Re: The Perils of Pluggability (was: capability authentication)

[Jonathan S. Shapiro]

On Wed, 2005-10-12 at 00:25 -0700, Jun Inoue wrote:

> Wouldn't "drop everything, pick up what you need" be more natural?
> If I understood it correctly, processes in general can be and are
> created with an initial set of capabilities supplied by the parent (and
> nothing else). Then in the "confined plugin" case, the plugin process
> can be started with none of the parent's capability.  Except the parent
> gives to the child, as the initial set of caps, what the parent thinks
> the child needs.

Yes. In EROS, when a constructor is run to create a new process, there
are no capabilities inherited by default -- this isn't a fork()
operation. The only capabilities that go to the new process are:

  1. Those provided by the "parent" through RPCs
  2. Those provided by the constructor.

shap