Capability-Based Security for Redox: Namespace and CWD as Capabilities
Summary
The post describes migrating Redox OS from kernel-managed namespace and CWD handling to a capability-based model. It covers implementing a Namespace Manager in userspace, treating resources as capabilities (open file descriptors), and revising relibc to use CWD as a capability to enable sandboxing and simpler kernel design. The result is improved security, reduced attack surface, and a path toward stronger sandboxing features.