the other hand does not specify explicitly what an
object can't do, but only what it can. For everything that it can do, it
has a capability token that it uses to authorize the action. Everything
that it doesn't explicitly have a capability token for, it can't do (in
other words, in a capability system there is no such thing as a
'negative capability', such as a disabled capability in a capability
list).
The difference between security provided by what is in the Linux kernel
and a decent capability system is similar to that of a paper wall that
can be penetrated by a pencil and a 10m thick concrete wall that can
take a nuke.
Andrej
-- Andrej Presern, andrejp@luz.fe.uni-lj.si
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/