porting CCAPI to UNIX

[Chaskiel M Grundman]

--On Wednesday, May 09, 2007 03:33:56 PM -0400 Ken Raeburn 
<raeburn at mit.edu> wrote:

> On May 9, 2007, at 15:31, Russ Allbery wrote:
>> AFS PAGs provide cross-session process isolation (well, not from
>> root, but
>> that's a different matter).  I was actually under the impression that
>> keyrings did as well.
>
> Not when I tried running some keyring tests.

Modulo a race condition, it should be possible, but it requires setting 
non-default permissions on the keyring and the key.

Keys have four sets of permission bits: In addition to the usual owner, 
group, and other, there are bits granted to 'possessors' of a key, that is, 
processes which have this key in (or as) one of their keyrings.

If the owner bits (but not the possessor bits) of a session keyring are 
cleared, then other processes with that uid will not be able to join the 
keyring. if the owner bits (but not the possessor bits) of the key are 
cleared, then other processes with that uid will not be able to access the 
key. The race comes from the fact that you cannot set the permission bits 
of a keyring when you create it, so an evil process can join the keyring 
before the owner access bits are cleared.