lkml.org 
[lkml]   [2004]   [Jun]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: In-kernel Authentication Tokens (PAGs)
Date
On Jun 11, 2004, at 23:13, Andy Lutomirski wrote:
> I like the idea of having some kernel support for tokens.
>
> But why PAGs? I imagine tokens as being independent objects without
> any hierarchy. A token group is a set of tokens. The operations on
> tokens
> are:
>
> [...snip...]
>
> If you really need a hierarchy, then you could allow token groups to
> contain
> other token groups, with the rule that the whole thing must be acyclic.

I think my vocabulary here is confusing, what you refer to as a token
group, I refer to as a PAG. The idea for the hierarchy is that it is
frequently desirable to start a sub-shell with a temporarily different
set of tokens, or to mask out only a certain token without modifying
the rest. For example, let's say that I login at my school, which gets
Kerberos tokens and AFS tickets. Now I want to perform some Kerberos
administration activities, so I run "pagsh" or something to create a
new shell with a new PAG, one with a parent of the original PAG. When
I do filesystem access the search process finds the old AFS tokens, but
the kmoffett/admin@MY.HOST Kerberos TGT token hides the old
kmoffett@MY.HOST Kerberos TGT, without replacing it. That means that
all the old shells operate normally, nothing has changed for them, but
the new shell has the extra layer with the new Kerberos tickets, so I
can administrate Kerberos without changing my AFS tokens to admin ones.

Cheers,
Kyle Moffett

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:03    [W:0.105 / U:1.420 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site