[cap-talk] Capabilities for immutable data

[Rob Meijer]

On Wed, February 23, 2011 00:08, David Wagner wrote:
> Sandro Magi  wrote:
>> Consider a trusted program that executes an untrusted sub-program by
>> providing it with a file handle. With the deferred I/O implementation
>> and your definitions, we would conclude that the trusted program caused
>> invalid data to be written to the file, since the untrusted program did
>> not wield any capabilities.
>
> I didn't follow the example.
>
> Do you mean a program written in an object capability language, like
> Joe-E?  When you say file handle, do you mean, e.g., a reference to a
> File object?  If yes, then a File reference is indeed a capability.
>
> If by file handle, you mean a small integer, then how does the
> untrusted sub-program cause I/O to happen?  In an object capability
> system, an integer does not provide authority to cause I/O; the
> untrusted code has to have some other source of authority (e.g.,
> a capability which the untrusted code passes the integer to).


A file handle is a handle. It can be passed to other processes as an act
of delegation. It holds the permission to use the file in a way determined
by the process that created it. Its a capability. Its an object
capability. Dont confuse the fact that the handle within a process is has
an integer representing it with the file handle being the integer.