lkml.org 
[lkml]   [2021]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [RFC] /dev/ioasid uAPI proposal
From
Date
On 08.06.21 21:00, Jason Gunthorpe wrote:

> Eg I can do open() on a file and I get to keep that FD. I get to keep
> that FD even if someone later does chmod() on that file so I can't
> open it again.
>
> There are lots of examples where a one time access control check
> provides continuing access to a resource. I feel the ongoing proof is
> the rarity in Unix.. 'revoke' is an uncommon concept in Unix..

Yes, it's even possible that somebody w/ privileges opens an fd and
hands it over to somebody unprivileged (eg. via unix socket). This is
a very basic unix concept. If some (already opened) fd now suddenly
behaves differently based on the current caller, that would be a break
with traditional unix semantics.


--mtx

--
---
Hinweis: unverschlüsselte E-Mails können leicht abgehört und manipuliert
werden ! Für eine vertrauliche Kommunikation senden Sie bitte ihren
GPG/PGP-Schlüssel zu.
---
Enrico Weigelt, metux IT consult
Free software and Linux embedded engineering
info@metux.net -- +49-151-27565287

\
 
 \ /
  Last update: 2021-06-09 10:53    [W:0.278 / U:0.764 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site