Linux, IRIX and “Posix Capabilities” (1999) • Hacker News Board

Re: Linux, IRIX and “Posix Capabilities” (1999)

#11

Post by anon4 » Mon, Jun 29, 2015, 11:37 AM UTC

lmz wrote: post #5

cturner wrote: post #4

Unix permissions become increasingly complicated while usage moves in the other direction. Complex permissions were a must-have in the era of time-shared systems. You'll find some slow-moving multinationals that still have people shelled into production unix boxes, and where they have thick policy manuals around who is allowed to become what kind of user. But it's on the way out. Two use-cases dominate now: unix serv…

What about mobile devices with partially trusted (or even untrusted) apps?

Android does it by giving each application a different user and then granting that user certain privileges.

Re: Linux, IRIX and “Posix Capabilities” (1999)

#12

Post by jtanworth » Mon, Jun 29, 2015, 11:47 AM UTC

"They are planning to sell Intel-based machines running Linux, with the SGI logo stamped on the box. They weren't very clear about the migration path they expect IRIX software to take, but they do seem to be very enthusiastic about Linux in general."

They chose Itanium as the new platform, and used the same technology as Apple did for Rosetta to smooth the transition between instruction sets (and in SGI's case, operating systems too).

http://www.itjungle.com/tug/tug080405-story02.html

Re: Linux, IRIX and “Posix Capabilities” (1999)

#13

Post by justincormack » Mon, Jun 29, 2015, 11:58 AM UTC

tenfingers wrote: post #10

justincormack wrote: post #9

Earlier quoted context omitted.

They are a limited model. Namespaces do allow you to pass access tokens between processes, but these are limited as mostly you can only be in one namespace at a time, so they are not usefully compositional. You can never be in more than one cgroup of the same type, and you cannot pass your capabilties on. Capsicum is a real capabilities system, as is being discussed in the article, where capabilities are attached to…

Wouldn't capsicum then allow to effectively implement different user models than root/user? Where the login process would be responsible to just drop capabilities after switching the uid?

Potentially, although it might need quite a lot of infrastructure to make that work usefully I think, as most of the design in Capsicum has been around reducing capabilities for a single group of programs for security, not a whole system. You can do much of that with Linux capabilities now - see man (7) capabilities and the section "The securebits flags: establishing a capabilities-only environment" which says how to disable suid so root is effectively removed.

Re: Linux, IRIX and “Posix Capabilities” (1999)

#14

Post by vhffm » Mon, Jun 29, 2015, 1:20 PM UTC

cturner wrote: post #4

Unix permissions become increasingly complicated while usage moves in the other direction. Complex permissions were a must-have in the era of time-shared systems. You'll find some slow-moving multinationals that still have people shelled into production unix boxes, and where they have thick policy manuals around who is allowed to become what kind of user. But it's on the way out. Two use-cases dominate now: unix serv…

I'd like to point out that large-memory/many-core multi-user machines are very much alive in Computational Science (Computational Physics, Computational Chemistry, etc). Usually as test-beds (before deploying on clusters), visualisation system, or simply front-end nodes for clusters.