lkml.org 
[lkml]   [1998]   [Feb]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: PROPOSAL: Process Authentication Groups (PAGs) (fwd)
From
Date
IMHO, PAGs are a poor model for what you are trying to do.  I
understand the idea here, but I believe they are flawed in a few ways.
First, I like that with kerberos or ssh, the user can choose which of
the available ticket files/agents/whatever to use. I often switch
between kerberos tickets in a single shell. Retyping the password
each time would be inconvenient, at best. If there is no way to truly
"set" the PAG, but only to create a new PAG, then substantial
functionality which I used on a daily basis is lost. Second, I don't
believe the kernel is the right place to store this data. Certainly,
the kernel may need access to it, but this is inherently user data,
not system data. Kernel storage makes certain useful techniques, such
as credential forwarding or smartcards, difficult. I'd rather not see
smartcard interaction code in my kernel.

Feel free to forward this to other appropriate forums.

Marc

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:41    [W:0.085 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site