USB sticks as capabilities

Posted on April 8, 2026
There is an interesting concept in computer security called capabilities. In short, a program can do something (like read/write a file, open a TCP connection, play sound or record audio/video) only if it holds a capability to do such a thing, which is very reminiscent of file descriptors.

Confusingly, POSIX also describes something it calls “capabilities” but these are very coarse-grained
Linux’s CAP_SYS_ADMIN reminds me of a god object, look it up with man capabilities
and can’t be transferred between processes. They do thus not qualify as “true” capabilities.

WASI is probably the best chance we currently have for bringing capabilities to the masses but there exist plenty of other (niche) projects:

I’ve been experimenting on my Linux system
NixOS to be precise, you can view my exact config
with bringing capabilities to the physical world.

By default my laptop has its WiFi-chip turned off and a blocklist of distracting websites. I can restore my internet connection by either plugging in Ethernet
Itself a physical manifestation of a capability
or a special USB stick whose ID I’ve hardcoded. Another USB stick also undoes my blocklist.
I’ll write an explanation for how at some point, in short: udev, rfkill and iptables
This has helped me cut down on (among other things) a news addiction.

Imagined ideal system

In some imaginary future world I foresee it being easy and useful to do stuff like this. Let me just quickly jot down a list of possibilities.

Internet:
  • Unrestricted
  • Blocklist of distracting domains
  • Limited speed (3G, or even 56k dialup)
  • Allow-list of domains (and ports?)
  • Offline

Display:
  • Unrestricted
  • Application-specific transparency
  • Black & white

Audio:
  • Unrestricted
  • Blocklist/allowlist of outputs
    Builtin speakers, headphone jack, bluetooth and usb. Did I miss any?
  • Turned off

Besides these “outputs” we also have some “inputs” on which we’d like our outputs to depend:
  • USB devices, the presence of specific devices could be used to allow/disallow any of the above “outputs”. Arbitrary USB devices could thus function like physical keys.
  • Power, charging generally signifies I’m at a desk, we might permit more. Discharging could mean that I’m at a less formal place like a couch.
  • Location (GPS? WiFi network?), maybe we’d like to prevent access to personal files while at work. Or only allow access to a specific game while at a friends house.
  • Time, perhaps no more access to work emails after 17:30?