What is difference between capabilities list and access list?

Answer 1

1. Access Control Lists

An ACL system has at least five namespaces whose relationships need to be considered:

1. The namespace of file names: /tmp/foo

2. The namespace of unique object identifiers: (dev 22, inode 36, type file)

3. The namespace of user identities (uid 52476)

4. For each object type (file, disk, terminal, ...), the namespace of operations that object can perform.

5. The namespace of process identifiers (process 719)

In an access list system, it is assumed that there are two global mappings:

principal: process identity -> user identity
fs_lookup: file name -> object identity

That is, every process has an assigned user identity and every file name can be translated into a unique object identifier. Hanging off of every unique object is a further mapping:

acl: (object identity, user identity) -> operation(s)

Given a process proc that wishes to perform an operation op on an object object, the protection mechanism in an access list system is to test the following predicate:

op in acl(object, principal(p))

In the special case of the "open" call, this test is modified to be:

op in acl(fs_lookup(filename), principal(p))

2. Capability Systems

A capability system has at least four namespaces whose relationships need to be considered:

1. The namespace of unique object identifiers: (dev 22, inode 36, type file)

2. For each object type (file, disk, terminal, ...), the namespace of operations that object can perform.

3. The namespace of process identifiers (process 719)

4. The namespace of capabilities (object 10, operation set S)

In a capability system, it is assumed that there is one local mapping for each process

cap: (process identity, index) -> capability

That is, every process has a list of capabilities. Each capability names an object and also names a set of legal operations on that object.

There are also two "accessor" functions:

obj: capability -> object identity
ops: capability -> operations

Given a process proc that wishes to perform an operation op on an object object, the process must first possess a capability naming that object. That is, it must possess a capability at some index i such that

object == obj(caps(p,i))

To perform an operation, the process names the "index" iof that capability to be invoked from the per-process list. The protection mechanism in a capability system is to test the following predicate:

op in ops(caps(p,i))

Capability systems typically do not have a distinguished "open" call.

3. Some Differences

This section is incomplete.

Simply comparing the predicates shows that there is a significant difference between the two systems:

ACL: op in acl(object, principal(p)) Capability: op in ops(caps(p,i))

An obvious difference is that the capability model makes no reference to any notion of "principal".

Another obvious difference is that the capability model has a parameter "i". This allows the process to specify whichauthority it wants to exercise, which is why only the capability model can solve the confused deputy problem.