On Tue, 2005-11-29 at 15:17 +0100, Pierre THIERRY wrote: > Scribit Jonathan S. Shapiro dies 18/10/2005 hora 15:58: > > In principle, we could do something similar for capabilities that > > travel from one user to another -- any time a capability crosses this > > boundary it's wrapper is replaced. This replacement is implemented by > > a reference monitor. > > How does the system knows you cross the boundary? If a process belonging > to a different user gets the capability, how does anyone know it is in > fact a different user?
Remember that in this scenario the only paths between users go through a reference monitor. The reference monitor performs the substitution. shap _______________________________________________ L4-hurd mailing list [email protected] http://lists.gnu.org/mailman/listinfo/l4-hurd
