[lkml]   [2004]   [Jun]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: In-kernel Authentication Tokens (PAGs)
    * Kyle Moffett ( wrote:
    > On Jun 12, 2004, at 17:44, Chris Wright wrote:
    > > Typically, objects that LSM cares about include a pointer to opaque
    > > data (security blob) which describes the security domain for the
    > > object.
    > > See task->security as an example. It's not clear to me if
    > > task->security
    > > is sufficient and you only need a back pointer to the task or if each
    > > PAG needs it's own security blob.
    > Ahh, ok. In this case, a PAG is an independent object, not directly
    > associated with any specific task or other PAG, so therefore it will
    > likely
    > need its own security blob. Currently, in the creation of my PAG I just
    > copy over the UID from the calling task. If I was to convert it to use
    > LSM,
    > I guess I should just leave out the UID entirely, and just have a
    > pointer
    > to a security blob. What is the best way to portray the security blob
    > to
    > user-space, in terms of sys-calls? I need a way for user-space apps to
    > change the security context in a similar way as it is changed for a task
    > or process. Do you have a link to some documentation on the kernel
    > API for LSM? I basically need to copy the current task's security blob
    > into a new one and be able to compare two contexts to see if one
    > can affect the other. Thanks!

    I don't have a good feel for the PAG data structure, perhaps the
    above would turn out as overkill. The security api is commented in
    include/linux/security.h, take a gander there. The blobs are specific
    to the security model, and I don't yet see a need to display them to
    userspace for each PAG.

    > > Sounds like an extension to rlimits. The counters could be stored in
    > > ->user to limit the userwide number of tokens.
    > Ok, thank you very much, that's exactly what I need. I am somewhat
    > new to kernel development, so finding my way around the structs is
    > somewhat difficult. Is there a good guide somewhere on the net that
    > you can point me to?

    Hmm, not really. The source is best.

    Linux Security Modules
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:03    [W:0.021 / U:1.320 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site