alt Hacker NewsI have been exploring something on the lines of capsicum for my language+runtime and you want to balance usability and security. Too much friction and people WILL use --all like I do with Deno.
My current thinking is to freeze all caps on startup. pid-0 within the runtime has the max caps the application will ever have and it can parcel out subsets to other processes that need it.
This can show up on the ux side as a single permission request listing all the caps the application claims it needs with a default negative response.
This is what I do by setting caps at compile time, they aren’t a runtime feature. You either compile out code without a grant or it errors.