cleanup: remove comment block in capabilities.h
This commit is contained in:
1 parent
fd397ac41d
commit
638dd9ee06
1 file changed
-20
@@ -10,26 +10,6 @@
|
||||
#include <montauk/config.h>
|
||||
#include <montauk/heap.h>
|
||||
|
||||
/*
|
||||
* Launchers (init, the desktop, the shell) look up the authority a program
|
||||
* should receive here instead of each carrying its own compiled-in table.
|
||||
*
|
||||
* This file is advisory, never authoritative. Every grant still goes
|
||||
* through SYS_SPAWN_CAPS and is validated in the kernel against the
|
||||
* caller's own delegable set, so nothing written here can produce authority
|
||||
* the kernel has not already delegated to the launcher. A missing,
|
||||
* truncated or hostile file can only ever result in a program receiving
|
||||
* less authority than intended. That is why the table can live in
|
||||
* userspace TOML: the kernel enumerates protected paths, userspace
|
||||
* interprets policy.
|
||||
*
|
||||
* Grants are keyed on the resolved binary path, which is what makes the
|
||||
* table safe to hand to init: pointing a privileged service entry at a
|
||||
* different executable looks up the new path, finds no entry, and grants
|
||||
* nothing. The kernel write-protects 0:/apps and 0:/os so the path cannot
|
||||
* be made to refer to a substituted image.
|
||||
*/
|
||||
|
||||
namespace montauk {
|
||||
namespace caps {
|
||||
|
||||
|
||||
Reference in new issue
Block a user