[9fans] possible way to have the secstore on the cpu server

[nigel@9fs.org]

It seems possible to store the secstore on the cpu server, without the
files being accessible to someone (other than bootes).

The attacker cannot open anything in '#'S as it is owned by bootes.  I
had assumed before that '#'S is generally readable, but it's only
group/user readable.  The service created by kfs is other r/w, so
obviously kfs would be a bad choice.  But, /srv/dos is accessible by
user only, so a small dos filesystem would appear to be unmountable by
anyone other than bootes.

The dossrv would have to be noswap and private, which given the amount
of memory it consumes might be the biggest impediment.

I realise that a separate auth server with no cpu service is
intrinsically more secure, but does the above have any fatal flaws?