From https://en.wikipedia.org/wiki/Capability-based_security

Capability-based security is to be contrasted with an approach that uses hierarchical protection domains.

From https://en.wikipedia.org/wiki/Protection_ring

hierarchical protection domains, often called protection rings, are mechanisms to protect data and functionality from faults (by improving fault tolerance) and malicious behaviour (by providing computer security). This approach is diametrically opposite to that of capability-based security.

Are capability-based security and hierarchical protection domains for different purposes? Or are they different methods for the same purpose?

In what sense are the two approaches are completely opposite to each other?

1 Answer 1


In capability-based security, programs follow the principle of least privilege as stated on Wikipedia. This means that each program has almost no permissions to begin with and permissions are then granted for only the parts that the program needs. This is generally done on a much higher level than hierarchical protection domains.

In hierarchical protection domains, there are essentially layers that each contain certain permissions. Programs in more privileged levels have more permissions. In this way, programs do not start off with no permissions and may be granted lots of permissions they don't actually need. This is often enforced by the CPU architecture instead of in pure software and is much less granular than capability-based security. This approach contradicts the principle of least privilege.

In the sense that both approaches are used for the provisioning of permissions to programs, they are different methods for the same purpose, but the tend to apply to different domains. The Android OS implements a kernel similar to Linux and uses hierarchical protection domains there, but then on top of that it adds the Android stack and then uses capability-based security for Apps.

  • 2
    Thanks. do running a process with sudo or su belong one of the two?
    – Tim
    Commented Sep 2, 2014 at 13:04
  • 1
    capability-based security is not used for accessing kernel services, is it?
    – Tim
    Commented Sep 2, 2014 at 14:31
  • 2
    This doesn't sound like "diametrically opposite." It sounds like "different," or maybe "is a subset of". I flagged the wikipedia page as requiring citation.
    – Wandering Logic
    Commented Sep 2, 2014 at 18:00
  • @Tim I'm not sure about sudo or su. The classification may not be as clear cut. I'm pretty sure there is nothing that uses capability-based security around the Linux kernel, but it would certainly be possible to use that basis in a kernel for some new OS.
    – neelsg
    Commented Sep 3, 2014 at 7:23
  • 1
    @WanderingLogic. I do not agree that one "is a subset of" the other, they are pretty much mutually exclusive. I do agree that "diametrically opposite" is misleading
    – neelsg
    Commented Sep 3, 2014 at 7:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .