Re:A Kernel Hacker Meets Fuchsia OS
by throwaway894345 on Thursday May 26, 2022 @10:31AM
(#31518772)
Semantics aside, is it accurate to say that schemes where the capability is represented as a signed token require care and diligence to mitigate leaks, and schemes where the capability is represented as a table entry (mapping a user/process to a permission) don't require any meaningful care/diligence?
[ Parent
| on HN ]
Yes, that's the idea.
Though, it is still worth thinking about how someone might accidentally leak a table-based capability via API misuse. For example, if table entries are reused over time you might get a sort of use-after-free situation where you mean to share an old capability but accidentally share the new one that replaced it.