summaryrefslogtreecommitdiff
path: root/mechanism.mdwn
blob: dddb234b7efcb5f99bd0f5b420b63e29eee83840 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
[[!meta copyright="Copyright © 2007, 2008 Free Software Foundation, Inc."]]

[[!meta license="""[[!toggle id="license" text="GFDL 1.2+"]][[!toggleable
id="license" text="Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version 1.2 or
any later version published by the Free Software Foundation; with no Invariant
Sections, no Front-Cover Texts, and no Back-Cover Texts.  A copy of the license
is included in the section entitled
[[GNU Free Documentation License|/fdl]]."]]"""]]

The Collaborative International Dictionary of English v.0.48
defines a mechanism as:

> The series of causal relations that operate to produce an
> effect in any system; as, the mechanism of a chemical
> reaction.

This is, a mechanism is a function that produces some result.
As mechanisms determine the type of result, they necessarily
impose some [[policy]] (rules).  Mechanisms that are referred
to as policy-free are those that minimally impose policy.

A process can be used to encapsulate a program instance.  On [[Unix]],
a process is associated with a UID.  This UID, in part, determines
what the process is authorized to do.  On a [[microkernel]],
the policy that controls what resources a process may access
are realized separately.  This may achieved through the use of
UIDs, however need not.  Thus, the processes mechanism on such
microkernels impose less policy than on Unix.  A process is not
policy free as it is possible to use other mechanisms to
encapsulate a program instance, e.g., [[SFI]] and tainting
ala [[Asbestos]].