From mboxrd@z Thu Jan  1 00:00:00 1970
Message-ID: <547E3A1A.7000902@gr13.net>
Date: Tue,  2 Dec 2014 23:15:54 +0100
From: "Enrico Weigelt, metux IT consult" <enrico.weigelt@gr13.net>
User-Agent: Mozilla/5.0 (X11; Linux i686;
	rv:31.0) Gecko/20100101 Thunderbird/31.2.0
MIME-Version: 1.0
To: 9fans@9fans.net
References: <8859357829938d06bd512e70b6e23590@hamnavoe.com>
In-Reply-To: <8859357829938d06bd512e70b6e23590@hamnavoe.com>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Subject: Re: [9fans] Factotum vs SASL
Topicbox-Message-UUID: 32752b32-ead9-11e9-9d60-3106f5b1d025

On 02.12.2014 10:50, Richard Miller wrote:

> For this sort of functionality the computer needs to be running as
> a plan 9 cpu server, not a terminal in which by definition hostowner
> controls everything.
>
> Somewhere in /contrib there is a patch which makes a few changes to
> the cpu kernel to allow a login on the console by a user different
> from hostowner, who then becomes termowner with permissions over
> some but not all of the local hardware (eg keyboard and mouse but
> not disk).  It's not hard to do.

Okay, that seems to go in the direction, I'm looking for.

To get the traditional unix behaviour, we'd also need some virtual
terminal multiplexer (which allows switching between VTs with
different sessions), supporting multiple framebuffers/GPUs,
keyboards, etc (eg. multiseat environments) - just giving the
logged-in users only these virtual devices. Shouldn't be that
hard to implement.

Anyways, for now I'm not so much focused on doing that on real
Plan9 system, instead using its concepts/tools (9P, factotum, ...)
on a GNU/Linux system.

> But it's only pretend security if the user has physical access
> to the machine.

Of course, you could still replace the disks, etc .. but that's
an entirely different area.

> The "plan 9 way" is to keep the cpu server in a locked box and
> get another computer to be a terminal.  A raspberry pi doesn't
> cost much.

Well, not very suited for mobile purposes (notebook, etc) :P


cu
--
Enrico Weigelt,
metux IT consulting
+49-151-27565287