[emacsen]

> What would an application do that is more secure than namespaces+cgroups?

Object capabilities, which is what Sandstorm/Cap’n Proto are based on, provides much more security than Mandatory Access Control systems while also providing a much simpler method for getting there.

Sadly the literature on OCAP is fairly poor, often being either too low level or too abstract.

The tl;dr is that OCAP systems work by assuming an application has no functionality whatsoever, and then must be passed (not sandboxed but passed) functionality, either at start time, or when the application requests it.

The easiest way to understand it is imagine if instead of being able to open a file on the filesystem by path, you had to specifically be passed the file descriptor by the OS, possibly before runtime.

Another way to think about it is thinking about the OAuth2 capabilities that you can grant an application. You authorize an application to have certain capabilities, and then the client is handed back a set of API tokens or addresses. Those are the only way it can exercise those capabilities.

It's not being sandboxed, it simply doesn't have any additional way to get access.

[_cenw]

That seems interesting and like a technically correct way to go, but also I can see nobody adopting it on a general purpose operating system and thus rendering it useless. Getting developers to use portals already is hard enough.

Thanks for actually answering the question.