[OpenAFS-devel] Unprotected PAGs

[Alexander Boström]

ons 2005-09-21 klockan 12:04 -0700 skrev Russ Allbery: 

> Could you make this an afsd startup option?  There's an open bug in Debian
> that would be at least partially addressed by letting people run AFS in
> this mode (someone asking for a way to escape PAGs), but compile-time
> options are a real pain for distributions.  We can't really ship multiple
> versions built with different options easily.

The patch does add a runtime option, but see the next paragraph for a
better way to escape PAGs. An afsd option would be better, but libafs
has already been loaded and the setgroups wrapper installed when afsd is
started, so that would make things a bit more complicated. Doable and
less Linux-specific though.

Anyway, while I still wouldn't mind having the above option, I see now
that it would probably be a better idea to add an AFSCALL_UNSETPAG that
returns the process to the default PAG. Only root should be allowed to
do that. This should be portable across different operating systems,
hopefully including any future in-kernel keyring based PAG
implementations.

/abo