# Plan 9 Security Model

Fundamentally different from Unix. Isolation is built into the core abstractions.

## Per-Process Namespaces

Every process has its own private filesystem view. The kernel maintains separate mount tables per process. This is the default, not an add-on like Linux namespaces or chroot. A compromised process sees only what its namespace exposes. No global /etc/passwd, no shared /tmp.

## Factotum

Per-user auth daemon running as file server at /mnt/factotum. Holds all crypto keys in volatile memory, negotiates auth protocols on behalf of applications. No application ever touches a secret key.

- Keys stored as UTF-8 attribute-value pairs: `proto=dp9ik dom=9front user=glenda !password=secret`
- Secret attributes (prefixed with !) never leave factotum's address space
- Kernel provides `private` (blocks /proc memory reads) and `noswap` (prevents paging) protections
- `confirm` attribute forces per-use graphical approval
- Pluggable protocol state machines

## Secstore

Network service for encrypted key storage. Uses PAK (Password-Authenticated Key Exchange) over DH. Resists passive eavesdropping, active MITM, and dictionary attacks. Files encrypted with AES-CBC. On login, factotum fetches keys from secstore automatically. Supports RADIUS for 2FA.

## Capability System

Temporary, single-use, machine-local credentials:
1. Factotum creates: `userid1@userid2@random-string`
2. HMAC-SHA1 hash written to write-only /dev/caphash (host owner only)
3. Original string passed to target process, which writes to /dev/capuse
4. Kernel verifies hash, changes process UID, destroys capability

Only factotum creates capabilities. All network servers run unprivileged. Compromised server = limited permissions only.

## Key References

| Title | URL |
|-------|-----|
| Security in Plan 9 (official) | https://9p.io/sys/doc/auth.html |
| Security in Plan 9 (USENIX PDF) | https://css.csail.mit.edu/6.858/2013/readings/plan9auth.pdf |
| Security in Plan 9 (USENIX HTML) | https://www.usenix.org/legacy/event/sec02/full_papers/cox/cox_html/ |
| Factotum (Wikipedia) | https://en.wikipedia.org/wiki/Factotum_(software) |
| The Use of Name Spaces in Plan 9 | https://9p.io/sys/doc/names.html |
| Cat-v Security in Plan 9 | http://doc.cat-v.org/plan_9/4th_edition/papers/auth |