The most common systems actually implement ACLs.
Operating systems have, in researches I have studied, C-lists as well and
we'll see there's some nice properties they offer.
So how would you implement C-lists?
So first of all, where would a C-list go?
Where would it be stored?
Remember, C-lists are per user.
C-lists we get from each row of the access control matrix, so
it's very user.
So the natural place for it is not going to be where we kept ACLs.
The other question one can ask is what exactly is a capability?
A capability, remember, says you are capable of accessing that resource.
You've been given permission to access that resource.
So typically a capability implementation details differ, but
is really a handle for a resource.
A reference allows you to find or locate the resource and be able to use it.
So if you can go use the resource,
you shouldn't be able to forge a capability for that resource.
Capabilities are sort of identifiers you can think of them or
references or handles.
But one property the system has to guarantee, is that these capabilities or
handle that we're talking about are unforgeable.
So think about the user has capabilities for a bunch of resources.
List of those capabilities is what defines a C-list for that given user.
The way where C-list is going to go,
we have to have a catalog for each user that we have in the system.
Similar to ACLs for each resource or object that we had before,
here we have to have a catalog of capabilities, and system has to
store the catalog of capabilities for each user that we have in the system.
The main capability systems that have been explored and
one of the interesting ones was a system called Hydra.
It was sort of a research project done at Carnegie Mellon.
This actually, you could have C-list stored in objects themselves.
So everything was an object.
It was an object based system.
And objects stored a C-list.
So when you came to a certain object, well you found new set of capabilities.
And you could then use those to access objects that you couldn't access before.
You can access this new objects while you are within this object.
And you could take capabilities back to the object it came from sometimes and
not other times, and things like that.
The basic idea is that capabilities are how you decide, or
the system makes the determination that you can access or not.
So you, the user has to start with a catalog and
as you execute maybe new capabilities come your way.
And that was this example we're talking about.
So one thing we didn't talk about is actually how does sharing happen.
The whole idea of who can access what, and giving access to somebody else or
the example or the quiz question we've been doing, is how does sharing happen?
With ACLs, we didn't talk about it.
But someone who has the right to let somebody else access a resource and
make a system column have this new user or this user that I'm specifying
should be able to read this file foo and what we're going to do is create
a new ACE for this user, if one doesn't already exist, and
going to add this new access right to that and then put that ACE in the ACL.
So the new user will be able to go and access this file in the future.
Capabilities, what do we have to do?
Sharing is going to requite propagation of capabilities.
The new user which should be able to access this resource In the future.
We have to provide this user with the capability for this resource.
So the capability has to be propagated.
But remember they shouldn't be able to forge it,
shouldn't be able to mint a capability unless it has been passed to them or
someone had chosen to share the resource with them.
With capabilities sharing is going to happen by propagation of capabilities.
I'm going to give you a capability, you're going to find a way for you to
gain access to a capability that you can then use to be able to use the resource.
Remember, the one difference here is that possession of a capability means
you can access the resource.
There is no access check required as was necessary with ACLs.