Re: [9front] git: use new /dev/drivers for privdrop

[Jacob Moody <moody@mail.posixcafe.org>]

On 5/28/22 18:23, Frank D. Engel, Jr. wrote:
> 
> People trying the OS through the type of sandbox test system being 
> proposed wouldn't really be able to do anything to test the system if 
> they cannot create new processes, but allowing that to go on unchecked 
> (without limits) could impact other users.
> 
> I tend to agree that if this is a use case to be considered, a quota of 
> some kind would be in order.

I dont think this use case is worth perusing. The concept of what constitutes
misuse of a resource is vague and dependent on hardware. Like I mentioned,
I think trying to make the promise that a process with access to a resource
won't misuse it is error prone.


> 
> This would also eliminate the need for the somewhat questionable idea of 
> using a "fake" device to serve as a process security mechanism for the 
> fork call, as one could simply set a quota of zero.
> 
> 

We are in plan9, a very large chunk of a processes capabilities are accomplished
through access to files. We have a system for mutating a processes view of
files through namespaces.
Devip is also a "fake" device, yet access to that
is tied to the processes ability to talk on the network. It seems consistent
with the theme of the system to describe capabilities as the set of files
a process has access to. If anything the fact that the fork call is a capability
that is not influenced by the namespace makes it the odd one out.


Thanks,
moody