Messages in this thread | | | Subject | Re: In-kernel Authentication Tokens (PAGs) | From | Trond Myklebust <> | Date | Tue, 15 Jun 2004 03:03:10 -0400 |
| |
På ty , 15/06/2004 klokka 02:38, skreiv Blair Strang:
> Surely the only logical reason to tag a process with extra security > information /in the kernel/ is because that information is going to be > used /by the kernel/. I can't think of a good reason to put a > generalised keystore in the kernel.
Here are three good reasons.
- You want the key lifetime to be the same as your process lifetime - You want the key to be readable ONLY by that one process. - The kernel wants to supports multiple security realms and mechanisms. Not everybody is happy with just kerberosV credentials, and we already have beta code for the SPKM mechanism in RPCSEC_GSS.
As for the AFS PAG idea: it's already been shot down. See the linux-fsdevel thread I referred to earlier.
Cheers, Trond - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |