lkml.org 
[lkml]   [2004]   [Jun]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: In-kernel Authentication Tokens (PAGs)
Date
On Jun 12, 2004, at 16:53, Chris Wright wrote:
> Actually that's not the case. The UID is currently insufficient to
> describe the security domain that a process is running in. The whole
> of the LSM infrastructure is designed with this in mind. So somehting
> like SELinux may enforce a security domain change (w/out a UID change)
> across an execve() of pagsh. I was simply trying to ascertain if you
> were storing this within task->user which I think would be wrong.

Ahh, ok, I myself have no experience with LSM, so there will likely be
some
need to change my implementation. Currently the only field that I add
to
existing structures in the kernel is a pag field in the task_struct.
PAG
structures themselves need some way of determining if the calling task
is in the same "grouping" as a stored "grouping" within the PAG. My
implementation uses UIDs, but I would be very glad if you could tell me
what I should use instead. I need some kind of structure or pointer
that I
can embed within a PAG and a token, and some kind of equality test.

The other thing that needs to be implemented is some kind of limit that
restricts how many PAGs/tokens and how much memory can be allocated
in the kernel per user and per process. Do you have any information on
where would be the best place to store that information?

Cheers,
Kyle Moffett

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:03    [W:1.769 / U:0.412 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site