Hi Alan,
sorry I thought I had cc:d you, bc I was pretty sure you'd have some
neat ideas. Like this one.
One could try to argue that this makes every linux process susceptible
to a trojan making it grant its userid to other tasks, but of course
that's silly since the trojan could just fork. Well, what this would
buy the attacker is the ability to sit inconspicuously under his old
userid, holding on to the fd until the admin goes out to coffee before
switching userids.
The other thing is that offhand I think the server can't easily tell
from the socket which user namespace the client is in, as ucred only
has .uid. Though (1) we might need to create a 'struct puser' analogous
to 'struct pid' for signals anyway, (2) userspace can segragate with
fs or net_ns (if abstract sock), and (3) client in a container
presumably won't be able to authenticate itself to server on the
host anyway.
Ashwin (and Ron), I think this idea will give us the same tools that
the p9auth driver does, perhaps in a more unix-y way. Would you have
objections, or do you see shortcomings?
Thanks, Alan.
-serge
--
