[cap-talk] More Heresey: ACLs not inherently bad

[David-Sarah Hopwood]

Karp, Alan H wrote:
> David Wagner wrote:
>> So my hypothesis is that the more seriously you take the principle
>> of least privilege(authority), the more you have to be careful about
>> confused deputy bugs.
> 
> I'm not so sure.  The compiler service necessarily needs the authority
> to read and write every file the invoker might specify as parameters.

No, if the parameters are capabilities then each instance of the compiler
only needs the authority passed by its actual parameters.

-- 
David-Sarah Hopwood