Capabilities

• A row of the access matrix can be associated with a domain to give a capability list
• A capability is a protected pointer to an object which specifies the permitted operations on the object
• Possession of capability gives right to perform operations specified by it (c.f. possession of a key)
• Capabilities are NOT directly accessed by users, but are protected objects - maintained by the OS and accessed indirectly by the user
• The OS provides procedures to create, delete and modify capabilities
• Rights Amplification : Trust worthy procedure can act on object passed as parameter of a specified type, if a calling process has capability to procedure
  Procedure rights may be more than rights of calling process

  
Figure 4: Capability

Hydra : Basic system objects are segments (with read, write and execute operations)
Application specific protection based on access procedures (operations) on user defined objects
Auxiliary rights : names of operations on a type
Capability give access to a specific object instance

 
• Capabilities in Distributed Systems