Object-capability model


The object-capability model is a computer security model. A capability describes a transferable right to perform one operations on a given object. It can be obtained by the following combination:
The security model relies on not being able to forge references.
In the object-capability model, all computation is performed following the above rules.
Advantages that motivate object-oriented programming, such as encapsulation or information hiding, modularity, and separation of concerns, correspond to security goals such as least privilege and privilege separation in capability-based programming.
The object-capability model was first proposed by Jack Dennis and Earl C. Van Horn in 1966.

Loopholes in object-oriented programming languages

Some object-based programming languages provide ways to access resources in other ways than according to the rules above including the following:
Such use of undeniable authority violates the conditions of the object-capability model. Caja and Joe-E are variants of JavaScript and Java, respectively, that impose restrictions to eliminate these loopholes.

Advantages of object capabilities

The structural properties of object capability systems favor modularity in code design and ensure reliable encapsulation in code implementation.
These structural properties facilitate the analysis of some security properties of an object-capability program or operating system. Some of these — in particular, information flow properties — can be analyzed at the level of object references and connectivity, independent of any knowledge or analysis of the code that determines the behavior of the objects. As a consequence, these security properties can be established and maintained in the presence of new objects that contain unknown and possibly malicious code.
These structural properties stem from the two rules governing access to existing objects:
As a consequence of these two rules, an object can obtain a reference to another object only through a preexisting chain of references. In short, "Only connectivity begets connectivity."

Glossary of related terms

;object-capability system
;object
;reference
;message
;request
;attenuation

Implementations

Almost all historical systems that have been described as "capability systems" can be modeled as object-capability systems.
KeyKOS, EROS, Integrity, CapROS, Coyotos, seL4, OKL4 and Fiasco.OC are secure operating systems that implement the object-capability model.

Languages that implement object capabilities

*