lkml.org 
[lkml]   [2004]   [Jun]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: In-kernel Authentication Tokens (PAGs)
* Kyle Moffett (mrmacman_g4@mac.com) wrote:
> On Jun 12, 2004, at 17:44, Chris Wright wrote:
> > Typically, objects that LSM cares about include a pointer to opaque
> > data (security blob) which describes the security domain for the
> > object.
> > See task->security as an example. It's not clear to me if
> > task->security
> > is sufficient and you only need a back pointer to the task or if each
> > PAG needs it's own security blob.
>
> Ahh, ok. In this case, a PAG is an independent object, not directly
> associated with any specific task or other PAG, so therefore it will
> likely
> need its own security blob. Currently, in the creation of my PAG I just
> copy over the UID from the calling task. If I was to convert it to use
> LSM,
> I guess I should just leave out the UID entirely, and just have a
> pointer
> to a security blob. What is the best way to portray the security blob
> to
> user-space, in terms of sys-calls? I need a way for user-space apps to
> change the security context in a similar way as it is changed for a task
> or process. Do you have a link to some documentation on the kernel
> API for LSM? I basically need to copy the current task's security blob
> into a new one and be able to compare two contexts to see if one
> can affect the other. Thanks!

I don't have a good feel for the PAG data structure, perhaps the
above would turn out as overkill. The security api is commented in
include/linux/security.h, take a gander there. The blobs are specific
to the security model, and I don't yet see a need to display them to
userspace for each PAG.

> > Sounds like an extension to rlimits. The counters could be stored in
> > ->user to limit the userwide number of tokens.
>
> Ok, thank you very much, that's exactly what I need. I am somewhat
> new to kernel development, so finding my way around the structs is
> somewhat difficult. Is there a good guide somewhere on the net that
> you can point me to?

Hmm, not really. The source is best.

thanks,
-chris
--
Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:03    [from the cache]
©2003-2011 Jasper Spaans