Messages in this thread | | | Date | Sat, 31 Aug 2002 03:29:19 +0200 | Subject | Re: [PATCH] Introduce BSD-style user credential [3/3] | From | Trond Myklebust <> |
| |
>>>>> " " == Linus Torvalds <torvalds@transmeta.com> writes:
> On Sat, 31 Aug 2002, Trond Myklebust wrote: >> >> task-> ucred is not the unit for implementing shared creds >> between threads.
> Fair enough, but some solution to this has to be found. I do > not want to apply something that simply cannot work sanely, and > I want to have at least a _plan_ on the table.
The plan is pretty rough at the moment, and not all of the code has been written yet. Basically, it boils down to:
Add the COW structure 'vfs_cred'
Make VFS changes to replace all instances of current->fsuid/fsgid/ngroups/groups with a single 'vfs_cred' that never can be changed by CLONE_CRED after we call down into the VFS. This means that we have to actually invent mechanisms for passing those creds down to address_space_operations, inode_operations.
Add the more volatile 'pcred' a.k.a. 'task_cred' (see below), which forms the necessary basis for CLONE_CRED tasks.
Audit 'task_cred' to ensure that CLONE_CRED won't introduce new security holes. Things like capabilities, which can sometimes override 'standard credentials', will for instance need to be looked into.
.... end of process -> add CLONE_CRED flag to 'clone()'
> This really ties in with the patches Dave has done (which are > equivalent to your "pcred"), and I'd like to see them work > together in practice.
Dave and I have already been discussing this on l-k, and we appear now to be in agreement on general procedure. Dave has said that he'd like to contribute once we get vfs_cred well established. I'm hoping he'll help out on the latter too ;-)
> (I would suggest calling the FS credentials "struct vfs_cred", > while the regular user credentials might just be "struct cred". > Other suggestions?)
I'm fine about 'vfs'cred', but how about 'struct task_cred' instead for the second? That ties them directly in to the task_struct, and avoids people mistaking for 'ucred'. Since the distinction between COW and non-COW is pretty profound, it might be useful in order to help emphasize to which category they belong...
Cheers, Trond - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |