Next: Capabilities in Distributed Systems
Up: No Title
Previous: Access Control List (ACL)
- A row of the access matrix can be associated with a domain to give a
capability list
- A capability is a protected pointer to an object which specifies the permitted
operations on the object
- Possession of capability gives right to perform operations specified by it
(c.f. possession of a key)
- Capabilities are NOT directly accessed by users, but are protected objects -
maintained by the OS and accessed indirectly by the user
- The OS provides procedures to create, delete and modify capabilities
- Rights Amplification : Trust worthy procedure can act on object passed as
parameter of a specified type, if a calling process has capability to procedure
Procedure rights may be more than rights of calling process
![figure93](img5.gif)
Figure 4: Capability
Hydra : Basic system objects are segments (with read, write and execute operations)
Application specific protection based on access procedures (operations) on user defined objects
Auxiliary rights : names of operations on a type
Capability give access to a specific object instance
Omer F Rana
Sun Feb 16 17:49:18 GMT 1997