Although I understand the principles on which both ACLs and Capabilities operate, I do not see why on system restart it would be favourable to store privileges by using ACLs, instead of capabilities lists as it is suggested in the Operating systems course I am taking. In other words, why do ACLs have better persistence than capabilities?
1
-
$\begingroup$ Note that both capabilities and acls are stored in xattrs $\endgroup$– o11cApr 6, 2016 at 23:41
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
There's a lot of confusion and regrettable writing out there surrounding the comparison between ACLs and capabilities. Often, when books make a comparison, they are referring to one particular type of ACL system vs one particular type of capability system, but the difference isn't always fundamental. So, if you see some comparison like this, I wouldn't worry about it too much.
In particular, capabilities can certainly have equal persistence to ACLs. As an extreme example: If you have a persistent store and all applications are persistent (so that when the machine reboots, all applications are relaunched with the same state as before the crash), then capabilities will be persistent. You can achieve the same level of persistence. Historically, people who have built capability systems in the past might not have built them that way (usually), but that isn't always a guide to what is or isn't fundamental.
So, I would take issue with the book's claim that ACLs have better persistence than capabilities. That's not necessarily true; it'll depend on specifically how the ACLs and capabilities are implemented by the system and used by applications.
(Also note that so-called "POSIX capabilities" are a bit of a misnomer and it's not clear we should really call them capabilities.)
I do realize that this might or might not help you if you're taking a course, as depending on the instructor, the instructor might expect you to go by what the book says and might not appreciate other perspectives (or, more benignly, want you to understand things from the textbook's perspective before taking a broader view).
-
$\begingroup$ Thanks! Our lecturer's argument was that ACLs are easily recovered when the system is restarted as they are stored in files while capabilities need to be reissued. (Which I don't really understand why) $\endgroup$ Apr 7, 2016 at 0:52
-
1$\begingroup$ @EugeniaKim, well, you're quite right. Just as you could save a ACL persistently, you could save a capability persistently. Now, in many systems, the reason why saving a capability persistently is tricky is because it may refer to a specific process (e.g., it is the capability to send messages to that process), and having a persistent identity for processes is challenging (the pid won't be meaningful after reboot, in a conventional system). That might be what the lecturer was thinking of. If so, it's a completely valid point -- but not inherently insurmountable. $\endgroup$– D.W. ♦Apr 7, 2016 at 1:26
-
$\begingroup$ @EugeniaKim ACLs apply to principals and capabilities refer to objects; apparently it's easier to serialize references to principals than to objects for some reason. Perhaps because the way we've designed our systems is that users are principals and they're created through manual intervention. A system with processes as principals would have the same difficulty for either! $\endgroup$ Nov 3, 2022 at 18:35