cleanup: remove comment block in capabilities.h
This commit is contained in:
1 parent
fd397ac41d
commit
638dd9ee06
1 file changed
-20
@@ -10,26 +10,6 @@
|
|||||||
#include <montauk/config.h>
|
#include <montauk/config.h>
|
||||||
#include <montauk/heap.h>
|
#include <montauk/heap.h>
|
||||||
|
|
||||||
/*
|
|
||||||
* Launchers (init, the desktop, the shell) look up the authority a program
|
|
||||||
* should receive here instead of each carrying its own compiled-in table.
|
|
||||||
*
|
|
||||||
* This file is advisory, never authoritative. Every grant still goes
|
|
||||||
* through SYS_SPAWN_CAPS and is validated in the kernel against the
|
|
||||||
* caller's own delegable set, so nothing written here can produce authority
|
|
||||||
* the kernel has not already delegated to the launcher. A missing,
|
|
||||||
* truncated or hostile file can only ever result in a program receiving
|
|
||||||
* less authority than intended. That is why the table can live in
|
|
||||||
* userspace TOML: the kernel enumerates protected paths, userspace
|
|
||||||
* interprets policy.
|
|
||||||
*
|
|
||||||
* Grants are keyed on the resolved binary path, which is what makes the
|
|
||||||
* table safe to hand to init: pointing a privileged service entry at a
|
|
||||||
* different executable looks up the new path, finds no entry, and grants
|
|
||||||
* nothing. The kernel write-protects 0:/apps and 0:/os so the path cannot
|
|
||||||
* be made to refer to a substituted image.
|
|
||||||
*/
|
|
||||||
|
|
||||||
namespace montauk {
|
namespace montauk {
|
||||||
namespace caps {
|
namespace caps {
|
||||||
|
|
||||||
|
|||||||
Reference in new issue
Block a user