There was a recent XKCD cartoon that touched on this; the focus on separation of privilege has historically been couched in terms of protecting one user from another. But the overwhelming majority of computing devices being sold are no longer multiuser, even as they maintain the outdated modalities.
I'm not happy that my single-user machine even has the concept of multiple users; that is way, way, way too coarse a level of granularity for privilege separation.
Indeed, this is one of the things Capsicum is intended to address.
Quoting from Robert Watson's PhD thesis, "A purely system-centric view, however, fails to address the observation that the security interactions of "users" are decreasingly central: desktop and notebook computers, tablet PCs, and smart phones typically have exactly one user."
...
"Capsicum addresses these problems by introducing new (and complementary) security primitives to support compartmentalisation: capability mode and capabilities. Capsicum capabilities should not be confused with operating system privileges, occasionally referred to as capabilities in the OS literature. Capsicum capabilities are an extension of UNIX file descriptors, and reflect rights on specific objects, such as files or sockets. Capabilities may be delegated from process to process in a granular way in the same manner as other file descriptor types: via inheritance or message-passing."
Comments
There was a recent XKCD cartoon that touched on this; the focus on separation of privilege has historically been couched in terms of protecting one user from another. But the overwhelming majority of computing devices being sold are no longer multiuser, even as they maintain the outdated modalities.
I'm not happy that my single-user machine even has the concept of multiple users; that is way, way, way too coarse a level of granularity for privilege separation.
Indeed, this is one of the things Capsicum is intended to address.
Quoting from Robert Watson's PhD thesis, "A purely system-centric view, however, fails to address the observation that the security interactions of "users" are decreasingly central: desktop and notebook computers, tablet PCs, and smart phones typically have exactly one user."
...
"Capsicum addresses these problems by introducing new (and complementary) security primitives to support compartmentalisation: capability mode and capabilities. Capsicum capabilities should not be confused with operating system privileges, occasionally referred to as capabilities in the OS literature. Capsicum capabilities are an extension of UNIX file descriptors, and reflect rights on specific objects, such as files or sockets. Capabilities may be delegated from process to process in a granular way in the same manner as other file descriptor types: via inheritance or message-passing."
http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-818.html