A simple example

• Netscape 3.0 has two principals

  • system
  • untrusted

• Black and white trust model

• Every stack frame is labeled with a principal and can set a privilege flag

• Stack inspection occurs when a dangerous operation initiates

  • search frames on caller’s stack from new to old
  • if privilege flag found, search stops
  • if untrusted frame found, throw exception

Previous slide

Next slide

Back to first slide

View graphic version