1
$\begingroup$

The wikipedia page on capability-based security states:

Capability-based security is to be contrasted with an approach that uses hierarchical protection domains.

However, in order to implement capability-based security, we still need a kernel that ensures that user processes are only able to use the capabilities they have been assigned. Hence we still need a distinction between kernel mode and user mode, which is exactly what hierarchical protection domains are. In fact, as far as I know, most OS'es use only 2 hierarchical protection domains (user and kernel) in practice (I think Windows 10 has domains 0,1,2,3, but that 2 and 3 are only rarely used).

So it seems to me that kernels that implement capability-based security do not make less use of hierarchical protection domains than other operating systems.

Isn't it more accurate therefore to say that capability-based security is one way of using hierarchical protection domains to achieve security? (rather than fundamentally different from hierarchical protection domains)

Improve this question
$\endgroup$

1 Answer 1

Reset to default
0
$\begingroup$

No. I don't think that would be a good summary, as it doesn't get to the heart of what I consider important about capability-based systems. Your rephrasing is putting a focus on how the restrictions are enforced, but that is not the interesting part of capability-based models; the more interesting part is how we express our security goals as capabilities, and what advantages and disadvantages such an approach has.

First off, understand that the notion of capability-based security is not a precisely well-defined concept; it's a broad phrase that could cover multiple possible meanings. Different people use that phrase to mean different things. So take everything here with a grain of salt.

I suggest that the best way to understand the phrase "capability-based security" is "a security architecture that relies heavily on capabilities". So, then you need to understand what capabilities are, and why they might be useful.

If you keep reading that Wikipedia article, it contains some explanation of what capabilities are and some ways that they might be useful.

If you want to dive into the details of one particular view on capabilities, I recommend looking at https://en.wikipedia.org/wiki/Object-capability_model and Mark Miller's PhD thesis. I think you'll find that to have a coherent, principled, and focused view. It's not necessarily what everyone means when they use the word "capability", but it's one take on the subject that is internally consistent and interesting.

Improve this answer
$\endgroup$
2
  • $\begingroup$ I didn't mean to summarize what capability-based security is, I meant to state the relation between capability-based security and hierarchical protection domains. The wikipedia article puts them on the same footing, as alternative strategies for security, and I'm asking whether that's really correct $\endgroup$
    – user56834
    Dec 31, 2019 at 4:38
  • $\begingroup$ @user56834, I don't like that way of viewing it, personally, as I think it doesn't capture what I find to be the most interesting aspects of capability-based security. But again, different people mean different things by capability-based security, so you're not going to find one right answer to that question. Instead, I suggest you study about some capability-based systems and how they work and see what you can learn from them, and then form your own opinion about the best way to think about them. $\endgroup$
    – D.W. ♦
    Dec 31, 2019 at 5:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.