Insight gained from reading a paper titled "ACLs don't" that is really obvious in retrospect:
the confused deputy problem happens exactly because authority-based systems care about the authority of whoever directly performs an operation, and that intuition/model breaks when there's a *delegation*, i.e. with deputies.
It would be possible to deal with simple delegation, but it won't work when there are multiple levels of it or when there are complex delegation graphs.
This is beautiful and I've never thought about this before:
the convention we have in Unix to pass pre-opened stdin/stdout/stderr fds is not just a nice way to tell the program where to read its input from and output its result/logs to; it is exactly how capability passing should work in a capability-based system. This also is another reason why accepting an -o option (for "output file") is a bad idea.
Also, this is how socket activation works. systemd (or launchd, or inetd, or what have you) listens on a port or a Unix socket — because, being root, it has rights to. Then it passes a capability — either the bound socket fd, or an individual connection fd — when starting your service. Your service then doesn't have to be privileged, because it doesn't need to be able to open/bind the port/socket.
@bugaevc Got a link?
@bugaevc there was a problem with your link: http://waterken.sourceforge.net/aclsdont/current.pdf worked
chaos.social - because anarchy is much more fun with friends.
chaos.social is a small Mastodon instance for and by the Chaos community surrounding the Chaos Computer Club. We provide a small community space - Be excellent to each other, and have a look at what that means around here.
Follow @ordnung for low-traffic instance-related updates.
The primary instance languages are German and English.