Re: security model

[Timothy Stack <stack@cs.utah.edu>]

> Hi,
> 
>     I want to make an application which sends capsule to read/modify the
>     route table of the given node. But I find the capsule cant do this
>     because the capsule is RemoteUser at the given node, and
>     RemoteUser don't have the permission to do this.

The route table is shared amongst all the protocols/applications so we
can't really allow untrusted code to have access to such a resource.

>     The Dante and DynamicRoute app are implemented as application. By
>     using '-principal user', the applications get the permission.
>     Could the capsule get any privileges to do these privilege
>     operations?

Downloaded code will always be run under the RemoteUser principal since
its hard to trust, however, an application can start up a protocol with a
different principal.  Simply create an application that calls
Node.register() with the appropriate Principal object.

>     Thanks.
> 
> -- 
> Best regards,
>  avivi

tim stack