Ambient authority - Revision history

Markm: Correction suggested to me by Ben Laurie

Markm — Sun, 02 Jan 2011 23:43:08 GMT

Correction suggested to me by Ben Laurie

New page

The correct interpretation of this page relies on proper interpretation of words: [[subject, object, operation and permission]].

== Definition ==

IF a subject requests an action, typically by naming an object and an operation on that object, and the action is allowed because the subject has a permission that would allow the action, THEN we say that the subject has '''ambient authority'''.

== Notes concerning the definition ==

Instead of "naming" an object, capability community often uses the term "designation" of an object.

Whether we can say that some chosen subject has '''ambient authority''' or not is solely determined by the fact HOW are operations allowed or denied. It is independent from the fact WHAT PERMISSIONS a given subject actually has. This matters in case of a term [[excess authority]].

The difference between [[ambient authority system]] and the [[designated authority system]] is that:
* in the first case subjects, when they request some operation with some object, '''do not have to''' specify the permission that allows given operation with given object;
* in the latter case subject, when they request some operation with some object, '''have to''' specify the permission this request with designated the permission that allows given operation with given object.

== See also ==

* [[Excess authority]]
* [[Ambient authority system]]

== Examples of ambient authority ==

All UNIX processes run with some effective user id have ambient authority to manipulate all files accessible by that user id.

All UNIX processes have ''ambient authority'' to listen to TCP or UDP ports 1024--65535.

All UNIX processes have ''ambient authority'' to send any signal to any other UNIX process.

== Acknowledgement ==

The term ''ambient authority'' was coined by Dean Tribble and Mark S. Miller.

Kosik: /* Notes concerning the definition */

Kosik — Fri, 10 Jul 2009 09:23:27 GMT

Notes concerning the definition

←Older revision		Revision as of 09:23, 10 July 2009
Line 10:		Line 10:

	Whether we can say that some chosen subject has '''ambient authority''' or not is solely determined by the fact HOW are operations allowed or denied. It is independent from the fact WHAT PERMISSIONS a given subject actually has. This matters in case of a term [[excess authority]].		Whether we can say that some chosen subject has '''ambient authority''' or not is solely determined by the fact HOW are operations allowed or denied. It is independent from the fact WHAT PERMISSIONS a given subject actually has. This matters in case of a term [[excess authority]].
		+
		+	The difference between [[ambient authority system]] and the [[designated authority system]] is that:
		+	* in the first case subjects, when they request some operation with some object, '''do not have to''' specify the permission that allows given operation with given object;
		+	* in the latter case subject, when they request some operation with some object, '''have to''' specify the permission this request with designated the permission that allows given operation with given object.

	== See also ==		== See also ==

Kosik at 10:40, 19 June 2009

Kosik — Fri, 19 Jun 2009 10:40:41 GMT

←Older revision		Revision as of 10:40, 19 June 2009
Line 14:		Line 14:

	* [[Excess authority]]		* [[Excess authority]]
		+	* [[Ambient authority system]]

	== Examples of ambient authority ==		== Examples of ambient authority ==

Kosik: Section "Notes concerning the definition" was simplified (shortened). Explanation of related notions can be linked from a new "See also" section.

Kosik — Fri, 19 Jun 2009 07:09:49 GMT

Section "Notes concerning the definition" was simplified (shortened). Explanation of related notions can be linked from a new "See also" section.

←Older revision		Revision as of 07:09, 19 June 2009
Line 11:		Line 11:
	Whether we can say that some chosen subject has '''ambient authority''' or not is solely determined by the fact HOW are operations allowed or denied. It is independent from the fact WHAT PERMISSIONS a given subject actually has. This matters in case of a term [[excess authority]].		Whether we can say that some chosen subject has '''ambient authority''' or not is solely determined by the fact HOW are operations allowed or denied. It is independent from the fact WHAT PERMISSIONS a given subject actually has. This matters in case of a term [[excess authority]].

-	~~In contrast, in a designated authority system, a subject explicitly identifies a subset (usually one) of its permissions, and the action is allowed only if permitted by that subset of permissions.~~	+	== See also ==

-	~~In an ambient~~ authority system, a subject making a request does not specify which permission to use -- the subject does not identify which permission is claimed to justify allowing the request. Instead, the system looks through all of the subject's permissions and allows the request if any of the subject's permissions would justify allowing the request.	+	* [[Excess authority]]
-		+
-	In an ambient authority system, a subject may have many permissions, and there is often no way for the subject to single one of these out. As a result, in these systems, developers may not think of the subject as having multiple different permissions at once; instead, developers might just associate the union of all those permissions with the subject, and call them ''the'' permissions of the subject.	+

	== Examples of ambient authority ==		== Examples of ambient authority ==

Kosik: Section "Notes" was renamed to "Notes concerning the definition".

Kosik — Fri, 19 Jun 2009 07:00:15 GMT

Section "Notes" was renamed to "Notes concerning the definition".

←Older revision		Revision as of 07:00, 19 June 2009
Line 5:		Line 5:
	IF a subject requests an action, typically by naming an object and an operation on that object, and the action is allowed because the subject has a permission that would allow the action, THEN we say that the subject has '''ambient authority'''.		IF a subject requests an action, typically by naming an object and an operation on that object, and the action is allowed because the subject has a permission that would allow the action, THEN we say that the subject has '''ambient authority'''.

-	== Notes ==	+	== Notes concerning the definition ==

	Instead of "naming" an object, capability community often uses the term "designation" of an object.		Instead of "naming" an object, capability community often uses the term "designation" of an object.

Kosik: I've added one new (as I assume relevant) entry in the "Notes" section that further clarifies the notion of "ambient authority".

Kosik — Fri, 19 Jun 2009 06:53:55 GMT

I've added one new (as I assume relevant) entry in the "Notes" section that further clarifies the notion of "ambient authority".

←Older revision		Revision as of 06:53, 19 June 2009
Line 8:		Line 8:

	Instead of "naming" an object, capability community often uses the term "designation" of an object.		Instead of "naming" an object, capability community often uses the term "designation" of an object.
		+
		+	Whether we can say that some chosen subject has '''ambient authority''' or not is solely determined by the fact HOW are operations allowed or denied. It is independent from the fact WHAT PERMISSIONS a given subject actually has. This matters in case of a term [[excess authority]].

	In contrast, in a designated authority system, a subject explicitly identifies a subset (usually one) of its permissions, and the action is allowed only if permitted by that subset of permissions.		In contrast, in a designated authority system, a subject explicitly identifies a subset (usually one) of its permissions, and the action is allowed only if permitted by that subset of permissions.

Kosik: Moved quotation mark.

Kosik — Fri, 19 Jun 2009 06:09:53 GMT

Moved quotation mark.

←Older revision		Revision as of 06:09, 19 June 2009
Line 7:		Line 7:
	== Notes ==		== Notes ==

-	Instead of "naming" an object, capability community often uses the term "designation of an object".	+	Instead of "naming" an object, capability community often uses the term "designation" of an object.

	In contrast, in a designated authority system, a subject explicitly identifies a subset (usually one) of its permissions, and the action is allowed only if permitted by that subset of permissions.		In contrast, in a designated authority system, a subject explicitly identifies a subset (usually one) of its permissions, and the action is allowed only if permitted by that subset of permissions.

Kosik at 11:37, 16 June 2009

Kosik — Tue, 16 Jun 2009 11:37:21 GMT

←Older revision		Revision as of 11:37, 16 June 2009
Line 6:		Line 6:

	== Notes ==		== Notes ==
		+
		+	Instead of "naming" an object, capability community often uses the term "designation of an object".

	In contrast, in a designated authority system, a subject explicitly identifies a subset (usually one) of its permissions, and the action is allowed only if permitted by that subset of permissions.		In contrast, in a designated authority system, a subject explicitly identifies a subset (usually one) of its permissions, and the action is allowed only if permitted by that subset of permissions.

76.64.3.181: Improved clarity of description.

76.64.3.181 — Mon, 15 Jun 2009 16:37:51 GMT

Improved clarity of description.

←Older revision		Revision as of 16:37, 15 June 2009
Line 3:		Line 3:
	== Definition ==		== Definition ==

-	IF a subject requests an action (typically by naming an object and an operation on that object) and the action is allowed if the subject has ~~any~~ permission that would allow the action THEN we say that the subject has '''ambient authority'''.	+	IF a subject requests an action, typically by naming an object and an operation on that object, and the action is allowed because the subject has a permission that would allow the action, THEN we say that the subject has '''ambient authority'''.

	== Notes ==		== Notes ==

Kosik at 06:53, 15 June 2009

Kosik — Mon, 15 Jun 2009 06:53:39 GMT

←Older revision		Revision as of 06:53, 15 June 2009
Line 1:		Line 1:
-	The correct interpretation of this page relies on proper interpretation of words [[subject, object, operation and permission]].	+	The correct interpretation of this page relies on proper interpretation of words: [[subject, object, operation and permission]].

	== Definition ==		== Definition ==