[OpenAFS-devel] Re: [PATCH] in-core AFS multiplexor and PAG support

[Neulinger, Nathan]

> > > Also, using a separate PAG structure means that you can=20
> lend your keys to
> > > an SUID program and conversely it means a SUID program=20
> can't so easily
> > > gain access to keys it didn't inherit from its caller.
> >=20
> > "task->user" always follows uid ("real uid"), and as such=20
> you can always
> > switch back and forth by just changing uid.
>=20
> So anyone who has the ability to get root on a box can=20
> immediately use other
> peoples keys with su... OTOH, the ability to get root would=20
> normally permit
> someone sufficiently motivated to get this anyway.

This isn't any good since it implies that a given uid can only have a
single set of tokens. Users can freely authenticate to afs and get
tokens for other afs ids at any time. As long as they are in different
pags, they can freely coexist. Now, if you're talking about pag-less
only, then the above is reasonable and expected.=20

-- Nathan