SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Capability-based security</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Capability-based security</span></span>

</h1>

</header>

<p><b>Capability-based security</b> is a concept in the design of <a href="Computer_security" title="Computer security">secure computing</a> systems, one of the existing <a href="Computer_security_model" title="Computer security model">security models</a>. A <b>capability</b> (known in some systems as a <b>key</b>) is a communicable, unforgeable <a href="Access_token" title="Access token">token</a> of authority. It refers to a value that <a href="Reference_(computer_science)" title="Reference (computer science)">references</a> an <a href="Object_(computer_science)" title="Object (computer science)">object</a> along with an associated set of <a href="Access_control" title="Access control">access rights</a>. A <a href="User_(computing)" title="User (computing)">user</a> <a href="Computer_program" title="Computer program">program</a> on a <a href="Capability-based_operating_system" title="Capability-based operating system">capability-based operating system</a> must use a capability to access an object. Capability-based security refers to the principle of designing user programs such that they directly share capabilities with each other according to the <a href="Principle_of_least_privilege" title="Principle of least privilege">principle of least privilege</a>, and to the operating system infrastructure necessary to make such transactions efficient and secure. Capability-based security is to be contrasted with an approach that uses <a href="File-system_permissions" title="File-system permissions">traditional UNIX permissions</a> and <a href="Access-control_list" title="Access-control list">access control lists</a>.

</p><p>Although most operating systems implement a facility which resembles capabilities, they typically do not provide enough support to allow for the exchange of capabilities among possibly mutually untrusting entities to be the primary means of granting and distributing access rights throughout the system. A capability-based system, in contrast, is designed with that goal in mind.

</p>

<div class="mw-heading mw-heading2"><h2 id="Introduction">Introduction</h2></div>

<p>Capabilities achieve their objective of improving system security by being used in place of forgeable <a href="Reference_(computer_science)" title="Reference (computer science)">references</a>. A forgeable reference (for example, a <a href="Path_(computing)" title="Path (computing)">path name</a>) identifies an object, but does not specify which access rights are appropriate for that object and the user program which holds that reference. Consequently, any attempt to access the referenced object must be validated by the operating system, based on the <a href="Ambient_authority" title="Ambient authority">ambient authority</a> of the requesting program, typically via the use of an <a href="Access-control_list" title="Access-control list">access-control list</a> (ACL). Instead, in a system with capabilities, the mere fact that a user program possesses that capability entitles it to use the referenced object in accordance with the rights that are specified by that capability. In theory, a system with capabilities removes the need for any access control list or similar mechanism by giving all entities all and only the capabilities they will actually need.

</p><p>A capability is typically implemented as a <a href="Privilege_(computing)" title="Privilege (computing)">privileged</a> <a href="Data_structure" title="Data structure">data structure</a> that consists of a section that specifies access rights, and a section that uniquely identifies the object to be accessed. The user does not access the data structure or object directly, but instead via a <a href="Handle_(computing)" title="Handle (computing)">handle</a>. In practice, it is used much like a <a href="File_descriptor" title="File descriptor">file descriptor</a> in a traditional operating system (a traditional handle), but to access every object on the system. Capabilities are typically stored by the operating system in a list, with some mechanism in place to prevent the program from directly modifying the contents of the capability (so as to forge access rights or change the object it points to). Some systems have also been based on <a href="Capability-based_addressing" title="Capability-based addressing">capability-based addressing</a> (hardware support for capabilities), such as <a href="Plessey_System_250" title="Plessey System 250">Plessey System 250</a>.

</p><p>Programs possessing capabilities can perform functions on them, such as passing them on to other programs, converting them to a less-privileged version, or deleting them. The operating system must ensure that only specific operations can occur to the capabilities in the system, in order to maintain the integrity of the security policy.

</p><p>Capabilities as discussed in this article should not be confused with Portable Operating System Interface (<a href="POSIX" title="POSIX">POSIX</a>) 1e/2c "<a href="#POSIX_capabilities">Capabilities</a>". The latter are coarse-grained privileges that cannot be transferred between processes.

</p>

<div class="mw-heading mw-heading2"><h2 id="Examples">Examples</h2></div>

<p>A capability is defined to be a protected <a href="Object_(computer_science)" title="Object (computer science)">object</a> reference which, by virtue of its possession by a user process, grants that process the capability (hence the name) to interact with an object in certain ways. Those ways might include reading data associated with an object, modifying the object, executing the data in the object as a process, and other conceivable access rights. The capability logically consists of a reference that uniquely identifies a particular object and a set of one or more of these rights.

</p><p>Suppose that, in a user process's memory space, there exists the following string:

</p>

<pre>/etc/passwd

</pre>

<p>Although this identifies a unique object on the system, it does not specify access rights and hence is not a capability. Suppose there is instead the following pair of values:

</p>

<pre>/etc/passwd

O_RDWR

</pre>

<p>This pair identifies an object along with a set of access rights. The pair, however, is still not a capability because the user process's <i>possession</i> of these values says nothing about whether that access would actually be legitimate.

</p><p>Now suppose that the user program successfully executes the following statement:

</p>

<div class="mw-highlight mw-highlight-lang-c mw-content-ltr" dir="ltr"><pre><span class="kt">int</span><span class="w"> </span><span class="n">fd</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">open</span><span class="p">(</span><span class="s">"/etc/passwd"</span><span class="p">,</span><span class="w"> </span><span class="n">O_RDWR</span><span class="p">);</span>

</pre></div>

<p>The variable <code>fd</code> now contains the index of a file descriptor in the process's file descriptor table. This file descriptor <i>is</i> a capability. Its existence in the process's file descriptor table is sufficient to show that the process does indeed have legitimate access to the object. A key feature of this arrangement is that the file descriptor table is in <a href="Kernel_(operating_system)" title="Kernel (operating system)">kernel memory</a> and cannot be directly manipulated by the user program.

</p>

<div class="mw-heading mw-heading2"><h2 id="Sharing_between_processes">Sharing between processes</h2></div>

<p>In traditional operating systems, programs often communicate with each other and with storage using references like those in the first two examples. Path names are often passed as command-line parameters, sent via sockets, and stored on disk. These references are not capabilities, and must be validated before they can be used. In these systems, a central question is "on whose <i>authority</i> is a given reference to be evaluated?" This becomes a critical issue especially for processes which must act on behalf of two different authority-bearing entities. They become susceptible to a programming error known as the <a href="Confused_deputy_problem" title="Confused deputy problem">confused deputy problem</a>, very frequently resulting in a <a href="Security_hole" class="mw-redirect" title="Security hole">security hole</a>.

</p><p>In a capability-based system, the capabilities themselves are passed between processes and storage using a mechanism that is known by the operating system to maintain the integrity of those capabilities.

</p><p>One novel approach to solving this problem involves the use of an <a href="Orthogonal_persistence" class="mw-redirect" title="Orthogonal persistence">orthogonally persistent</a> operating system. In such a system, there is no need for entities to be discarded and their capabilities be invalidated, and hence require an ACL-like mechanism to restore those capabilities at a later time. The operating system maintains the integrity and security of the capabilities contained within all storage, both volatile and nonvolatile, at all times; in part by performing all <a href="Serialization" title="Serialization">serialization</a> tasks by itself, rather than requiring user programs to do so, as is the case in most operating systems. Because user programs are relieved of this responsibility, there is no need to trust them to reproduce only legal capabilities, nor to validate requests for access using an <a href="Access_control" title="Access control">access control</a> mechanism. An example implementation is the <a href="Flex_machine" title="Flex machine">Flex machine</a> from the early 1980s.

</p>

<div class="mw-heading mw-heading2"><h2 id="POSIX_capabilities">POSIX capabilities</h2></div>

<p>Portable Operating System Interface (POSIX) draft 1003.1e specifies a concept of permissions called "capabilities". However, POSIX capabilities differ from capabilities in this article. A POSIX capability is not associated with any object; a process having CAP_NET_BIND_SERVICE capability can listen on any TCP port under 1024. This system is found in Linux.<sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup>

</p><p>In contrast, <a href="Capsicum_(Unix)" title="Capsicum (Unix)">Capsicum</a> Unix hybridizes a true capability-system model with a Unix design and POSIX API. Capsicum capabilities are a refined form of file descriptor, a delegable right between processes and additional object types beyond classic POSIX, such as processes, can be referenced via capabilities. In Capsicum capability mode, processes are unable to utilize global namespaces (such as the filesystem namespace) to look up objects, and must instead inherit or be delegated them. This system is found natively in FreeBSD, but patches are available to other systems.<sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Implementations">Implementations</h2></div>

<p>Notable research and commercial systems employing capability-based security include the following:

</p>

<ul><li><a href="Tahoe-LAFS" title="Tahoe-LAFS">Tahoe-LAFS</a>, an open-source capability-based filesystem</li>

<li><a href="FreeBSD" title="FreeBSD">FreeBSD</a> <a href="Capsicum_(Unix)" title="Capsicum (Unix)">Capsicum</a><sup id="cite_ref-3" class="reference"><a href="#cite_note-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-4" class="reference"><a href="#cite_note-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup></li>

<li><a href="Genode" title="Genode">Genode</a><sup id="cite_ref-5" class="reference"><a href="#cite_note-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup></li>

<li><a href="Fuchsia_(operating_system)" title="Fuchsia (operating system)">Fuchsia</a><sup id="cite_ref-6" class="reference"><a href="#cite_note-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup></li>

<li><a href="HarmonyOS" title="HarmonyOS">HarmonyOS</a> (<a href="OpenHarmony" title="OpenHarmony">OpenHarmony</a>) <sup id="cite_ref-7" class="reference"><a href="#cite_note-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-8" class="reference"><a href="#cite_note-8"><span class="cite-bracket">[</span>8<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-9" class="reference"><a href="#cite_note-9"><span class="cite-bracket">[</span>9<span class="cite-bracket">]</span></a></sup></li>

<li><a href="Phantom_OS" title="Phantom OS">Phantom OS</a><sup id="cite_ref-10" class="reference"><a href="#cite_note-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup></li>

<li><a href="RedoxOS" title="RedoxOS">RedoxOS</a></li>

<li><a href="L4_microkernel_family" title="L4 microkernel family">L4 microkernel family</a>:

<ul><li>OKL4 from Open Kernel Labs</li>

<li><a href="SeL4" class="mw-redirect" title="SeL4">SeL4</a> from NICTA</li>

<li>Fiasco.OC and NOVA from <a href="TU_Dresden" title="TU Dresden">TU Dresden</a></li></ul></li>

<li><a href="WebAssembly" title="WebAssembly">WebAssembly</a> System Interface (WASI)</li></ul>

<div class="mw-heading mw-heading3"><h3 id="Discontinued">Discontinued</h3></div>

<ul><li><a href="Amoeba_(operating_system)" title="Amoeba (operating system)">Amoeba</a> distributed operating system</li>

<li><a href="GNOSIS" title="GNOSIS">GNOSIS</a>, an operating system developed at <a href="Tymshare" title="Tymshare">Tymshare</a>

<ul><li><a href="KeyKOS" title="KeyKOS">KeyKOS</a>, successor to GNOSIS

<ul><li>EROS, The <a href="Extremely_Reliable_Operating_System" class="mw-redirect" title="Extremely Reliable Operating System">Extremely Reliable Operating System</a>, successor to KeyKOS</li></ul></li></ul></li>

<li><a href="Cambridge_CAP_computer" class="mw-redirect" title="Cambridge CAP computer">Cambridge CAP computer</a></li>

<li><a href="Hydra_(operating_system)" title="Hydra (operating system)">Hydra (operating system)</a>, part of the <a href="C.mmp" title="C.mmp">C.mmp</a> project at <a href="Carnegie_Mellon_University" title="Carnegie Mellon University">Carnegie Mellon University</a></li>

<li>IBM <a href="System/38" class="mw-redirect" title="System/38">System/38</a> and <a href="AS/400" class="mw-redirect" title="AS/400">AS/400</a></li>

<li><a href="Intel_iAPX_432" title="Intel iAPX 432">Intel iAPX 432</a></li>

<li><a href="Plessey_System_250" title="Plessey System 250">Plessey System 250</a></li>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

<li id="cite_note-1"><span class="mw-cite-backlink"><b><a href="#cite_ref-1">^</a></b></span> <span class="reference-text"><span class="neverexpand"><code><a rel="nofollow" class="external text" href="https://manned.org/capabilities.7">capabilities(7)</a></code></span> – <a href="Linux" title="Linux">Linux</a> Programmer's <a href="Man_page" title="Man page">Manual</a> – Overview, Conventions and Miscellanea</span>

</li>

<li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><span class="neverexpand"><code><a rel="nofollow" class="external text" href="https://www.freebsd.org/cgi/man.cgi?query=capsicum&sektion=4">capsicum(4)</a></code></span> – <a href="FreeBSD" title="FreeBSD">FreeBSD</a> Kernel Interfaces <a href="Man_page" title="Man page">Manual</a></span>

</li>

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.freebsd.org/cgi/man.cgi?capsicum(4)">"Capsicum(4)"</a>.</cite></span>

</li>

<li id="cite_note-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-4">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="https://www.cl.cam.ac.uk/research/security/capsicum/papers/2010usenix-security-capsicum-website.pdf">Capsicum: practical capabilities for UNIX</a>. Retrieved 9 July 2024</span>

</li>

<li id="cite_note-5"><span class="mw-cite-backlink"><b><a href="#cite_ref-5">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://rudd-o.com/linux-and-free-software/genode-os-a-breath-of-fresh-air-in-operating-system-and-software-security">"Genode OS: a breath of fresh air in operating system and software security"</a>. <i>Rudd-O.com</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2023-12-21</span></span>.</cite></span>

</li>

<li id="cite_note-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-6">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.engadget.com/2016-08-13-google-fuchsia-operating-system.html">"Google's Fuchsia operating system runs on virtually anything"</a>. <i>Engadget</i>. 2016-08-14<span class="reference-accessdate">. Retrieved <span class="nowrap">2023-12-21</span></span>.</cite></span>

</li>

<li id="cite_note-7"><span class="mw-cite-backlink"><b><a href="#cite_ref-7">^</a></b></span> <span class="reference-text"><cite id="CITEREFDěcký" class="citation web cs1">Děcký, Martin. <a rel="nofollow" class="external text" href="https://d3s.mff.cuni.cz/files/teaching/nswi161/martin-decky-microkernels-capabilities.pdf">"Microkernel-based and Capability-based Operating Systems"</a> <span class="cs1-format">(PDF)</span>. <i>D3S</i><span class="reference-accessdate">. Retrieved <span class="nowrap">23 December</span> 2023</span>.</cite></span>

</li>

<li id="cite_note-8"><span class="mw-cite-backlink"><b><a href="#cite_ref-8">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://github.com/openharmony/docs/blob/master/en/application-dev/security/accesstoken-overview.md">"docs/en/application-dev/security/accesstoken-overview.md at master · openharmony/docs"</a>. <i>GitHub</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2024-05-04</span></span>.</cite></span>

</li>

<li id="cite_note-9"><span class="mw-cite-backlink"><b><a href="#cite_ref-9">^</a></b></span> <span class="reference-text"><cite id="CITEREFDARKNAVY2024" class="citation web cs1">DARKNAVY (2024-06-11). <a rel="nofollow" class="external text" href="https://www.darknavy.org/blog/avss_report_kernel/">"AVSS Report: System Security Adversarial Capability Preliminary Evaluation of iOS, Android, and HarmonyOS - Kernel"</a>. <i>DARKNAVY</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2024-07-04</span></span>.</cite></span>

</li>

<li id="cite_note-10"><span class="mw-cite-backlink"><b><a href="#cite_ref-10">^</a></b></span> <span class="reference-text"><cite id="CITEREFDziuba" class="citation web cs1">Dziuba, Ted. <a rel="nofollow" class="external text" href="https://www.theregister.com/2009/02/03/phantom_russian_os/">"Russian rides Phantom to OS immortality"</a>. <i>The Register</i><span class="reference-accessdate">. Retrieved <span class="nowrap">31 December</span> 2023</span>.</cite></span>

</li>

</ol></div></div>

<ul><li>Levy, Henry M., <i>*<a rel="nofollow" class="external text" href="http://portal.acm.org/citation.cfm?id=538134&dl=ACM&coll=&CFID=15151515&CFTOKEN=6184618">Capability-Based Computer Systems</a></i>, Digital Equipment Corporation 1984. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>0-932376-22-3</bdi>. An electronic version is available <a rel="nofollow" class="external text" href="http://www.cs.washington.edu/homes/levy/capabook/">here</a>.</li>

<li><a rel="nofollow" class="external text" href="https://web.archive.org/web/20031029002231/http://www.eros-os.org/">The EROS Project</a></li>

<li><a href="E_programming_language" class="mw-redirect" title="E programming language">E</a>, a programming language based around capability security (<a rel="nofollow" class="external text" href="http://www.erights.org/">ERights.org</a>)</li>

<li>Mark S. Miller, Ka-Ping Yee, Jonathan Shapiro. <i>Capability Myths Demolished</i>, Technical Report SRL2003-02, Systems Research Laboratory, Johns Hopkins University. <a rel="nofollow" class="external text" href="http://srl.cs.jhu.edu/pubs/SRL2003-02.pdf">Available online.</a></li>

<li><a rel="nofollow" class="external text" href="http://www.cs.washington.edu/homes/levy/capabook/Chapter5.pdf">The Cambridge CAP Computer</a>, Levy, 1988</li></ul>

<div class="mw-heading mw-heading2"><h2 id="Further_reading">Further reading</h2></div>

<ul><li><a href="Capability-based_addressing" title="Capability-based addressing">Capability-based addressing</a>: <cite id="CITEREFTheodore_A._Linden1976" class="citation journal cs1">Theodore A. Linden (December 1976). "Operating System Structures to Support Security and Reliable Software". <i><a href="ACM_Computing_Surveys" title="ACM Computing Surveys">ACM Computing Surveys</a></i>. <b>8</b> (4): <span class="nowrap">409–</span>445. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F356678.356682">10.1145/356678.356682</a>. <a href="Hdl_(identifier)" class="mw-redirect" title="Hdl (identifier)">hdl</a>:<span class="id-lock-free" title="Freely accessible"><a rel="nofollow" class="external text" href="https://hdl.handle.net/2027%2Fmdp.39015086560037">2027/mdp.39015086560037</a></span>. <a href="ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/0360-0300">0360-0300</a>. <a href="S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:16720589">16720589</a>.</cite></li>

<li><a href="Li_Gong_(computer_scientist)" title="Li Gong (computer scientist)">Li Gong</a>, <i><a rel="nofollow" class="external text" href="http://doi.ieeecomputersociety.org/10.1109/SECPRI.1989.36277">A Secure Identity-Based Capability System</a></i>, sp, p. 56, 1989 IEEE Symposium on Security and Privacy, 1989</li>

<li><a rel="nofollow" class="external text" href="http://portal.acm.org/citation.cfm?id=361070&dl=ACM&coll=&CFID=15151515&CFTOKEN=6184618">Capability-based addressing</a></li>

<li><a rel="nofollow" class="external text" href="http://portal.acm.org/citation.cfm?id=850709&dl=ACM&coll=&CFID=15151515&CFTOKEN=6184618">A hardware implementation of capability-based addressing</a></li>

<li><a rel="nofollow" class="external text" href="http://portal.acm.org/citation.cfm?id=850701&coll=&dl=ACM&CFID=15151515&CFTOKEN=6184618">An implementation of capabilities on the PDP-11/45</a></li>

<li><a rel="nofollow" class="external text" href="http://portal.acm.org/citation.cfm?id=801885&dl=ACM&coll=&CFID=15151515&CFTOKEN=6184618">IBM System/38 support for capability-based addressing</a></li>

<li><a rel="nofollow" class="external text" href="http://portal.acm.org/citation.cfm?id=319163&dl=ACM&coll=&CFID=15151515&CFTOKEN=6184618">EROS: a fast capability system</a></li></ul>

<p>POSIX "capabilities" in Linux:

</p>

<ul><li><a rel="nofollow" class="external text" href="http://www.friedhoff.org/posixfilecaps.html">POSIX Capabilities & Files</a></li>

<li><a rel="nofollow" class="external text" href="http://www.ibm.com/developerworks/library/l-posixcap/">POSIX file capabilities: Parceling the power of root</a></li>

<li><a rel="nofollow" class="external text" href="http://www.linuxjournal.com/magazine/making-root-unprivileged">Making Root Unprivileged</a></li>

<li><a rel="nofollow" class="external text" href="http://www.sevagas.com/?POSIX-file-capabilities-the-dark">Security issues and new risks linked to POSIX file capabilities</a></li>

<li><a rel="nofollow" class="external text" href="http://man7.org/linux/man-pages/man7/capabilities.7.html">Linux manual page for "capabilities(7)"</a></li>

<li><a rel="nofollow" class="external text" href="https://www.vultr.com/docs/working-with-linux-capabilities">Working with Linux capabilities</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2></div>

<ul><li><a rel="nofollow" class="external text" href="https://archive.today/20130112225523/http://www.eros-os.org/essays/capintro.html">"What is a Capability?"</a></li>

<li><a rel="nofollow" class="external text" href="https://archive.today/20130414162939/http://www.eros-os.org/pipermail/cap-talk/2003-March/001133.html">Reviews of 'Capability Myths Demolished'</a></li>

<li><a rel="nofollow" class="external text" href="http://www.cap-lore.com/CapTheory/index.html">Capability Theory by Sound Bytes</a></li></ul>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hlist dl,.mw-parser-output .hlist ol,.mw-parser-output .hlist ul{margin:0;padding:0}.mw-parser-output .hlist dd,.mw-parser-output .hlist dt,.mw-parser-output .hlist li{margin:0;display:inline}.mw-parser-output .hlist.inline,.mw-parser-output .hlist.inline dl,.mw-parser-output .hlist.inline ol,.mw-parser-output .hlist.inline ul,.mw-parser-output .hlist dl dl,.mw-parser-output .hlist dl ol,.mw-parser-output .hlist dl ul,.mw-parser-output .hlist ol dl,.mw-parser-output .hlist ol ol,.mw-parser-output .hlist ol ul,.mw-parser-output .hlist ul dl,.mw-parser-output .hlist ul ol,.mw-parser-output .hlist ul ul{display:inline}.mw-parser-output .hlist .mw-empty-li{display:none}.mw-parser-output .hlist dt::after{content:": "}.mw-parser-output .hlist dd::after,.mw-parser-output .hlist li::after{content:" · ";font-weight:bold}.mw-parser-output .hlist dd:last-child::after,.mw-parser-output .hlist dt:last-child::after,.mw-parser-output .hlist li:last-child::after{content:none}.mw-parser-output .hlist dd dd:first-child::before,.mw-parser-output .hlist dd dt:first-child::before,.mw-parser-output .hlist dd li:first-child::before,.mw-parser-output .hlist dt dd:first-child::before,.mw-parser-output .hlist dt dt:first-child::before,.mw-parser-output .hlist dt li:first-child::before,.mw-parser-output .hlist li dd:first-child::before,.mw-parser-output .hlist li dt:first-child::before,.mw-parser-output .hlist li li:first-child::before{content:" (";font-weight:normal}.mw-parser-output .hlist dd dd:last-child::after,.mw-parser-output .hlist dd dt:last-child::after,.mw-parser-output .hlist dd li:last-child::after,.mw-parser-output .hlist dt dd:last-child::after,.mw-parser-output .hlist dt dt:last-child::after,.mw-parser-output .hlist dt li:last-child::after,.mw-parser-output .hlist li dd:last-child::after,.mw-parser-output .hlist li dt:last-child::after,.mw-parser-output .hlist li li:last-child::after{content:")";font-weight:normal}.mw-parser-output .hlist ol{counter-reset:listitem}.mw-parser-output .hlist ol>li{counter-increment:listitem}.mw-parser-output .hlist ol>li::before{content:" "counter(listitem)"\a0 "}.mw-parser-output .hlist dd ol>li:first-child::before,.mw-parser-output .hlist dt ol>li:first-child::before,.mw-parser-output .hlist li ol>li:first-child::before{content:" ("counter(listitem)"\a0 "}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1236075235">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbox{box-sizing:border-box;border:1px solid #a2a9b1;width:100%;clear:both;font-size:88%;text-align:center;padding:1px;margin:1em auto 0}.mw-parser-output .navbox .navbox{margin-top:0}.mw-parser-output .navbox+.navbox,.mw-parser-output .navbox+.navbox-styles+.navbox{margin-top:-1px}.mw-parser-output .navbox-inner,.mw-parser-output .navbox-subgroup{width:100%}.mw-parser-output .navbox-group,.mw-parser-output .navbox-title,.mw-parser-output .navbox-abovebelow{padding:0.25em 1em;line-height:1.5em;text-align:center}.mw-parser-output .navbox-group{white-space:nowrap;text-align:right}.mw-parser-output .navbox,.mw-parser-output .navbox-subgroup{background-color:#fdfdfd}.mw-parser-output .navbox-list{line-height:1.5em;border-color:#fdfdfd}.mw-parser-output .navbox-list-with-group{text-align:left;border-left-width:2px;border-left-style:solid}.mw-parser-output tr+tr>.navbox-abovebelow,.mw-parser-output tr+tr>.navbox-group,.mw-parser-output tr+tr>.navbox-image,.mw-parser-output tr+tr>.navbox-list{border-top:2px solid #fdfdfd}.mw-parser-output .navbox-title{background-color:#ccf}.mw-parser-output .navbox-abovebelow,.mw-parser-output .navbox-group,.mw-parser-output .navbox-subgroup .navbox-title{background-color:#ddf}.mw-parser-output .navbox-subgroup .navbox-group,.mw-parser-output .navbox-subgroup .navbox-abovebelow{background-color:#e6e6ff}.mw-parser-output .navbox-even{background-color:#f7f7f7}.mw-parser-output .navbox-odd{background-color:transparent}.mw-parser-output .navbox .hlist td dl,.mw-parser-output .navbox .hlist td ol,.mw-parser-output .navbox .hlist td ul,.mw-parser-output .navbox td.hlist dl,.mw-parser-output .navbox td.hlist ol,.mw-parser-output .navbox td.hlist ul{padding:0.125em 0}.mw-parser-output .navbox .navbar{display:block;font-size:100%}.mw-parser-output .navbox-title .navbar{float:left;text-align:left;margin-right:0.5em}body.skin--responsive .mw-parser-output .navbox-image img{max-width:none!important}@media print{body.ns-0 .mw-parser-output .navbox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style></div><div role="navigation" class="navbox" aria-labelledby="Object-capability_security187" style="padding:3px"><table class="nowraplinks mw-collapsible autocollapse navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><th scope="col" class="navbox-title" colspan="2"><style data-mw-deduplicate="TemplateStyles:r1239400231">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbar{display:inline;font-size:88%;font-weight:normal}.mw-parser-output .navbar-collapse{float:left;text-align:left}.mw-parser-output .navbar-boxtext{word-spacing:0}.mw-parser-output .navbar ul{display:inline-block;white-space:nowrap;line-height:inherit}.mw-parser-output .navbar-brackets::before{margin-right:-0.125em;content:"[ "}.mw-parser-output .navbar-brackets::after{margin-left:-0.125em;content:" ]"}.mw-parser-output .navbar li{word-spacing:-0.125em}.mw-parser-output .navbar a>span,.mw-parser-output .navbar a>abbr{text-decoration:inherit}.mw-parser-output .navbar-mini abbr{font-variant:small-caps;border-bottom:none;text-decoration:none;cursor:inherit}.mw-parser-output .navbar-ct-full{font-size:114%;margin:0 7em}.mw-parser-output .navbar-ct-mini{font-size:114%;margin:0 4em}html.skin-theme-clientpref-night .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}}@media print{.mw-parser-output .navbar{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div id="Object-capability_security187" style="font-size:114%;margin:0 4em"><a href="Object-capability_model" title="Object-capability model">Object-capability</a> security</div></th></tr><tr><th scope="row" class="navbox-group" style="width:1%">Concepts</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Principle_of_least_privilege" title="Principle of least privilege">Principle of least privilege</a> (PoLP)</li>

<li><a href="Confused_deputy_problem" title="Confused deputy problem">Confused deputy problem</a></li>

<li><a href="Ambient_authority" title="Ambient authority">Ambient authority</a></li>

<li><a href="File_descriptor" title="File descriptor">File descriptor</a></li>

<li><a href="Object-capability_model" title="Object-capability model">Object-capability model</a></li>

<li><a href="Capability-based_addressing" title="Capability-based addressing">Capability-based addressing</a></li>

<li><a href="Zooko's_triangle" title="Zooko's triangle">Zooko's triangle</a></li>

<li><a href="Petname" title="Petname">Petnames</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Operating_system" title="Operating system">Operating systems</a>,<br><a href="Kernel_(operating_system)" title="Kernel (operating system)">kernels</a></th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Capsicum_(Unix)" title="Capsicum (Unix)">Capsicum</a></li>

<li><a href="Fuchsia_(operating_system)" title="Fuchsia (operating system)">Fuchsia</a></li>

<li><a href="Genode" title="Genode">Genode</a></li>

<li><a href="GNOSIS" title="GNOSIS">GNOSIS</a> → <a href="KeyKOS" title="KeyKOS">KeyKOS</a> → <a href="EROS_(microkernel)" title="EROS (microkernel)">EROS</a> → CapROS</li>

<li><a href="Hydra_(operating_system)" title="Hydra (operating system)">Hydra</a></li>

<li><a href="Midori_(operating_system)" title="Midori (operating system)">Midori</a></li>

<li><a href="NLTSS" title="NLTSS">NLTSS</a></li>

<li><a href="HarmonyOS" title="HarmonyOS">HarmonyOS</a> (<a href="HarmonyOS_NEXT" title="HarmonyOS NEXT">HarmonyOS NEXT</a>)</li>

<li><a href="Phantom_OS" title="Phantom OS">Phantom OS</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Programming_language" title="Programming language">Programming languages</a></th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Caja_project" title="Caja project">Caja–Cajita</a></li>

<li><a href="Joule_(programming_language)" title="Joule (programming language)">Joule</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="File_system" title="File system">File systems</a></th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Tahoe-LAFS" title="Tahoe-LAFS">Tahoe-LAFS</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Specialised hardware</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<li><a href="CAP_computer" title="CAP computer">Cambridge CAP</a></li>

<li><a href="IBM_System/38" title="IBM System/38">IBM System/38</a></li>

<li><a href="Intel_iAPX_432" title="Intel iAPX 432">Intel iAPX 432</a></li>

<li><a href="Plessey_System_250" title="Plessey System 250">Plessey System 250</a></li>

<li><a href="Capability_Hardware_Enhanced_RISC_Instructions" title="Capability Hardware Enhanced RISC Instructions">CHERI</a></li></ul>

</div></td></tr></tbody></table></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-06-12" href="https://en.wikipedia.org/wiki/?title=Capability-based_security&oldid=1295300962">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>