Re: In-kernel Authentication Tokens (PAGs)

[Kyle Moffett]

On Jun 12, 2004, at 18:51, Chris Wright wrote:
> I don't have a good feel for the PAG data structure, perhaps the
> above would turn out as overkill.  The security api is commented in
> include/linux/security.h, take a gander there.  The blobs are specific
> to the security model, and I don't yet see a need to display them to
> userspace for each PAG.

Ok, well perhaps what I actually need are some extra callbacks for
security modules then.  A token-group (I'm changing the term because
PAG is confused with an older patch) needs to have an access spec
indicating who can read/modify the token-group as a whole and who
can read/modify each token within it.  In my emails with Andy
Lutomirski we have thought about the idea of putting the token-groups
in /proc and running all access through that way.  If we do that, then 
it
would be very practical to just use file permissions and POSIX ACLs
to control access, in which case each token-group and token could
just use the same access-control mechanisms that are used for other
files in /proc.  That would likely be the easiest path

> > Ok, thank you very much, that's exactly what I need.  I am somewhat
> > new to kernel development, so finding my way around the structs is
> > somewhat difficult.  Is there a good guide somewhere on the net that
> > you can point me to?
> Hmm, not really.  The source is best.
Ok, well thanks for pointing out linux/security.h anyway.

Thanks very much for your help!

Cheers,
Kyle Moffett

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/