HOME

TheInfoList



OR:

Capability-based security is a concept in the design of secure computing systems, one of the existing security models. A capability (known in some systems as a key) is a communicable, unforgeable token of authority. It refers to a value that
references A reference is a relationship between Object (philosophy), objects in which one object designates, or acts as a means by which to connect to or link to, another object. The first object in this relation is said to ''refer to'' the second object. ...
an object along with an associated set of access rights. A user program on a capability-based operating system must use a capability to access an object. Capability-based security refers to the principle of designing user programs such that they directly share capabilities with each other according to the
principle of least privilege In information security, computer science, and other fields, the principle of least privilege (PoLP), also known as the principle of minimal privilege (PoMP) or the principle of least authority (PoLA), requires that in a particular abstraction l ...
, and to the operating system infrastructure necessary to make such transactions efficient and secure. Capability-based security is to be contrasted with an approach that uses traditional UNIX permissions and access control lists. Although most operating systems implement a facility which resembles capabilities, they typically do not provide enough support to allow for the exchange of capabilities among possibly mutually untrusting entities to be the primary means of granting and distributing access rights throughout the system. A capability-based system, in contrast, is designed with that goal in mind.


Introduction

Capabilities achieve their objective of improving system security by being used in place of forgeable
references A reference is a relationship between Object (philosophy), objects in which one object designates, or acts as a means by which to connect to or link to, another object. The first object in this relation is said to ''refer to'' the second object. ...
. A forgeable reference (for example, a path name) identifies an object, but does not specify which access rights are appropriate for that object and the user program which holds that reference. Consequently, any attempt to access the referenced object must be validated by the operating system, based on the ambient authority of the requesting program, typically via the use of an access-control list (ACL). Instead, in a system with capabilities, the mere fact that a user program possesses that capability entitles it to use the referenced object in accordance with the rights that are specified by that capability. In theory, a system with capabilities removes the need for any access control list or similar mechanism by giving all entities all and only the capabilities they will actually need. A capability is typically implemented as a privileged
data structure In computer science, a data structure is a data organization and storage format that is usually chosen for Efficiency, efficient Data access, access to data. More precisely, a data structure is a collection of data values, the relationships amo ...
that consists of a section that specifies access rights, and a section that uniquely identifies the object to be accessed. The user does not access the data structure or object directly, but instead via a
handle A handle is a part of, or an attachment to, an object that allows it to be grasped and object manipulation, manipulated by hand. The design of each type of handle involves substantial ergonomics, ergonomic issues, even where these are dealt wi ...
. In practice, it is used much like a
file descriptor In Unix and Unix-like computer operating systems, a file descriptor (FD, less frequently fildes) is a process-unique identifier (handle) for a file or other input/output resource, such as a pipe or network socket. File descriptors typically h ...
in a traditional operating system (a traditional handle), but to access every object on the system. Capabilities are typically stored by the operating system in a list, with some mechanism in place to prevent the program from directly modifying the contents of the capability (so as to forge access rights or change the object it points to). Some systems have also been based on capability-based addressing (hardware support for capabilities), such as Plessey System 250. Programs possessing capabilities can perform functions on them, such as passing them on to other programs, converting them to a less-privileged version, or deleting them. The operating system must ensure that only specific operations can occur to the capabilities in the system, in order to maintain the integrity of the security policy. Capabilities as discussed in this article should not be confused with Portable Operating System Interface (
POSIX The Portable Operating System Interface (POSIX; ) is a family of standards specified by the IEEE Computer Society for maintaining compatibility between operating systems. POSIX defines application programming interfaces (APIs), along with comm ...
) 1e/2c " Capabilities". The latter are coarse-grained privileges that cannot be transferred between processes.


Examples

A capability is defined to be a protected object reference which, by virtue of its possession by a user process, grants that process the capability (hence the name) to interact with an object in certain ways. Those ways might include reading data associated with an object, modifying the object, executing the data in the object as a process, and other conceivable access rights. The capability logically consists of a reference that uniquely identifies a particular object and a set of one or more of these rights. Suppose that, in a user process's memory space, there exists the following string: /etc/passwd Although this identifies a unique object on the system, it does not specify access rights and hence is not a capability. Suppose there is instead the following pair of values: /etc/passwd O_RDWR This pair identifies an object along with a set of access rights. The pair, however, is still not a capability because the user process's ''possession'' of these values says nothing about whether that access would actually be legitimate. Now suppose that the user program successfully executes the following statement: int fd = open("/etc/passwd", O_RDWR); The variable fd now contains the index of a file descriptor in the process's file descriptor table. This file descriptor ''is'' a capability. Its existence in the process's file descriptor table is sufficient to show that the process does indeed have legitimate access to the object. A key feature of this arrangement is that the file descriptor table is in kernel memory and cannot be directly manipulated by the user program.


Sharing between processes

In traditional operating systems, programs often communicate with each other and with storage using references like those in the first two examples. Path names are often passed as command-line parameters, sent via sockets, and stored on disk. These references are not capabilities, and must be validated before they can be used. In these systems, a central question is "on whose ''authority'' is a given reference to be evaluated?" This becomes a critical issue especially for processes which must act on behalf of two different authority-bearing entities. They become susceptible to a programming error known as the confused deputy problem, very frequently resulting in a security hole. In a capability-based system, the capabilities themselves are passed between processes and storage using a mechanism that is known by the operating system to maintain the integrity of those capabilities. One novel approach to solving this problem involves the use of an orthogonally persistent operating system. In such a system, there is no need for entities to be discarded and their capabilities be invalidated, and hence require an ACL-like mechanism to restore those capabilities at a later time. The operating system maintains the integrity and security of the capabilities contained within all storage, both volatile and nonvolatile, at all times; in part by performing all
serialization In computing, serialization (or serialisation, also referred to as pickling in Python (programming language), Python) is the process of translating a data structure or object (computer science), object state into a format that can be stored (e. ...
tasks by itself, rather than requiring user programs to do so, as is the case in most operating systems. Because user programs are relieved of this responsibility, there is no need to trust them to reproduce only legal capabilities, nor to validate requests for access using an
access control In physical security and information security, access control (AC) is the action of deciding whether a subject should be granted or denied access to an object (for example, a place or a resource). The act of ''accessing'' may mean consuming ...
mechanism. An example implementation is the Flex machine from the early 1980s.


POSIX capabilities

Portable Operating System Interface (POSIX) draft 1003.1e specifies a concept of permissions called "capabilities". However, POSIX capabilities differ from capabilities in this article. A POSIX capability is not associated with any object; a process having CAP_NET_BIND_SERVICE capability can listen on any TCP port under 1024. This system is found in Linux. In contrast,
Capsicum ''Capsicum'' () is a genus of flowering plants in the Solanum, nightshade family Solanaceae, native to the Americas, cultivated worldwide for their edible fruit, which are generally known as "peppers" or "capsicum". Chili peppers grow on five s ...
Unix hybridizes a true capability-system model with a Unix design and POSIX API. Capsicum capabilities are a refined form of file descriptor, a delegable right between processes and additional object types beyond classic POSIX, such as processes, can be referenced via capabilities. In Capsicum capability mode, processes are unable to utilize global namespaces (such as the filesystem namespace) to look up objects, and must instead inherit or be delegated them. This system is found natively in FreeBSD, but patches are available to other systems.


Implementations

Notable research and commercial systems employing capability-based security include the following: * Tahoe-LAFS, an open-source capability-based filesystem *
FreeBSD FreeBSD is a free-software Unix-like operating system descended from the Berkeley Software Distribution (BSD). The first version was released in 1993 developed from 386BSD, one of the first fully functional and free Unix clones on affordable ...
Capsicum ''Capsicum'' () is a genus of flowering plants in the Solanum, nightshade family Solanaceae, native to the Americas, cultivated worldwide for their edible fruit, which are generally known as "peppers" or "capsicum". Chili peppers grow on five s ...
* Genode * Fuchsia *
HarmonyOS HarmonyOS (HMOS) ( zh, s=鸿蒙, p=Hóngméng, tr=Vast Mist) is a distributed operating system developed by Huawei for smartphones, tablet computer, tablets, smart TVs, smart watches, personal computers and other smart devices. It has a microk ...
(
OpenHarmony OpenHarmony (OHOS, OH) is a family of open-source distributed operating systems based on HarmonyOS derived from LiteOS, donated the L0-L2 branch source code by Huawei to the OpenAtom Foundation. Similar to HarmonyOS, the open-source distrib ...
) *
Phantom OS Phantom OS is an Persistence_(computer_science)#Orthogonal_or_transparent_persistence, orthogonally persistent managed code general-purpose operating system. It is based on a concept of persistent virtual memory, and executes bytecode in a virt ...
* RedoxOS * L4 microkernel family: **OKL4 from Open Kernel Labs ** SeL4 from NICTA **Fiasco.OC and NOVA from
TU Dresden TU Dresden (for , abbreviated as TUD), also as the Dresden University of Technology, is a public research university in Dresden, Germany. It is the largest institute of higher education in the city of Dresden, the largest university in Saxony a ...
*
WebAssembly WebAssembly (Wasm) defines a portable binary-code format and a corresponding text format for executable programs as well as software interfaces for facilitating communication between such programs and their host environment. The main goal of ...
System Interface (WASI)


Discontinued

* Amoeba distributed operating system *
GNOSIS Gnosis is the common Greek noun for knowledge ( γνῶσις, ''gnōsis'', f.). The term was used among various Hellenistic religions and philosophies in the Greco-Roman world. It is best known for its implication within Gnosticism, where ...
, an operating system developed at Tymshare **
KeyKOS KeyKOS is a persistent, pure capability-based operating system for the IBM S/370 mainframe computers. It allows emulating the environments of VM, MVS, and Portable Operating System Interface (POSIX). It is a predecessor of the Extremely Reli ...
, successor to GNOSIS *** EROS, The
Extremely Reliable Operating System Extremely Reliable Operating System (EROS) is an operating system developed starting in 1991 at the University of Pennsylvania, and then Johns Hopkins University, and The EROS Group, LLC. Features include automatic data and process persistence, s ...
, successor to KeyKOS * Cambridge CAP computer * Hydra (operating system), part of the C.mmp project at
Carnegie Mellon University Carnegie Mellon University (CMU) is a private research university in Pittsburgh, Pennsylvania, United States. The institution was established in 1900 by Andrew Carnegie as the Carnegie Technical Schools. In 1912, it became the Carnegie Institu ...
* IBM
System/38 The System/38 is a discontinued minicomputer and midrange computer manufactured and sold by IBM. The system was announced in 1978. The System/38 has 48-bit computing, 48-bit addressing, which was unique for the time, and a novel database#Integrat ...
and AS/400 * Intel iAPX 432 * Plessey System 250 * Flex


References

* Levy, Henry M., '
Capability-Based Computer Systems
', Digital Equipment Corporation 1984. . An electronic version is availabl
here

The EROS Project
* E, a programming language based around capability security
ERights.org
* Mark S. Miller, Ka-Ping Yee, Jonathan Shapiro. ''Capability Myths Demolished'', Technical Report SRL2003-02, Systems Research Laboratory, Johns Hopkins University
Available online.

The Cambridge CAP Computer
Levy, 1988


Further reading

* Capability-based addressing: * Li Gong,
A Secure Identity-Based Capability System
', sp, p. 56, 1989 IEEE Symposium on Security and Privacy, 1989
Capability-based addressing

A hardware implementation of capability-based addressing

An implementation of capabilities on the PDP-11/45

IBM System/38 support for capability-based addressing

EROS: a fast capability system
POSIX "capabilities" in Linux:


POSIX file capabilities: Parceling the power of root

Making Root Unprivileged

Security issues and new risks linked to POSIX file capabilities



Working with Linux capabilities


External links







{{DEFAULTSORT:Capability-Based Security Computer security models Access control