On 5/25/06, Bas Wijnen <[EMAIL PROTECTED]> wrote:
On Wed, May 24, 2006 at 11:55:40AM +0200, Pierre THIERRY wrote:
> > > Am I wrong on anything here? > > You seemed to be forgetting that without a constructor, we can still > > have an "identify" operation. > > I don't see how your proposal enables a process to check anything > accurately and in a tamperproof way about it's environment. In your > model, it is mandatory for a process to trust all of it's parents. > > In the ping or competition case, that's not possible. It is. The parent space bank is the user session, which is not under user control.
In your proposal the user can choose to run the program in opaque storage. But the administrator cannot choose to set up a program that can be run only in opaque storage to ensure its integrity (much like suid programs on unix). Thanks Michal
_______________________________________________ L4-hurd mailing list [email protected] http://lists.gnu.org/mailman/listinfo/l4-hurd
