Re:Capability Myths Demolished (2003)
by throwaway_pdp09 on Thursday April 02, 2020 @07:29AM
(#22757939)
You are right - see my note [0] but I missed the bleedin obvious. Thanks for pointing it out.
In that case the hardware is effectively broken and all that's left is attempted software mitigation. Which may/may not work, but surely will cost performance. And extra complexity. And consequential possible bugs.
From memory a key can be represented as a random 64-bit integer taken from a sparse set. IOW you'd have bugger all chance of guessing another currently used 64-bit int, and if you tried and guessed wrong the OS, which would keep a list of caps allocated to each process) would say when you tried to use it "and where exactly did this come from, eh?" and kill you. But that's from memory and guesswork.
HTH and don't trust what I say too much!
But in a capability-based OS, privilege is all about the keys you hold, no? So assuming a malicious process can copy keys from other processes, can the OS detect and prevent the malicious process from using the key?
I tried reading up on KeyKOS[1] and there was very little info on what exactly a key is and how it is verified by the OS, at least that I could see.
[1]: http://cap-lore.com/CapTheory/KK/Arch/