charlotte-os / charlotte-core

The Kernel of CharlotteOS

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Create the initial framework for the access control and capabilities subsystem

mdpatelcsecon opened this issue · comments

Implement an access control system with the following design:

  1. Global Capability Tables: One array per type of capability. Each capability is stored once in the appropriate table along with a reference count.

  2. Context Capability Table: Each process context has a map where the keys are u64s and the values are the capability type and index into the corresponding global capability table. This allows multiple contexts to share the same capability without duplicating it in the kernel.

  3. Reference Counting: Each capability has a reference count. When a capability is revoked from a context, the reference count is decremented. When the count reaches zero, the capability and its associated resources should be freed.

This issue is blocked on #14.

This issue is blocked on the development of a kernel dynamic allocator.

This is being shelved as there are design considerations that are still in flux and it may not be needed.