Date: Mon, 6 Jan 1997 15:11:56 -0700 (MST) From: Terry Lambert <terry@lambert.org> To: dennis@etinc.com (dennis) Cc: avalon@coombs.anu.edu.au, hackers@freebsd.org Subject: Re: file locking / firewalling based on uid/gid Message-ID: <199701062211.PAA12748@phaeton.artisoft.com> In-Reply-To: <3.0.32.19970105125150.00687428@etinc.com> from "dennis" at Jan 5, 97 12:51:52 pm
next in thread | previous in thread | raw e-mail | index | archive | help
> >(To me, filtering based on UID implies you're doing things at a higher > > level than normal packet filtering and should be a separate beast rather > > than coming up with kludges to extend ipfw. Heck, there are many more > > and different checks you can make, for a start...). > > I agree. It seems that firewalling and "authentication" are getting > entwined... > which is not a "bad" thing as long as there is no penalty to pay by one or > the other. We've recently combined our bandwidth management, queue > prioritization and filtering functons, but made it a single-pass function to > eliminate the performance penalty. We must seperate credential instances from process group instances and attach them to session instances instead. Each credential for a given machine can have only a single session instance, with a potential of N process group instances sharing a pointer to the session instance. A setuid/setgid operation would establish a new session instance (if a session for the new credential were not present on the system) and decrement the reference count for the previous credential. When the reference count gose to 0, the session is destroyed. We need session instanced to implement "password caches" for non-BSD originated credentials associated with an identity instanced by a session. For instance, for use in NetWare or SMB file systems. We have the potential for "auto" session management, with a session manager registration mechanism for a given process group, to allow for credential query by the kernel if a mechanism for a covert channel to the user exists (ie: ask for the user's SMB password using an X-based dialog for a process group running under XDM, etc.). Regards, Terry Lambert terry@lambert.org --- Any opinions in this posting are my own and not those of my present or previous employers.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199701062211.PAA12748>