#Plan 9 Security Model

Fundamentally different from Unix. Isolation is built into the core abstractions.

#Per-Process Namespaces

Every process has its own private filesystem view. The kernel maintains separate mount tables per process. This is the default, not an add-on like Linux namespaces or chroot. A compromised process sees only what its namespace exposes. No global /etc/passwd, no shared /tmp.

#Factotum

Per-user auth daemon running as file server at /mnt/factotum. Holds all crypto keys in volatile memory, negotiates auth protocols on behalf of applications. No application ever touches a secret key.

• Keys stored as UTF-8 attribute-value pairs: proto=dp9ik dom=9front user=glenda !password=secret
• Secret attributes (prefixed with !) never leave factotum's address space
• Kernel provides private (blocks /proc memory reads) and noswap (prevents paging) protections
• confirm attribute forces per-use graphical approval
• Pluggable protocol state machines

#Secstore

Network service for encrypted key storage. Uses PAK (Password-Authenticated Key Exchange) over DH. Resists passive eavesdropping, active MITM, and dictionary attacks. Files encrypted with AES-CBC. On login, factotum fetches keys from secstore automatically. Supports RADIUS for 2FA.

#Capability System

Temporary, single-use, machine-local credentials:

1. Factotum creates: userid1@userid2@random-string
2. HMAC-SHA1 hash written to write-only /dev/caphash (host owner only)
3. Original string passed to target process, which writes to /dev/capuse
4. Kernel verifies hash, changes process UID, destroys capability

Only factotum creates capabilities. All network servers run unprivileged. Compromised server = limited permissions only.

#Key References