Post B6iScYqpkXV5KjpPPM by AdrianVovk@fosstodon.org
 (DIR) More posts by AdrianVovk@fosstodon.org
 (DIR) Post #B6iScY5gZpmoyVlkv2 by valpackett@social.treehouse.systems
       0 likes, 0 repeats
       
       @swick one thing I do like about dedicated sockets (like security-context-v1) is that they're kinda capability-shaped (in the proper sense not the silly linux caps sense) (very vaguely and weakly but still).. But yeah, a general "what sandbox is on the other end of the socket" API is a very practical need right now
       
 (DIR) Post #B6iScYOpQf6Bvsj2ky by AdrianVovk@fosstodon.org
       0 likes, 0 repeats
       
       @valpackett @swick IMO security-context is closer to appd than to capabilities as you mean them. It's all about attaching the app's identity to the socket connection. The compositor knows who the app is and this can enforce policy on itappd is the same thing, but made generic. Instead of having N protocol-specific ways to attach an app's identity to a given socket connection, we build out a mechanism to query an app's identity given any connectionThus they're fundamentally the same thing
       
 (DIR) Post #B6iScYcIcZsGbf1nkm by valpackett@social.treehouse.systems
       0 likes, 0 repeats
       
       @AdrianVovk @swick right, you can attach metadata in security-context, but that's sort-of optional in practice? Many compositors don't really care about app identity, e.g. in Sway the only policy is "if connected from security-context, then hide all 'privileged' protocols like layer-shell", nothing more complicated, so effectively that new socket is a strictly-reduced-capability one vs. the original connection
       
 (DIR) Post #B6iScYqpkXV5KjpPPM by AdrianVovk@fosstodon.org
       0 likes, 0 repeats
       
       @valpackett @swick Sounds like anti-capabilities :p. Holding the special socket takes away your capability to do privileged actions, rather than granting you the capability to do the actionsAnyway on a more practical note the Wayland compositor can do exactly the same thing with appd. Check if the incoming client is any sandboxed app, if yes hide the privileged protocols, if no don't. No need to look at all the metadata if you don't need it. But boy is it useful to have right there if you do
       
 (DIR) Post #B6iScZ3az5hzyJnbIe by wolf480pl@mstdn.io
       0 likes, 0 repeats
       
       @AdrianVovk- holding the "normal" socket gives you privileged access - holding the special socket gives you limited access- holding no socket gives you no accessand you can always move down in that list, but never up.I think this matches the properties of a capability quite well.Another important aspect of capabilities is you can pass a socket to someone else, giving them the same access as you have.@valpackett @swick