58597139fa
## Description Closes: #9404 --- ### Author Checklist *All items are required. Please add a note to the item if the item is not applicable and please add links to any relevant follow up issues.* I have... - [x] included the correct [type prefix](https://github.com/commitizen/conventional-commit-types/blob/v3.0.0/index.json) in the PR title - [ ] added `!` to the type prefix if API or client breaking change - [x] targeted the correct branch (see [PR Targeting](https://github.com/cosmos/cosmos-sdk/blob/master/CONTRIBUTING.md#pr-targeting)) - [x] provided a link to the relevant issue or specification - [ ] followed the guidelines for [building modules](https://github.com/cosmos/cosmos-sdk/blob/master/docs/building-modules) - [ ] included the necessary unit and integration [tests](https://github.com/cosmos/cosmos-sdk/blob/master/CONTRIBUTING.md#testing) - [ ] added a changelog entry to `CHANGELOG.md` - [ ] included comments for [documenting Go code](https://blog.golang.org/godoc) - [ ] updated the relevant documentation or specification - [x] reviewed "Files changed" and left comments if necessary - [x] confirmed all CI checks have passed ### Reviewers Checklist *All items are required. Please add a note if the item is not applicable and please add your handle next to the items reviewed if you only reviewed selected items.* I have... - [ ] confirmed the correct [type prefix](https://github.com/commitizen/conventional-commit-types/blob/v3.0.0/index.json) in the PR title - [ ] confirmed `!` in the type prefix if API or client breaking change - [ ] confirmed all author checklist items have been addressed - [ ] reviewed state machine logic - [ ] reviewed API design and naming - [ ] reviewed documentation is accurate - [ ] reviewed tests and test coverage - [ ] manually tested (if applicable)
80 lines
2.7 KiB
Markdown
80 lines
2.7 KiB
Markdown
<!--
|
|
order: 11
|
|
-->
|
|
|
|
# Object-Capability Model
|
|
|
|
## Intro
|
|
|
|
When thinking about security, it is good to start with a specific threat model. Our threat model is the following:
|
|
|
|
> We assume that a thriving ecosystem of Cosmos SDK modules that are easy to compose into a blockchain application will contain faulty or malicious modules.
|
|
|
|
The Cosmos SDK is designed to address this threat by being the
|
|
foundation of an object capability system.
|
|
|
|
> The structural properties of object capability systems favor
|
|
> modularity in code design and ensure reliable encapsulation in
|
|
> code implementation.
|
|
>
|
|
> These structural properties facilitate the analysis of some
|
|
> security properties of an object-capability program or operating
|
|
> system. Some of these — in particular, information flow properties
|
|
> — can be analyzed at the level of object references and
|
|
> connectivity, independent of any knowledge or analysis of the code
|
|
> that determines the behavior of the objects.
|
|
>
|
|
> As a consequence, these security properties can be established
|
|
> and maintained in the presence of new objects that contain unknown
|
|
> and possibly malicious code.
|
|
>
|
|
> These structural properties stem from the two rules governing
|
|
> access to existing objects:
|
|
>
|
|
> 1. An object A can send a message to B only if object A holds a
|
|
> reference to B.
|
|
> 2. An object A can obtain a reference to C only
|
|
> if object A receives a message containing a reference to C. As a
|
|
> consequence of these two rules, an object can obtain a reference
|
|
> to another object only through a preexisting chain of references.
|
|
> In short, "Only connectivity begets connectivity."
|
|
|
|
For an introduction to object-capabilities, see this [Wikipedia article](https://en.wikipedia.org/wiki/Object-capability_model).
|
|
|
|
## Ocaps in practice
|
|
|
|
The idea is to only reveal what is necessary to get the work done.
|
|
|
|
For example, the following code snippet violates the object capabilities
|
|
principle:
|
|
|
|
```go
|
|
type AppAccount struct {...}
|
|
account := &AppAccount{
|
|
Address: pub.Address(),
|
|
Coins: sdk.Coins{sdk.NewInt64Coin("ATM", 100)},
|
|
}
|
|
sumValue := externalModule.ComputeSumValue(account)
|
|
```
|
|
|
|
The method `ComputeSumValue` implies a pure function, yet the implied
|
|
capability of accepting a pointer value is the capability to modify that
|
|
value. The preferred method signature should take a copy instead.
|
|
|
|
```go
|
|
sumValue := externalModule.ComputeSumValue(*account)
|
|
```
|
|
|
|
In the Cosmos SDK, you can see the application of this principle in the
|
|
gaia app.
|
|
|
|
+++ <https://github.com/cosmos/cosmos-sdk/blob/v0.41.4/simapp/app.go#L249-L273>
|
|
|
|
The following diagram shows the current dependencies between keepers.
|
|
|
|
|
|
|
|
## Next {hide}
|
|
|
|
Learn about the [`runTx` middleware](./runtx_middleware.md) {hide}
|