Messages in this thread | | | Subject | Re: [PATCH] in-core AFS multiplexor and PAG support | Date | Tue, 13 May 2003 19:21:05 +0100 | From | David Howells <> |
| |
> Right, if some process/user opens a file and then passes the descriptor > to another process/user which closes it. The close should operate under > the same permissions as the original opener.
As long as the token isn't explicitly withdrawn. With my token structure, I've defined it such that if the list_head in the token struct is ever empty, then the token is withdrawn.
Furthermore, I'm considering it such that the the filesystem will select a token from the PAG's token ring in the file_operations->open method and will attach it to the file->f_token at that point for quick reference later.
> If someone obtains my user id on in any way (i.e. weak password/ > bufferoverflow/ root exploit), he should not be allowed to use or access > my tokens as he hasn't proven his identity. In this case he would either > still be in his original process authentication group, or a new and > empty PAG. But definitely not in any of my authentication groups. > > Which is also why joining a PAG should never be allowed.
Someone asked for it, but I suspect if allowed at all it may be best that this ability is governed by its own capability bit and also that the security interface should be consulted.
David - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |