Registering caps and other objects in a microkernel

[GwenCat]

Hey all

I'm wondering if anyone has opinions on how much a microkernel should rely on a global registry vs "root tasks just pass down anonymous capabilities/objects to child tasks".

My current project basically has a global registry for IPC endpoints, but I'm planning on pulling that out into userspace soon, and of course I also need to think carefully about permissions.

I can make it "you can discover anything, but you still need the cap to it" or I can make it so that registering an IPC endpoint implies being able to talk to it.

Currently only my ring0 modules can directly talk to the registry, but I'm pondering how to handle this when I migrate to ring3 tasks.

Anyone got some thoughts?

[AndrewAPrice]

I built a permission server. I have an enum of permissions. Anyone can query it "hey does pid x have permission y?" If it doesn't know, the permission server will show a window:

"Can NetSurf access the Internet?
[Just this once] [Always] [Never]"

It works great. The only limitation I'm running into is I'm writing a shell, and the user may want to do power user things with the shell like kill applications or move system files, but then any script can run in the shell that does dangerous things, or a malicious program could launch the shell and ask if to execute these commands.