cap-std use

[valeriob01]

Greetings,
will Cloud Hypervisor use the new cap-std ?

https://blog.sunfishcode.online/introducing-cap-std/

Usage of cap-std would benefit of capability-based security for the hypervisor and virtual machines.

[sboeuf]

That's quite interesting, I wasn't aware about this.
What are the impacts in terms of performance?
And the biggest challenge is about adoption from other crates, right? Or can you only introduce it to one crate at a time?
I'm asking because even if we try to move the project to such crate, there are many crates we rely on from rust-vmm, so I'm wondering if we would still be able to compile some sort of hybrid.

[valeriob01]

I think it is better if you ask the author of cap-std, I'm not aware of much detail, just interested in capability-based security, but if you want to consult some capability experts you can drop a note here https://groups.google.com/u/2/g/cap-talk where there is a discussion going on on this topic.

[sunfishcode]

That's quite interesting, I wasn't aware about this.
What are the impacts in terms of performance?

cap-std is very lightweight, and on Linux >= 5.6, it's very fast; the filesystem code uses Linux's openat2 + O_PATH to implement most operations with one or two system calls. On other platforms it often does approximately one system call per path component, which is slower, though not unreasonably so.

And the biggest challenge is about adoption from other crates, right? Or can you only introduce it to one crate at a time?
I'm asking because even if we try to move the project to such crate, there are many crates we rely on from rust-vmm, so I'm wondering if we would still be able to compile some sort of hybrid.

cap-std can easily be introduced one crate at a time. That's one of its strengths—it doesn't have any process-wide effects, so it has no impact on crates that aren't using it.

Of course, that's also one of its weaknesses, because it can't easily ensure that all your dependencies are sandboxed, if that's what you need. There's a tool that can help scan codebases for ambient authority, but it isn't the same as having a process-based sandbox wrapped around your entire program.

[selroc]

So what is your current decision about cap-std ?

[selroc]

Greetings, will Cloud Hypervisor use the new cap-std ?

https://blog.sunfishcode.online/introducing-cap-std/

Usage of cap-std would benefit of capability-based security for the hypervisor and virtual machines.

FYI selroc is me (valeriob01) under another account.
What is your current decision about cap-std ?