Messages in this thread | | | Date | Tue, 6 Apr 2004 11:48:03 -0700 (PDT) | From | Sergiy Lozovsky <> | Subject | Re: kernel stack challenge |
| |
--- John Stoffel <stoffel@lucent.com> wrote: > >>>>> "Sergiy" == Sergiy Lozovsky > <serge_lozovsky@yahoo.com> writes: > > >> Policy has no place inside the kernel. > > Sergiy> Root privileges (ability to send a signal to > any process, > Sergiy> access any file and so on) are encoded in > the kernel. > > But that does not require a LISP interpreter in the > kernel either. > And you are also mistaking policy with a capability. > Who has root is > a policy, what root can do is a capability. They > are seperate issues.
UID is stored in a task structure in the kernel as well as what to do with it. With VXE both policy and capability are in a file (out of the kernel), though there is an option to preload it into the kernel before execution of particular system starts.
> Sergiy> So all interaction with the kernel goes via > VM. Investing > Sergiy> some time into carefull parameter check in > VM allows to avoid > Sergiy> the same work for each new application. > > You have not given us a simple example of how this > VM would be used in > the kernel and what it provides. I think that would > help people > understand why you think this is so needed.
I though I did. Here is a link to the site with detailed description of the system. It works since 1999. - http://vxe.quercitron.com
It's not an example - it's working system.
There was an article in LinuxFocus - it's less technical and more compact - http://jamesthornton.com/linux/LinuxFocus/English/January2000/article133.shtml
Serge.
__________________________________ Do you Yahoo!? Yahoo! Small Business $15K Web Design Giveaway http://promotions.yahoo.com/design_giveaway/ - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |