From owner-freebsd-hackers@freebsd.org Thu Mar 10 08:50:35 2016 Return-Path: Delivered-To: freebsd-hackers@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id D8C07AC7432 for ; Thu, 10 Mar 2016 08:50:35 +0000 (UTC) (envelope-from bharghav2947@gmail.com) Received: from mail-lb0-x22d.google.com (mail-lb0-x22d.google.com [IPv6:2a00:1450:4010:c04::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 6368F19B0 for ; Thu, 10 Mar 2016 08:50:35 +0000 (UTC) (envelope-from bharghav2947@gmail.com) Received: by mail-lb0-x22d.google.com with SMTP id k15so103151155lbg.0 for ; Thu, 10 Mar 2016 00:50:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to; bh=QvRClB6pDZhObBlb5d0Y2GPlOQegsAYG67z9HtACZu8=; b=jAFz2DHPx9QfuWiU+BGcZFbJ0x2hWJ9qOqE52881Kn5E1liwQnIiK/AvgwY3e9sWvV oDkRs5o3SqdR02VnYMn3yyWXG42C4s6yt+PfCOb8yJjJ1fjfRZHThcM0Vie8XNKNgJhf an4vwA36S4OpV1J+bfPRcz+32RZLaXXVWrq5WLc7SUKkprJgfq0UjqCy1c+dL7NzI5t5 O2jSRw6+MAbfIedtMN3bt7HubGMpmE1ogQPpVouzpLk0KUUTZrjEOwSXgRIC/PSkYS5k bFDDiwpPTmW8+pxGmBsYGfckT+aOzp7oPzbjsx4LTcYNMNBaFz34ZFSnmczoPxVCfgzs 8XCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to; bh=QvRClB6pDZhObBlb5d0Y2GPlOQegsAYG67z9HtACZu8=; b=Mmj0K9ff3T5F9ziknifuEMenX8RVfwyB8TjL8juK1E9oxqUHRzExMViXcynU63GvEu SlRBWRtr9VxJLXb/41uZnETu6IPSsHSa61miDuZE4g8I7O7a3Tm51t0JUjlJW/LZz53a lafFANhOKvtEk+DOIlViHwt+CtVE0A2O1rkeGrJ9NIoY6NrVrCXLmKjgfpnJUGUd6x0E DnijlBi8wNar956+FR62ld2oitT8AA2msA13lgg2gz0ax1BIVRP2d9ZbOoEKadsCuPYo 3WsZnmMrWGUUtQVIKt+GLw7FQ/HP5JXOAhmZLHr26HG2GepDRvEH8sTJ+rXqKwsBQo63 ItvQ== X-Gm-Message-State: AD7BkJIxhK29JK+iPRBpYrHBFnVLPZLAJiUfAYI0LfCjZzeCa5P/a0QQX9KcU3uqYobdeaQdePTvgiJBdf4PAQ== MIME-Version: 1.0 X-Received: by 10.113.3.6 with SMTP id bs6mr774813lbd.114.1457599833491; Thu, 10 Mar 2016 00:50:33 -0800 (PST) Received: by 10.25.196.196 with HTTP; Thu, 10 Mar 2016 00:50:33 -0800 (PST) Date: Thu, 10 Mar 2016 14:20:33 +0530 Message-ID: Subject: Converting DAC or policy Rules into Capsicum capabilities From: pavan teja To: freebsd-hackers@freebsd.org Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.21 X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 08:50:36 -0000 Hello everyone, I'm right now working on Implementing KDBus project into FreeBSD project .In the KDBus we have a set of policy rules by which we can control the bus connectivity by other processes . If viewing from the other side policy rules appeared to me similar to DAC the security mechanism used in Linux . Can anyone suggest me a good way to convert these DAC rules into capabilities .I want to replace these policy rules in KDBus in my design and replace them with some capabilities . *Example for some policy rules are:* KDBUS_ITEM_NAME: str='org.foo.bar' KDBUS_ITEM_POLICY_ACCESS: type=USER, access=OWN, id=1000 KDBUS_ITEM_POLICY_ACCESS: type=USER, access=TALK, id=1001 KDBUS_ITEM_POLICY_ACCESS: type=WORLD, access=SEE Please help me out by stating an example as how i can convert policy rules as these into some form of capabilities given to each process .This would be very helpful for my design.