[9fans] Re: First-timer help

[Dave Eckhardt <davide+p9@cs.cmu.edu>]

> I then ran "auth/changeuser john" and tried to set my password,
> but I got a "permission denied" error.  Help?

My apologies for the vague answer, but: every time I've run
auth/changeuser (running as bootes on my auth/fossil/venti file
server) I've got a "permission denied" error which appears to be
harmless, since the accounts are created and people can log in.
I haven't chased it down beyond that.

> And why do you have to reboot in order to change users?
> UNIX has had that from the beginning, and I don't see any
> reason to drop it.

Plan 9 was designed around a particular distributed system
architecture (see the "Plan 9 From Bell Labs" paper at
http://cm.bell-labs.com/sys/doc/index.html).  There are
basically three kinds of machine:

* critical infrastructure, such as authorization and reliable file
  storage, which define identity and trust for the multi-user
  computing environment--these are typically accessible by only
  trusted system administrators and located in physically secure
  environmentally-controlled locations,

* shared "CPU servers", whose configuration, policies, and hardware
  are owned by the system administrators, but which can be used
  in a restricted fashion by multiple users simultaneously,

* public-access "terminals", which will allow any user to boot
  them running any code--think of a standard PC, where whoever
  sticks a floppy into the drive can do anything they wish.

Other models are possible.  For example, Amoeba was designed
for "processor pools", racks of CPU servers each one of which
was used by one user at a time.

In order to have multiple users running on a public-access
terminal, you have to define what you would mean by that,
which isn't easy.  Who should own a particular serial line
or USB port?  If Alice boots a kernel she just wrote, should
Bob trust it to keep his password secret?  Should Bob be able
to reboot the machine to use a different kernel if Alice is
running some long computation?

These questions are architecturally answered for Plan 9 file
servers (nobody logs in), and CPU servers (people can log in,
but not reboot, modify configuration, or control hardware).
The answer for terminals is "one person owns the machine at
a time and can do anything to it".  Rebooting is a simple
way to ensure that *everything* on the machine belongs to
one user at a time.

Dave Eckhardt