Cap<NetSession> (sigil-os#12, 098094a) brings network access under the sigilOS capability model. HP_NET_TOKEN is broker-held; the kernel injects it at the broker boundary; EL0 cannot forge it or escalate beyond its granted session. Network is now a held capability, not ambient.
The problem: ambient network access
On a traditional OS, network access is ambient — any process with a socket syscall succeeds. There is no kernel boundary between "process that should reach the network" and "process that should not." The only check is the discretionary permission of the process owner, which is bypassed by any vulnerability that achieves code execution in the target process.
In sigilOS, the invariant is different: no EL0 code reaches the network without a held cap. A process without Cap<NetSession> cannot open a socket, resolve a name, or send a packet. The capability is not a permission bit that can be set — it is a kernel-injected token that EL0 cannot manufacture.
Cap<NetSession> — how it works
HP_NET_TOKEN is the broker-held network capability token. At session establishment, the broker grants a Cap<NetSession> handle to apps that are authorized for network access. The kernel injects HP_NET_TOKEN at the broker seam — EL0 only receives the session handle, not the token itself.
EL0 app
│ holds: session handle (opaque u32)
▼
broker seam
│ kernel injects HP_NET_TOKEN
▼
net dispatch
│ checks: HP_NET_TOKEN present → route to stack
│ wrong/absent → EPERM
▼
network stackWrong or absent token returns EPERM immediately. The EL0 app never sees HP_NET_TOKEN — it only sees the result of the call (success or EPERM). There is no way to derive the token from the session handle.
What Cap<NetSession> gates
| Operation | Syscall | Gate |
|---|---|---|
| DNS resolve | net_resolve | HP_NET_TOKEN → EPERM if absent |
| TCP connect | net_connect | HP_NET_TOKEN → EPERM if absent |
| UDP send | net_send | HP_NET_TOKEN → EPERM if absent |
| NET_LISTEN | 109 | HP_NET_TOKEN → EPERM if absent |
| NET_ACCEPT | 110 | HP_NET_TOKEN → EPERM if absent |
| NET_CLOSE | 112 | Session handle revocation |
The Lumen network panel displays the session's cap grant as a visible chip — the user can see which sessions hold Cap<NetSession> and revoke them. Revocation calls NET_CLOSE (syscall 112) on the session handle; subsequent net calls from that session return EPERM.
SRDX remote desktop transport
The SRDX (Sigil Remote Desktop eXchange) transport (sigil-os#12 + kernel 0b932b9, syscalls 109–112) runs on top of Cap<NetSession>. The full syscall set:
- 109 NET_LISTEN — open a listening socket on a cap-granted session
- 110 NET_ACCEPT — accept an inbound connection
- 111 — reserved (future: NET_ACCEPT_ASYNC)
- 112 NET_CLOSE — close session + revoke cap grant
SRDX uses NET_LISTEN on a fixed port to accept the desktop viewer connection, then routes compositor scene deltas over the session. Because SRDX runs under Cap<NetSession>, a compromised viewer process cannot escalate to arbitrary network access — its cap is scoped to the established session only.