Permissions (capabilities)
Every action needs an unforgeable token. There is no root account.
DurgX has no administrator and no all-powerful account. A program can only do something if it holds a capability: a token that names exactly one thing and exactly what may be done with it.
Capabilities cannot be forged. A program never sees the token itself. It holds a small number (a slot index) that points to the token inside the kernel.
What a capability contains
| Part | Meaning |
|---|---|
| Object | What it points to: memory, a device interrupt, a thread, a message endpoint and so on. |
| Rights | What you may do with it (see below). |
| Generation | A counter. Raising it cancels this capability and every copy made from it, instantly. |
| Badge | A label you choose, so a server can tell its callers apart. |
Rights
| Right | Lets you |
|---|---|
| READ | Read the object. |
| WRITE | Change the object. |
| GRANT | Hand a weaker copy to another program. |
| MAP | Map memory into your own address space. |
| INVOKE | Call it: send to an endpoint, wait on an interrupt. |
| REVOKE | Cancel the copies you handed out. |
Kinds of objects
| Object | What it is |
|---|---|
| Untyped | Raw physical memory that has not been given a purpose yet. |
| Frame | One page of memory, including device memory a driver talks to. |
| PageTable | Part of a program's memory map. |
| Tcb | A thread. |
| Endpoint | A place to send messages to, or a message ring. |
| Irq | One hardware interrupt line. |
| IoPort | A specific range of device ports. |
| CNode | A table of capabilities, used to pass them around. |
Memory comes from you
The kernel never allocates memory on its own. Whenever it needs room for a new thread or page table, that memory is carved out of an Untyped capability you supply. The result: the kernel cannot run out of memory in the middle of a job, and you can see exactly where all memory went.
When an action is refused
| Reason | Meaning |
|---|---|
| Invalid slot | The slot you named is empty. |
| Insufficient rights | The capability exists but does not allow this action. |
| Revoked | The capability was cancelled. |
| Wrong object type | The capability points to a different kind of object. |
| Target faulted | The program you tried to reach has crashed. |
Try it
Capability radix tree
A task's CSpace is a 2-level radix tree indexed by cptr. Dashed arcs show derivation.
Select a capability. Revoke an authority to watch every derived copy die in a single write.
slot 0x00
validUntyped
64 MiB physical memory
- generation
- 1
- badge
- 0x0
struct Capability {
object: ObjectRef,
rights: Rights,
generation: u32, // bump = revoke
badge: u64,
}