On 1/16/2017 4:03 PM, James Bottomley wrote: > [...] > > OK, so snipping all the details: it's a per process property and > inherited, I don't even see that it needs anything container specific. > The pid namespace should be sufficient to keep any potential security > leaks contained and the inheritance model should just work with > containers. Agreed. >> While a file system can internally create an association between an >> authentication content with a file descriptor once it is created and >> with pages for write-back, I believe there would be benefit from a >> more generic method of tracking authentication contexts in file >> descriptors and pages. In particular would be better defined >> behavior when a file has been opened for "write" from processes >> associated with more than one authentication context. > > As long as an "authentication" becomes a property of a file descriptor > (like a token), then I don't see any container problems: fds are > namespace blind, so they can be passed between containers and your > authorizations would go with them. If you need to go back to a process > as part of the authorization, then there would be problems because > processes are namespaced. > >> For example, the problems that AFS is currently experiencing with >> systemd. A good description of problem by Jonathan Billings can be >> found at >> >> >> https://docs.google.com/document/d/1P27fP1uj-C8QdxDKMKtI-Qh00c5_9zJa4 >> YHjn=pB6ODM/pub > > This is giving me "Sorry, the file you have requested does not exist." Not sure how an extra '=' got in there. https://docs.google.com/document/d/1P27fP1uj-C8QdxDKMKtI-Qh00c5_9zJa4YHjnpB6ODM/pub Jeffrey Altman
begin:vcard fn:Jeffrey Altman n:Altman;Jeffrey org:AuriStor, Inc. adr:Suite 6B;;255 West 94Th Street;New York;New York;10025-6985;United States email;internet:jaltman@xxxxxxxxxxxx title:Founder and CEO tel;work:+1-212-769-9018 note;quoted-printable:LinkedIn: https://www.linkedin.com/in/jeffreyaltman=0D=0A= Skype: jeffrey.e.altman=0D=0A= url:https://www.auristor.com/ version:2.1 end:vcard
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
