Re: 'native files', 'object fingerprints' [was: sendpath()]

[Pavel Machek]

Hi!

> 	struct safe_kpointer {
> 		void *kaddr;
> 		unsigned long fingerprint[4];
> 	};
> 
> the kernel can validate kaddr by 1) validating the pointer via the master
> fingerprint (every valid kernel pointer must point to a structure that
> starts with the master fingerprint's copy). Then usage-permissions are
> validated by checking the file fingerprint (the per-object fingerprint).
> 
> this is a safe, very fast [ O(1) ] object-permission model. (it's a
> variation of a former idea of yours.) A process can pass object
> fingerprints and kernel pointers to other processes too - thus the other
> process can access the object too. Threads will 'naturally' share objects,
> because fingerprints are typically stored in memory.

I do not know if I'd trust this.

First, 

(fd < current->fdlimit && current->fdlist[fd])

if O(1), too. Sure, passing those is slightly hard, but we can do that already.
With your proposal, all hopes for fuser and revoke are out.

Ouch; you say process can pass it to other process. How will kernel know not
to free fd until _both_ freed it?

Plus, you are playing tricks with random numbers. Up to now, only ssh and 
similar depended on random numbers. Now kernel relies on them during boot.
Notice that most important "master fingerprint" is generated first. At that
timeyou might not have enough entropy in your pools.
								Pavel

-- 
Philips Velo 1: 1"x4"x8", 300gram, 60, 12MB, 40bogomips, linux, mutt,
details at http://atrey.karlin.mff.cuni.cz/~pavel/velo/index.html.