SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Object-capability model</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Object-capability model</span></span>

</h1>

</header>

/* start https://en.wikipedia.org/ */

.mw-parser-output .ambox{border:1px solid #a2a9b1;border-left:10px solid #36c;background-color:#fbfbfb;box-sizing:border-box}.mw-parser-output .ambox+link+.ambox,.mw-parser-output .ambox+link+style+.ambox,.mw-parser-output .ambox+link+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+style+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+link+.ambox{margin-top:-1px}html body.mediawiki .mw-parser-output .ambox.mbox-small-left{margin:4px 1em 4px 0;overflow:hidden;width:238px;border-collapse:collapse;font-size:88%;line-height:1.25em}.mw-parser-output .ambox-speedy{border-left:10px solid #b32424;background-color:#fee7e6}.mw-parser-output .ambox-delete{border-left:10px solid #b32424}.mw-parser-output .ambox-content{border-left:10px solid #f28500}.mw-parser-output .ambox-style{border-left:10px solid #fc3}.mw-parser-output .ambox-move{border-left:10px solid #9932cc}.mw-parser-output .ambox-protection{border-left:10px solid #a2a9b1}.mw-parser-output .ambox .mbox-text{border:none;padding:0.25em 0.5em;width:100%}.mw-parser-output .ambox .mbox-image{border:none;padding:2px 0 2px 0.5em;text-align:center}.mw-parser-output .ambox .mbox-imageright{border:none;padding:2px 0.5em 2px 0;text-align:center}.mw-parser-output .ambox .mbox-empty-cell{border:none;padding:0;width:1px}.mw-parser-output .ambox .mbox-image-div{width:52px}@media(min-width:720px){.mw-parser-output .ambox{margin:0 10%}}@media print{body.ns-0 .mw-parser-output .ambox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1248332772">

/* start https://en.wikipedia.org/ */

.mw-parser-output .multiple-issues-text{width:95%;margin:0.2em 0}.mw-parser-output .multiple-issues-text>.mw-collapsible-content{margin-top:0.3em}.mw-parser-output .compact-ambox .ambox{border:none;border-collapse:collapse;background-color:transparent;margin:0 0 0 1.6em!important;padding:0!important;width:auto;display:block}body.mediawiki .mw-parser-output .compact-ambox .ambox.mbox-small-left{font-size:100%;width:auto;margin:0}.mw-parser-output .compact-ambox .ambox .mbox-text{padding:0!important;margin:0!important}.mw-parser-output .compact-ambox .ambox .mbox-text-span{display:list-item;line-height:1.5em;list-style-type:disc}body.skin-minerva .mw-parser-output .multiple-issues-text>.mw-collapsible-toggle,.mw-parser-output .compact-ambox .ambox .mbox-image,.mw-parser-output .compact-ambox .ambox .mbox-imageright,.mw-parser-output .compact-ambox .ambox .mbox-empty-cell,.mw-parser-output .compact-ambox .hide-when-compact{display:none}

/* end https://en.wikipedia.org/ */

</style>

<p>The <b>object-capability model</b> is a <a href="Computer_security_model" title="Computer security model">computer security model</a>. A <a href="Capability-based_security" title="Capability-based security">capability</a> describes a transferable right to perform one (or more) operations on a given <a href="Object_(computer_science)" title="Object (computer science)">object</a>. It can be obtained by the following combination:

</p>

<dl><dd><ul><li>An unforgeable reference (in the sense of object references or protected pointers) that can be sent in messages.</li>

<li>A message that specifies the operation to be performed.</li></ul></dd></dl>

<p>The security model relies on not being able to forge references.

</p>

<dl><dd><ul><li>Objects can interact only by sending messages on references.</li>

<li>A reference can be obtained by:</li></ul>

<dl><dd><ol><li>Initial conditions: In the initial state of the computational world being described, object A may already have a reference to object B.</li>

<li>Parenthood: If A creates B, at that moment A obtains the only reference to the newly created B.</li>

<li>Endowment: If A creates B, B is born with that subset of A's references with which A chose to endow it.</li>

<li>Introduction: If A has references to both B and C, A can send to B a message containing a reference to C. B can retain that reference for subsequent use.</li></ol></dd></dl></dd></dl>

<p>In the object-capability model, <i>all</i> computation is performed following the above rules.

</p><p>Advantages that motivate <a href="Object_(computer_science)" title="Object (computer science)">object-oriented programming</a>, such as encapsulation or <a href="Information_hiding" title="Information hiding">information hiding</a>, <a href="Modular_programming" title="Modular programming">modular programming</a> (modularity), and <a href="Separation_of_concerns" title="Separation of concerns">separation of concerns</a>, correspond to security goals such as <a href="Principle_of_least_privilege" title="Principle of least privilege">least privilege</a> and <a href="Privilege_separation" title="Privilege separation">privilege separation</a> in capability-based programming.<sup id="cite_ref-thesis_1-0" class="reference"><a href="#cite_note-thesis-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup>

</p><p>The object-capability model was first proposed by <a href="Jack_Dennis" title="Jack Dennis">Jack Dennis</a> and Earl C. Van Horn in 1966.<sup id="cite_ref-3" class="reference"><a href="#cite_note-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Loopholes_in_object-oriented_programming_languages">Loopholes in object-oriented programming languages</h2></div>

<p>Some object-based programming languages (e.g., <a href="JavaScript" title="JavaScript">JavaScript</a> (<a href="Criticism_of_JavaScript" class="mw-redirect" title="Criticism of JavaScript">criticism</a>), <a href="Java_(programming_language)" title="Java (programming language)">Java</a>, and <a href="C_Sharp_(programming_language)" title="C Sharp (programming language)">C#</a>) provide ways to access resources in ways other than according to the rules above, including the following:

</p>

<dl><dd><ul><li>Direct <a href="Assignment_(computer_science)" title="Assignment (computer science)">assignment</a> to the <a href="Instance_variable" title="Instance variable">instance variables</a> of an object in Java and C#.</li>

<li>Direct <a href="Reflective_programming" title="Reflective programming">reflective programming</a> (reflection) inspection of the meta-data of an object in Java and C#.</li>

<li>The pervasive ability to import primitive modules, e.g., java.io.File that enable external effects.</li></ul></dd></dl>

<p>Such use of <i>undeniable authority</i> violates the conditions of the object-capability model. <a href="Caja_(programming_language)" class="mw-redirect" title="Caja (programming language)">Caja</a> and <a href="Joe-E" title="Joe-E">Joe-E</a> are variants of JavaScript and Java, respectively, that impose restrictions to eliminate these loopholes.

</p>

<div class="mw-heading mw-heading2"><h2 id="Advantages_of_object_capabilities">Advantages of object capabilities</h2></div>

<p>Computer scientist E. Dean Tribble stated that in <a href="Smart_contract" title="Smart contract">smart contracts</a>, identity-based access control did not support well dynamically changing permissions, compared to the object-capability model. He analogized the ocap model with giving a <a href="Valet_parking" title="Valet parking">valet</a> the key to a car, without giving the right to car ownership.<sup id="cite_ref-chorus-one_4-0" class="reference"><a href="#cite_note-chorus-one-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup>

</p><p>The structural properties of object capability systems favor modularity in code design and ensure reliable encapsulation in code implementation.

</p><p>These structural properties facilitate the analysis of some security properties of an object-capability program or <a href="Operating_system" title="Operating system">operating system</a>. Some of these, specifically information flow properties, can be analyzed at the level of object references and connectivity, independent of any knowledge or analysis of the code that determines the behavior of the objects. As a consequence, these security properties can be established and maintained in the presence of new objects that contain unknown and possibly malicious code.

</p><p>These structural properties stem from the two rules governing access to existing objects:

</p>

<dl><dd>1) An object <i>A</i> can send a message to <i>B</i> only if object <i>A</i> holds a reference to <i>B</i>.</dd>

<dd>2) An object <i>A</i> can obtain a reference to <i>C</i> only if object <i>A</i> receives a message containing a reference to <i>C</i>.</dd></dl>

<p>As a consequence of these two rules, an object can obtain a reference to another object only through a preexisting chain of references. In short, "Only connectivity begets connectivity."

</p>

<div class="mw-heading mw-heading2"><h2 id="Glossary_of_related_terms">Glossary of related terms</h2></div>

<dl><dt>object-capability system</dt>

<dd>A computational system that implements principles described in this article.</dd>

<dt>object</dt>

<dd>An object has local state and behavior. An object in this sense is both a <i>subject</i> and an <i>object</i> in the sense used in the access control literature.</dd>

<dt>reference</dt>

<dd>An unforgeable communications channel (protected pointer, opaque address) that unambiguously designates one object, and provides permission to send messages to that object.</dd>

<dt>message</dt>

<dd>What is sent on a reference. Depending on the system, messages may or may not be first-class objects.</dd>

<dt>request</dt>

<dd>An operation in which a message is sent on a reference. When the message is received, the receiver will have access to any references included in the message.</dd>

<dt>attenuation</dt>

<dd>A common <a href="Design_pattern" title="Design pattern">design pattern</a> in object-capability systems: given one reference of an object, create another reference for a proxy object with certain security restrictions, such as only permitting read-only access or allowing revocation. The proxy object performs security checks on messages that it receives and passes on any that are allowed. <i>Deep attenuation</i> refers to the case where the same attenuation is applied transitively to any objects obtained via the original attenuated object, typically by use of a <i>membrane</i>.</dd></dl>

<div class="mw-heading mw-heading2"><h2 id="Implementations">Implementations</h2></div>

<p>Almost all historical systems that have been described as <i>capability systems</i> can be modeled as object-capability systems. However, some uses of the term <i>capability</i> are inconsistent with the model, such as <a href="POSIX" title="POSIX">POSIX</a> <i>capabilities</i>.

</p><p><a href="KeyKOS" title="KeyKOS">KeyKOS</a>, <a href="EROS_(microkernel)" title="EROS (microkernel)">EROS</a>, <a href="Integrity_(operating_system)" title="Integrity (operating system)">Integrity (operating system)</a>, CapROS, Coyotos, <a href="SeL4" class="mw-redirect" title="SeL4">seL4</a>, <a href="OKL4" class="mw-redirect" title="OKL4">OKL4</a> and <a href="Fiasco_(L4_clone)" class="mw-redirect" title="Fiasco (L4 clone)">Fiasco.OC</a> are secure operating systems that implement the object-capability model.

</p>

<div class="mw-heading mw-heading2"><h2 id="Languages_that_implement_object_capabilities">Languages that implement object capabilities</h2></div>

<li><a href="Emerald_(programming_language)" title="Emerald (programming language)">Emerald</a> (1987)</li>

<li>Trusty Scheme (1992)</li>

<li><a href="Joule_(programming_language)" title="Joule (programming language)">Joule</a> (1996)</li>

<li>Original-E (1997)</li>

<li><a rel="nofollow" class="external text" href="https://web.archive.org/web/20070515041003/http://caperl.links.org/">CaPerl</a> (2006)</li>

<li><a rel="nofollow" class="external text" href="http://wiki.erights.org/wiki/Emily">Emily</a> (2006)</li>

<li><a rel="nofollow" class="external text" href="http://www.monte-language.org/">Monte</a> (2008–present)</li>

<li><a rel="nofollow" class="external text" href="http://www.ponylang.org/">Pony</a> (2014–present)<sup id="cite_ref-chorus-one_4-1" class="reference"><a href="#cite_note-chorus-one-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup></li>

<li><a href="Wyvern_(programming_language)" title="Wyvern (programming language)">Wyvern</a> (2012–present)</li>

<li><a href="Newspeak_(programming_language)" title="Newspeak (programming language)">Newspeak</a> (2007–present)</li>

<li><a href="Hack_(programming_language)" title="Hack (programming language)">Hack</a> (2021-present)</li>

<li><a rel="nofollow" class="external text" href="https://rchain-community.github.io/">Rholang</a> (2018-present)</li></ul>

<ul><li><a href="Capability-based_security" title="Capability-based security">Capability-based security</a></li>

<li><a href="Capability-based_addressing" title="Capability-based addressing">Capability-based addressing</a></li>

<li><a href="Actor_model" title="Actor model">Actor model</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite id="CITEREFMiller2006" class="citation report cs1"><a href="Mark_S._Miller" title="Mark S. Miller">Miller, Mark Samuel</a> (May 2006). <a rel="nofollow" class="external text" href="http://erights.org/talks/thesis/">Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control</a>. <i>erights.org</i> (Report). Baltimore, Maryland<span class="reference-accessdate">. Retrieved <span class="nowrap">28 July</span> 2013</span>.</cite></span>

</li>

<cite id="CITEREFMillerYeeShapiro2003" class="citation report cs1"><a href="Mark_S._Miller" title="Mark S. Miller">Miller, Mark S.</a>; Yee, Ka-Ping; Shapiro, Jonathan S. (2003). <a rel="nofollow" class="external text" href="http://srl.cs.jhu.edu/pubs/SRL2003-02.pdf">Capability Myths Demolished</a> <span class="cs1-format">(PDF)</span> (Report). Technical Report SRL2003-02. Systems Research Lab, Johns Hopkins University.</cite></span>

</li>

<li id="cite_note-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-3">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external autonumber" href="http://srl.cs.jhu.edu/pubs/SRL2003-03.pdf">[1]</a> citing: J.B. Dennis, E.C. Van Horn. “Programming Semantics for Multiprogrammed Computations.” Communications of the ACM, 9(3):143–155, March 1966.</span>

</li>

<li id="cite_note-chorus-one-4"><span class="mw-cite-backlink">^ <a href="#cite_ref-chorus-one_4-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-chorus-one_4-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><cite id="CITEREFLutsch2019" class="citation web cs1">Lutsch, Felix (26 August 2019). <a rel="nofollow" class="external text" href="https://blog.chorus.one/agoric-qa-transcript/">"Agoric Q&A with Dean Tribble"</a>. <i>Chorus One</i>.</cite></span>

</li>

<cite id="CITEREFLieberman1981" class="citation report cs1">Lieberman, Henry (June 1981). A Preview of Act 1 (MIT AI memo 625) (Report). MIT.</cite></span>

</li>

<cite id="CITEREFLieberman1981" class="citation report cs1">Lieberman, Henry (June 1981). Thinking About Lots of Things at Once without Getting Confused: Parallelism in Act 1 (MIT AI memo 626) (Report). MIT.</cite></span>

</li>

</ol></div></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hlist dl,.mw-parser-output .hlist ol,.mw-parser-output .hlist ul{margin:0;padding:0}.mw-parser-output .hlist dd,.mw-parser-output .hlist dt,.mw-parser-output .hlist li{margin:0;display:inline}.mw-parser-output .hlist.inline,.mw-parser-output .hlist.inline dl,.mw-parser-output .hlist.inline ol,.mw-parser-output .hlist.inline ul,.mw-parser-output .hlist dl dl,.mw-parser-output .hlist dl ol,.mw-parser-output .hlist dl ul,.mw-parser-output .hlist ol dl,.mw-parser-output .hlist ol ol,.mw-parser-output .hlist ol ul,.mw-parser-output .hlist ul dl,.mw-parser-output .hlist ul ol,.mw-parser-output .hlist ul ul{display:inline}.mw-parser-output .hlist .mw-empty-li{display:none}.mw-parser-output .hlist dt::after{content:": "}.mw-parser-output .hlist dd::after,.mw-parser-output .hlist li::after{content:" · ";font-weight:bold}.mw-parser-output .hlist dd:last-child::after,.mw-parser-output .hlist dt:last-child::after,.mw-parser-output .hlist li:last-child::after{content:none}.mw-parser-output .hlist dd dd:first-child::before,.mw-parser-output .hlist dd dt:first-child::before,.mw-parser-output .hlist dd li:first-child::before,.mw-parser-output .hlist dt dd:first-child::before,.mw-parser-output .hlist dt dt:first-child::before,.mw-parser-output .hlist dt li:first-child::before,.mw-parser-output .hlist li dd:first-child::before,.mw-parser-output .hlist li dt:first-child::before,.mw-parser-output .hlist li li:first-child::before{content:" (";font-weight:normal}.mw-parser-output .hlist dd dd:last-child::after,.mw-parser-output .hlist dd dt:last-child::after,.mw-parser-output .hlist dd li:last-child::after,.mw-parser-output .hlist dt dd:last-child::after,.mw-parser-output .hlist dt dt:last-child::after,.mw-parser-output .hlist dt li:last-child::after,.mw-parser-output .hlist li dd:last-child::after,.mw-parser-output .hlist li dt:last-child::after,.mw-parser-output .hlist li li:last-child::after{content:")";font-weight:normal}.mw-parser-output .hlist ol{counter-reset:listitem}.mw-parser-output .hlist ol>li{counter-increment:listitem}.mw-parser-output .hlist ol>li::before{content:" "counter(listitem)"\a0 "}.mw-parser-output .hlist dd ol>li:first-child::before,.mw-parser-output .hlist dt ol>li:first-child::before,.mw-parser-output .hlist li ol>li:first-child::before{content:" ("counter(listitem)"\a0 "}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1236075235">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbox{box-sizing:border-box;border:1px solid #a2a9b1;width:100%;clear:both;font-size:88%;text-align:center;padding:1px;margin:1em auto 0}.mw-parser-output .navbox .navbox{margin-top:0}.mw-parser-output .navbox+.navbox,.mw-parser-output .navbox+.navbox-styles+.navbox{margin-top:-1px}.mw-parser-output .navbox-inner,.mw-parser-output .navbox-subgroup{width:100%}.mw-parser-output .navbox-group,.mw-parser-output .navbox-title,.mw-parser-output .navbox-abovebelow{padding:0.25em 1em;line-height:1.5em;text-align:center}.mw-parser-output .navbox-group{white-space:nowrap;text-align:right}.mw-parser-output .navbox,.mw-parser-output .navbox-subgroup{background-color:#fdfdfd}.mw-parser-output .navbox-list{line-height:1.5em;border-color:#fdfdfd}.mw-parser-output .navbox-list-with-group{text-align:left;border-left-width:2px;border-left-style:solid}.mw-parser-output tr+tr>.navbox-abovebelow,.mw-parser-output tr+tr>.navbox-group,.mw-parser-output tr+tr>.navbox-image,.mw-parser-output tr+tr>.navbox-list{border-top:2px solid #fdfdfd}.mw-parser-output .navbox-title{background-color:#ccf}.mw-parser-output .navbox-abovebelow,.mw-parser-output .navbox-group,.mw-parser-output .navbox-subgroup .navbox-title{background-color:#ddf}.mw-parser-output .navbox-subgroup .navbox-group,.mw-parser-output .navbox-subgroup .navbox-abovebelow{background-color:#e6e6ff}.mw-parser-output .navbox-even{background-color:#f7f7f7}.mw-parser-output .navbox-odd{background-color:transparent}.mw-parser-output .navbox .hlist td dl,.mw-parser-output .navbox .hlist td ol,.mw-parser-output .navbox .hlist td ul,.mw-parser-output .navbox td.hlist dl,.mw-parser-output .navbox td.hlist ol,.mw-parser-output .navbox td.hlist ul{padding:0.125em 0}.mw-parser-output .navbox .navbar{display:block;font-size:100%}.mw-parser-output .navbox-title .navbar{float:left;text-align:left;margin-right:0.5em}body.skin--responsive .mw-parser-output .navbox-image img{max-width:none!important}@media print{body.ns-0 .mw-parser-output .navbox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style></div><div role="navigation" class="navbox" aria-labelledby="Object-capability_security187" style="padding:3px"><table class="nowraplinks mw-collapsible autocollapse navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><th scope="col" class="navbox-title" colspan="2"><style data-mw-deduplicate="TemplateStyles:r1239400231">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbar{display:inline;font-size:88%;font-weight:normal}.mw-parser-output .navbar-collapse{float:left;text-align:left}.mw-parser-output .navbar-boxtext{word-spacing:0}.mw-parser-output .navbar ul{display:inline-block;white-space:nowrap;line-height:inherit}.mw-parser-output .navbar-brackets::before{margin-right:-0.125em;content:"[ "}.mw-parser-output .navbar-brackets::after{margin-left:-0.125em;content:" ]"}.mw-parser-output .navbar li{word-spacing:-0.125em}.mw-parser-output .navbar a>span,.mw-parser-output .navbar a>abbr{text-decoration:inherit}.mw-parser-output .navbar-mini abbr{font-variant:small-caps;border-bottom:none;text-decoration:none;cursor:inherit}.mw-parser-output .navbar-ct-full{font-size:114%;margin:0 7em}.mw-parser-output .navbar-ct-mini{font-size:114%;margin:0 4em}html.skin-theme-clientpref-night .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}}@media print{.mw-parser-output .navbar{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div id="Object-capability_security187" style="font-size:114%;margin:0 4em"> security</div></th></tr><tr><th scope="row" class="navbox-group" style="width:1%">Concepts</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Principle_of_least_privilege" title="Principle of least privilege">Principle of least privilege</a> (PoLP)</li>

<li><a href="Confused_deputy_problem" title="Confused deputy problem">Confused deputy problem</a></li>

<li><a href="Ambient_authority" title="Ambient authority">Ambient authority</a></li>

<li><a href="File_descriptor" title="File descriptor">File descriptor</a></li>

<li><a href="Capability-based_security" title="Capability-based security">Capability-based security</a></li>

<li><a href="Capability-based_addressing" title="Capability-based addressing">Capability-based addressing</a></li>

<li><a href="Zooko's_triangle" title="Zooko's triangle">Zooko's triangle</a></li>

<li><a href="Petname" title="Petname">Petnames</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Operating_system" title="Operating system">Operating systems</a>,<br><a href="Kernel_(operating_system)" title="Kernel (operating system)">kernels</a></th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Capsicum_(Unix)" title="Capsicum (Unix)">Capsicum</a></li>

<li><a href="Fuchsia_(operating_system)" title="Fuchsia (operating system)">Fuchsia</a></li>

<li><a href="Genode" title="Genode">Genode</a></li>

<li><a href="GNOSIS" title="GNOSIS">GNOSIS</a> → <a href="KeyKOS" title="KeyKOS">KeyKOS</a> → <a href="EROS_(microkernel)" title="EROS (microkernel)">EROS</a> → CapROS</li>

<li><a href="Hydra_(operating_system)" title="Hydra (operating system)">Hydra</a></li>

<li><a href="Midori_(operating_system)" title="Midori (operating system)">Midori</a></li>

<li><a href="NLTSS" title="NLTSS">NLTSS</a></li>

<li><a href="HarmonyOS" title="HarmonyOS">HarmonyOS</a> (<a href="HarmonyOS_NEXT" title="HarmonyOS NEXT">HarmonyOS NEXT</a>)</li>

<li><a href="Phantom_OS" title="Phantom OS">Phantom OS</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Programming_language" title="Programming language">Programming languages</a></th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Caja_project" title="Caja project">Caja–Cajita</a></li>

<li><a href="Joule_(programming_language)" title="Joule (programming language)">Joule</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="File_system" title="File system">File systems</a></th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Tahoe-LAFS" title="Tahoe-LAFS">Tahoe-LAFS</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Specialised hardware</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<li><a href="CAP_computer" title="CAP computer">Cambridge CAP</a></li>

<li><a href="IBM_System/38" title="IBM System/38">IBM System/38</a></li>

<li><a href="Intel_iAPX_432" title="Intel iAPX 432">Intel iAPX 432</a></li>

<li><a href="Plessey_System_250" title="Plessey System 250">Plessey System 250</a></li>

<li><a href="Capability_Hardware_Enhanced_RISC_Instructions" title="Capability Hardware Enhanced RISC Instructions">CHERI</a></li></ul>

</div></td></tr></tbody></table></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-06-12" href="https://en.wikipedia.org/wiki/?title=Object-capability_model&oldid=1295221088">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>