Everything about Capability Computers totally explained
Capability-based security is a concept in the design of
secure computing systems. A
capability (known in some systems as a
key) is a communicable, unforgeable token of authority. It refers to a value that
references an
object along with an associated set of
access rights. A
user program on a capability-based
operating system must use a capability to access an object. Capability-based security refers to the principle of designing user programs such that they directly share capabilities with each other according to the
principle of least privilege, and to the operating system infrastructure necessary to make such transactions efficient and secure.
Although most operating systems implement a facility which resembles capabilities, they typically don't provide enough support to allow for the exchange of capabilities among possibly mutually untrusting entities to be the primary means of granting and distributing access rights throughout the system. A capability-based system, in contrast, is designed with that goal in mind.
Capabilities as discussed on this page shouldn't be confused with POSIX 1e/2c "Capabilities". The latter are coarse-grained privileges that can't be transferred between processes.
Capabilities and capability-based security
Capabilities achieve their objective of improving system security by being used in place of forgeable
references. A forgeable reference (for example, a
path name) identifies an object, but doesn't specify which access rights are appropriate for that object and the user program which holds that reference. Consequently, any attempt to access the referenced object must be validated by the operating system, typically via the use of an
access control list (ACL). Instead, in a system with capabilities, the mere fact that a user program possesses that capability entitles it to use the referenced object in accordance with the rights that are specified by that capability. In theory, a system with capabilities removes the need for any access control list or similar mechanism by giving all entities all and only the capabilities that'll actually need.
A capability is typically implemented as a
privileged data structure that consists of a section that specifies access rights, and a section that uniquely identifies the object to be accessed. In practice, it's used much like a
file descriptor in a traditional operating system, but to access every object on the system. Capabilities are typically stored by the operating system in a list, with some mechanism in place to prevent the program from directly modifying the contents of the capability (so as to forge access rights or change the object it points to). Some systems have also been based on
capability-based addressing (hardware support for capabilities), such as
Plessey System 250.
Programs possessing capabilities can perform functions on them, such as passing them on to other programs, converting them to a less-privileged version, or deleting them. The operating system must ensure that only specific operations can occur to the capabilities in the system, in order to maintain the integrity of the security policy.
Introduction to capability-based security
(The following introduction assumes some basic knowledge of Unix systems.)
A
capability is defined to be a protected
object reference which, by virtue of its possession by a user process, grants that process the capability (hence the name) to interact with an object in certain ways. Those ways might include reading data associated with an object, modifying the object, executing the data in the object as a process, and other conceivable access rights. The capability logically consists of a reference that uniquely identifies a particular object and a set of one or more of these rights.
Suppose that, in a user process's memory space, there exists the following string:
/etc/passwd
Although this identifies a unique object on the system, it doesn't specify access rights and hence isn't a capability. Suppose there's instead the following two values:
/etc/passwd
O_RDWR
This identifies an object along with a set of access rights. It, however, is still not a capability because the user process's
possession of these values says nothing about whether that access would actually be legitimate.
Now suppose that the user program successfully executes the following statement:
int fd = open("/etc/passwd", O_RDWR);
The variable
fd now contains the index of a file descriptor in the process's file descriptor table. This file descriptor
is a capability. Its existence in the process's file descriptor table is sufficient to know that the process does indeed have legitimate access to the object. A key feature of this arrangement is that the file descriptor table is in
kernel memory and can't be directly manipulated by the user program.
Sharing of capabilities between processes
In traditional operating systems, programs often communicate with each other and with storage using references like those in the first two examples. Path names are often passed as command-line parameters, sent via sockets, and stored on disk. These references are not capabilities, and must be validated before they can be used. In these systems, a central question is "on whose
authority is a given reference to be evaluated?" This becomes a critical issue especially for processes which must act on behalf of two different authority-bearing entities. They become susceptible to a programming error known as the
Confused deputy problem, very frequently resulting in a
security hole.
In a capability-based system, the capabilities themselves are passed between processes and storage using a mechanism that's known by the operating system to maintain the integrity of those capabilities.
Although many operating systems implement facilities very similar to capabilities through the use of
file descriptors or
file handles — for example, in
UNIX, file descriptors can be discarded (closed), inherited by child processes, and even sent to other processes via
sockets — there are several obstacles that prevent all of the benefits of a
capability-based addressing system from being realized in a traditional operating system environment. Chief among these obstacles is the fact that entities which might hold capabilities (such as
processes and
files) can't be made
persistent in such a way that maintains the integrity of the secure information that a capability represents. The operating system can't trust a user program to read back a capability and not tamper with the object reference or the access rights. Consequently, when a program wishes to regain access to an object that's referenced on disk, the operating system must have some way of validating that access request, and an access control list or similar mechanism is mandated.
One novel approach to solving this problem involves the use of an
orthogonally persistent operating system. (This was realised in the Flex machine. See
Ten15). In such a system, there's no need for entities to be discarded and their capabilities be invalidated, and hence require an ACL-like mechanism to restore those capabilities at a later time. The operating system maintains the integrity and security of the capabilities contained within all storage, both volatile and nonvolatile, at all times; in part by performing all
serialization tasks by itself, rather than requiring user programs to do so, as is the case in most operating systems. Because user programs are relieved of this responsibility, there's no need to trust them to reproduce only legal capabilities, nor to validate requests for access using an
access control mechanism.
POSIX Capabilities
POSIX draft 1003.1e specifies concept of permissions called "capabilities". However POSIX capabilities differ from capabilities in this article - POSIX capability isn't associated to any object: Process having CAP_NET_BIND_SERVICE capability can listen on any TCP port under 1024.
Research and commercial systems
Further Information
Get more info on 'Capability Computers'.
|
External Link Exchanges
Do you know how hard it is to get a link from a large encyclopaedia? Well we're different and will prove it. To get a link from us just add the following HTML to your site on a relevant page:
<a href="http://capability-based_security.totallyexplained.com">Capability-based security Totally Explained</a>
Then simply click through this link from your web page. Our crawlers will verify your link, extract the title of your web page and instantly add a link back to it. If you like you can remove the words Totally Explained and embed the link in article text.
As long as your link remains in place, we'll keep our link to you right here. Please play fair - our crawlers are watching. Your site must be closely related to this one's topic. Any kind of spamming, dubious practises or removing the link will result in your link from us being dropped and, potentially, your whole site being banned. |
