A capability is a communicable, unforgeable token of authority. It refers to a value that references an object along with an associated set of access rights. A user program on a capability-based operating system must use a capability to access an object.
| Wiki Markup |
|---|
The term _capability_ was introduced by Dennis and Van Horn \[[Dennis 1966|AA. References#Dennis 1966]\]. The basic idea is that for a program to access an object, it must have a special token. This token designates an object and gives the program the authority to perform a specific set of actions (such as reading or writing) on that object. Such a token is known as a capability. |
...
| Wiki Markup |
|---|
Authority is embodied by object references, which serve as capabilities. _Authority_ refers to any effects that running code can have other than to perform side-effect-free computations. Authority includes effects not only effects on external resources such as files orand network sockets, but also on mutable data structures that are shared with other parts of the program \[[Mettler 2010B|AA. References#Mettler 2010B]\]. |
References to objects whose methods can perform sensitive operations can serve as capabilities that enable the holder to perform those operations (or to request that the object perform those operations on behalf of the holder). Consequently, such references must themselves be treated as sensitive data , and must not be leaked to untrusted code.
| Wiki Markup |
|---|
One surprising source of leaked capabilities and leaked data is inner classes, which have access to all the fields of their enclosing class. Java bytecodes lack built-in support for inner classes; consequently, inner classes are compiled into ordinary classes with stylized names, such as {{OuterClass$InnerClass}}. Because inner classes must be able to access the private fields of their enclosing class, the access control for those fields is changed to package access in the bytecode. Consequently, handcrafted bytecode can access these nominally private fields (see âSecurity Aspects in Java Bytecode Engineeringâ \[[Schoenefeld 04|AA. References#Schoenefeld 04]\] for an example). |
...