Method and apparatus for creating a security environment for a user task in a client/server system

Claim 2

In a server system in which a daemon process listens for a request from a user to execute a specified user task, said request specifying an identity for said user, said system having an operating system kernel, a method for executing said task on behalf of said user with an appropriate security environment for said user, comprising the steps of: (a) having said daemon process, upon receiving said request from said user: (1) set an environment variable in accordance with said identity specified in said request; and (2) issue a system call to said operating system kernel to execute said specified user task in a new address space; and (b) having said operating system kernel, upon receiving said system call from said daemon process: (1) create a new address space for said specified user task; (2) create a security environment for said specified user task in accordance with said environment variable; and (3) start said specified user task in said new address space.

Claim 3

The method of claim 1 in which said operating system kernel is a POSIX-compliant operating system kernel.

Claim 4

The method of claim 1 in which said system call is a spawn() system call.

Claim 5

The method of claim 1 in which said user has a user name, said identity comprising said user name.

Claim 6

The method of claim 4 in which said environment variable is set equal to said user name.

Claim 7

The method of claim 5 in which said new address space and said user name each have a user ID associated therewith, said step (b)(2) of creating said security environment comprising the step of: setting the user ID of said new address space equal to the user ID of the user name specified by said environment variable.

Claim 8

The method of claim 6 in which the user ID of said user name is determined by accessing a security database.

Claim 9

The method of claim 5 in which said new address space and said user name each have a group ID associated therewith, said step (b)(2) of creating said security environment comprising the step of: setting the group ID of said new address space equal to the group ID of the user name specified by said environment variable.

Claim 10

In a server system in which a daemon process listens for a request from a user to execute a specified user task, said request specifying an identity for said user, said system having an operating system kernel, apparatus for executing said task on behalf of said user with an appropriate security environment for said user, comprising: (a) means associated with said daemon process, responsive to receiving said request from said user, for: (1) setting an environment variable in accordance with said identity specified in said request; and (2) issuing a system call to said operating system kernel to execute said specified user task in a new address space; and (b) means associated with said operating system kernel, responsive to receiving said system call from said daemon process, for: (1) creating a new address space for said specified user task; (2) creating a security environment for said specified user task in accordance with said environment variable; and (3) starting said specified user task in said new address space.

Claim 11

In a server system in which a daemon process listens for a request from a user to execute a specified user task, said request specifying an identity for said user, said system having an operating system kernel, apparatus for executing said task on behalf of said user with an appropriate security environment for said user, comprising: (a) means associated with said daemon process, responsive to receiving said request from said user, for: (1) setting an environment variable in accordance with said identity specified in said request; and (2) issuing a system call to said operating system kernel to execute said specified user task in a new address space; and (b) means associated with said operating system kernel, responsive to receiving said system call from said daemon process, for: (1) creating a new address space for said specified user task; (2) creating a security environment for said specified user task in accordance with said environment variable; and (3) starting said specified user task in said new address space.

Claim 12

The apparatus of claim 9 in which said operating system kernel is a POSIX-compliant operating system kernel.

Claim 13

The apparatus of claim 9 in which said system call is a spawn() system call.

Claim 14

The apparatus of claim 9 in which said user has a user name, said identity comprising said user name.

Claim 15

The apparatus of claim 12 in which said environment variable is set equal to said user name.

Claim 16

The apparatus of claim 13 in which said new address space and said user name each have a user ID associated therewith, said means (b)(2) for creating said security environment comprising: means for setting the user ID of said new address space equal to the user ID of the user name specified by said environment variable.

Claim 17

The apparatus of claim 14 in which the user ID of said user name is determined by accessing a security database.

Claim 18

The apparatus of claim 13 in which said new address space and said user name each have a group ID associated therewith, said step (b)(2) of creating said security environment comprising the step of: setting the group ID of said new address space equal to the group ID of the user name specified by said environment variable.

Claim 19

A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for executing a task on behalf of a user with an appropriate security environment for said user in a server system in which a daemon process listens for a request from a user to execute a specified user task, said request specifying an identity for said user, said system having an operating system kernel, said method steps comprising: (a) having said daemon process, upon receiving said request from said user: (1) set an environment variable in accordance with said identity specified in said request; and (2) issue a system call to said operating system kernel to execute said specified user task in a new address space; and (b) having said operating system kernel, upon receiving said system call from said daemon process: (1) create a new address space for said specified user task; (2) create a security environment for said specified user task in accordance with said environment variable; and (3) start said specified user task in said new address space.

Claim 20

A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for executing a task on behalf of a user with an appropriate security environment for said user in a server system in which a daemon process listens for a request from a user to execute a specified user task, said request specifying an identity for said user, said system having an operating system kernel, said method steps comprising: (a) having said daemon process, upon receiving said request from said user: (1) set an environment variable in accordance with said identity specified in said request; and (2) issue a system call to said operating system kernel to execute said specified user task in a new address space; and (b) having said operating system kernel, upon receiving said system call from said daemon process: (1) create a new address space for said specified user task; (2) create a security environment for said specified user task in accordance with said environment variable; and (3) start said specified user task in said new address space.

Claim 21

The program storage device of claim 17 in which said operating system kernel is a POSIX-compliant operating system kernel.

Claim 22

The program storage device of claim 17 in which said system call is a spawn() system call.

Claim 23

The program storage device of claim 17 in which said user has a user ID, said identity comprising said user ID.

Claim 24

The program storage device of claim 20 in which said environment variable is set equal to said user ID.

Claim 25

The program storage device of claim 21 in which said new address space and said user name each have a user ID associated therewith, said step (b)(2) of creating said security environment comprising the step of: setting the user ID of said new address space equal to the user ID of the user name specified by said environment variable.

Claim 26

The program storage device of claim 22 in which the user ID of said user name is determined by accessing a security database.

Claim 27

The program storage device of claim 21 in which said new address space and said user name each have a group ID associated therewith, said step (b)(2) of creating said security environment comprising the step of: setting the group ID of said new address space equal to the group ID of the user name specified by said environment variable.