Editing Capability-based security (section)

{{short description|Computer safety concept}}
'''Capability-based security''' is a concept in the design of [[Computer security|secure computing]] systems, one of the existing [[Computer security model|security models]]. A '''capability''' (known in some systems as a '''key''') is a communicable, unforgeable [[Access token|token]] of authority. It refers to a value that [[reference (computer science)|references]] an [[object (computer science)|object]] along with an associated set of [[access control|access rights]]. A [[user (computing)|user]] [[Computer program|program]] on a [[capability-based operating system]] must use a capability to access an object. Capability-based security refers to the principle of designing user programs such that they directly share capabilities with each other according to the [[principle of least privilege]], and to the operating system infrastructure necessary to make such transactions efficient and secure. Capability-based security is to be contrasted with an approach that uses [[File-system permissions|traditional UNIX permissions]] and [[access-control list|access control lists]].

Although most operating systems implement a facility which resembles capabilities, they typically do not provide enough support to allow for the exchange of capabilities among possibly mutually untrusting entities to be the primary means of granting and distributing access rights throughout the system. A capability-based system, in contrast, is designed with that goal in mind.