Re: Ports and privileges

[tqbf () secnet com]

> A very easy way to do this is to make portalfs better and have them use
> sockets acquired in that manner.

You can already do this without portalfs using credential passing; there
was some momentum at OpenBSD for writing a "privileged port" daemon that
would accept descriptors from processes and fstat() them to find out who
the client was, and then pass back (if the client was authorized) a
descriptor for an open bound privileged port (or even a port that had
completed an rcmd() exchange).

-----------------------------------------------------------------------------
Thomas H. Ptacek                                        Secure Networks, Inc.
-----------------------------------------------------------------------------
http://www.enteract.com/~tqbf                           "mmm... sacrilicious"