Re: Capabilities, Anybody?

Theo Markettos wrote:

MitchAlsup1 <mitchalsup@aol.com> wrote:

BGB wrote:
<snip>

You can make it work, yes, but the question is less "can you make it work, technically", but more:
Can you make it work in a way that provides both a fairly normal C experience, and *also* an unbreakable sandbox, at the same time.

The C experience is fairly normal, as long as you are actually playing by
the C rules.  You can't arbitraily cast integers to pointers - if you plan
to do that you need to use intptr_t so the compiler knows to keep the data
in a capability so it can use it as a pointer later.

As a 'for instance' how does one take a capability and align it to a cache
line boundary ?? Say in/after malloc() ?!?

Tricks which store data in the upper or lower bits of pointers are awkward.

Especially so when you have a 64-bit VaS to play in.

Other tricks like XOR linked lists of pointers don't work. 

This should have died out with the PDP-11s. With modern machines it does not
save enough space to warrant the loss in performance.

                                                            This is all
stuff that's pushing into the 'undefined behaviour' parts of C (even if C
doesn't explicitly call it out).

<snip>

Why would you want to ASLR?  ASLR is to prevent you guessing valid addresses
for things so you can't craft pointers to them.  CHERI prevents you crafting
pointers to arbitrary things in the first place.

ALSR has become a catch-phrase used to give the listener a good feeling
about the security of the present system--all the while knowing that is
it little more than window dressing on a building already in flames.