Re: documentation vs specification

On Mon, 2011-10-03 at 12:58 -0700, Russ Allbery wrote:
> Both I think miss the PAG concept that AFS has.  While the additional
> granularity between processes with the same UID is not a security measure,
> it is very convenient when one wants to take on multiple identities while
> doing different things and be sure that one doesn't accidentally get the
> wrong one.

Actually, the inheritance model of linux keyrings is farily close to
what you usually want.  Note that OpenAFS has been using keyrings to
track PAGs for some time.  The main flaw is that Linux doesn't provide
the user with good enough tools to manage keyring contents and doesn't
make it easy to fork a session with respect to one kind of key but not
another.