lkml.org 
[lkml]   [2008]   [Aug]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectAccess to credentials of a process from another?
From
Date
I looked with some interest the big credentials patch.

I have a desire to do following in user space

- have PID of another process

- want to check some aspect of credentials of this process from
another process (for example, currently whether the other process
has a specific group in its context).

In current Ubuntu release, to achieve this, I had to patch kernel
sys.c and write own kernel module which offered the API for this
function.

I notice that credentials (http://lwn.net/Articles/287091/) document
has some wording about accessing credentials from another
process. What is not clear yet (in document),

- is this possible from loadable module (e.g. are the required
symbols exported)?

- are there any plans to define some API for a user space application
to access this information?

I assume that in some cases, like Unix socket, the peers should
have same direct vay of reading each others credentials blobs from the
socket?

However, for example, in case of DBus this is murky, as the server and
client do not have direct connection to each other, and DBus would
need to pass some information. Currently, with some work, it is
possible for DBus server to get the clients PID. Thus, a function in
user space to get the credentials by PID would be sufficient.

Also, it is not acceptable to say that DBus should use it's "root"
powers and fake clients credentials on forwarded messages.

- First, not all DBus are root,

- second, server might want to see both credentials (DBus servers and
the originating client).

Finally, I don't like any text based /proc file solutions, for example
parsing output of "/proc/<pid>/status" is horrible (especially was not
option for me, because it does not give all groups anyway).


\
 
 \ /
  Last update: 2008-08-08 10:49    [W:0.039 / U:0.160 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site