Re: suidpid( UID, credential? ) ? secure IPC? (fwd)

Jim Doyle (jrd@bu.edu)
Mon, 6 Oct 1997 13:38:17 -0400 (EDT)


Date: Mon, 6 Oct 1997 13:36:23 -0400 (EDT)
From: Jim Doyle <jrd@bu.edu>
To: "Theodore Y. Ts'o" <tytso@MIT.EDU>
Subject: Re: suidpid( UID, credential? ) ? secure IPC?

On Mon, 6 Oct 1997, Theodore Y. Ts'o wrote:

> Instead of a suidpid() call, a more general, and much more interesting
> mechanism to think about creating would be a "protected shared library"
> mechanism.
>

All of this suidpid() stuff scares me.

> This allows you to do all sorts of very interesting things all in
> userspace, without needing extra special-purpose system calls and
> without requiring an IPC mechanism. It does require a kernel
> context-switch to enter and leave a PSL, but if it's done properly, that
> should be the only overhead.

Mainframe's (i.e. IBM MVS, OS/390, et. al.) have a special facility for
performance cross-address space procedure calls. You can think of them
as Local Procedure Calls (as opposed to Remote procedure calls which involve
a network transport, marshalling data into host-neutral form, etc).

MVS programmers have been using this facility for decades to isolate
highly privileged, or extrememly important code, from other address spaces.
The facility is there for good reason... Why not go study it, or talk
to you nearby MVS guru - and try to implement such a facility in Linux.

Mach also has a nice facility for doing this kind of thing.. If you want
to bear the expense of moving typed data around.

Mainframes also have some other nice things that Unix desperately needs...
Like Durable Queues (essentially SysV message queues that are ACID
consistent and persist across reboots). I've been finding it a chore to
write business-grade applications on Unix without things like cross-address
space calls, durable queues, etc. Generally, one has to resort to an
Overkill solution like local-host RPCs and bloated things like Tuxedo
or (god-forbid) Encina.

-- Jim

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Jim Doyle Boston University Information Technology
Systems Analyst/Programmer email: jrd@bu.edu Distributed Systems
tel. (617)-353-8248
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++--+-+-+-+-+-+-