On Thu, Feb 11, 2010 at 1:00 AM, Lennart Poettering <lennart at poettering.net> wrote: > On Mon, 08.02.10 19:11, olin.pulse.7ia at shivers.mail0.org (olin.pulse.7ia at shivers.mail0.org) wrote: > >> PA is a system that manages access to a hardware resource, in a network >> distributed context. Such a system must have mechanism for managing >> authentication and privileges -- one that works in a network distributed >> context. >> >> X11 is in a very similar position -- except that there's less call for shared >> access to the resources it manages (in the sense that, with X11, multiple >> humans usually don't want access to the same screen, keyboard or mouse at the >> same time). X uses ~/.Xauthority, but, these days, it mostly "lifts" this >> base mechanism up to a distributed setting by means of ssh. >> >> OK, so that's X11. I cannot figure out what PA's mechanism for this >> is. > > By default we store the access creds of the PA server in the root > window of the X server. Which means that everyone who has access to > the X server has access to the matching PA server, too. So we mostly > follow the X logic, with one exception: we only have one PA instance > running per user and machine, and share it between all sessions of the > same user, so that every session of the same user has access to all > local cards that belong to any of the X screens. > >> I sort of get the sense, from this per-user-login server model that >> PA has the horrible one-persone/one-computer model of "the person at >> the console is the person using the computer," which was inflicted >> on the world by Microsoft Windows. If so, this is a real design >> error, one that doesn't sync up with Unix, which has always had a >> multi-user model of the world. > > Right. "horrible". > > I mean, what you say is utterly bogus, but I don't even want to dicuss > that here. I'd just like to refer you to the CK work that has been > done, because that is where this logic stems from. The logic is > certainly nothing we PA folks came up with. It's something CK was > designed for. So please complain not to me. I certainly believe CK is > what we want, but I am not its maintainer. it does not mean that CK is the absolute right solution for everyone I second that the current default setup is not good for many users. It does not help to force people to a logic which they do not accept. I know that you see many things to be broken but many people lived with it very good for more than at least 10 years, until you came up with the first unstable PA hacks which you tried to fix it over the years (good attitude). I do agree with the other users, I do see that there is a scenario where your design is okay but it's not the ultimate solution for it, you can work as hard as you can to convince people but it will not work out. Markus
