Hi, I wish I knew Plan 9 and EROS better, so I could answer your question. I don't understand what Jonathan Shapiro is saying in the mail you refer to, so it's very hard to comment.
> 1. The *only* way that a process in plan-9 can obtain a capability is > from its parent. [...] > This differs very strongly from the status in EROS/Coyotos, where > *authentication* capabilities are not considered to be "holes" for > purposes of confinement. An implication of this is that the capability > which answers the question "Is this capability a capability to an > authentic X object" can be widely distributed, and can come to the user > in a way that the parent process cannot interfere with. So what would such a way be? The only way I see is by a kernel system call which performs right amplification, and grants the process the authority to authenticate capabilities. Maybe this is how it is done in EROS (I vaguely remember something like this, but the details escape me). > In the Hurd, processes get capabilities to the root filesystem, to > `auth' and friends from their parent process. Not quite right. They get their capabilities from the parent. There are some capabilities they can get from Mach: task-self, thread-self. But the others are inherited from the parent process. The "root directory port" is one such capability. > This is very convenient > because it allows to run processes in a "sandbox". OTOH, this makes it > impossible for a process to make sure it is talking to "authentic" > servers, as in the Plan 9 case above. Right. It is unclear to me though if this actually is a problem. If it is a problem or not seems to depend on other aspects of the system design. For example, in EROS, you have constructors, which seem to be a bit like "suid" applications in Unix. If you start a suid application, who is the parent task? In the Hurd, it is the filesystem providing the suid application, _not_ the user initiating the execution. The suid application receives an initial execution environment which is a mix of the filesystems and the initiators execution environment. So, beside the other doubts I have expressed above, I also have some doubts about how the word "parent" is used here. > Now, what does "authentic" mean in a system designed in such a way that > most system services can be replaced by the user? Should programs be > allowed to rely on a specific implementation of a given service? I think you can get more insight if you try to focus on the word "parent" and try to figure out what the parent is in the Plan 9, EROS, and Hurd case. If you figure it out, let me know :) Thanks, Marcus _______________________________________________ L4-hurd mailing list [email protected] http://lists.gnu.org/mailman/listinfo/l4-hurd
