On Apr 20, 10:58pm, Bill Studenmund wrote:
} On Fri, 4 Jan 2002, John Nemeth wrote:
} > On Apr 16,  6:01am, Todd Vierling wrote:
} > }
} > } Perhaps the question should be rephrased as, "do we *need* the ability for
} > } init to have external auth methods, and so forth?"  If not, then init can
} > } stay static without pain.
} >
} >      In order to answer that question, you need to ask when and why
} > does init need to be able to authenticate people.  The answer is that
} > it asks for the root password when entering single user mode on an
} > insecure console.  This is usually done immediately after boot.  At
} > this point in time, there is normally no networking (with the possible
} > exception of diskless boots), and there are no other processes
} > running.  This means that you can't access distributed password
} > databases on other systems and there won't be any server processes for
} > local NIS/NIS+/LDAP/Hesiod/etc. databases.  In other words,
} > realistically, at the point in time when init wants to do
} > authentication, the only method available will be local file.
} 
} I agree that distributed options won't be available right after boot, but
} that doesn't mean that module-based authenticators won't work. :-) I'm
} thinking of a card-based authenticator, like I think smartcard type
} things (where you type in a pin and the number from the card).

     Don't these sorts of things often have their own daemons (i.e.
will they work without any processes besides init running and without
any kind of initialisation)?

} While I agree the need for such things won't be common, the places where
} they will be needed will probably have a hard requirement. So if we can,
} being able to add modules to an otherwise static init would be nice.

     Personally, I would like to see option 2 (static programs being
able to use dlopen()).  That sounds like the most complete and correct
solution to me.  And, it would certainly solve this problem (i.e. init
would be statically linked, but it could pull in an authentication
module if really needed).  It also makes the system recovery problem go
away.  However, I expect based on what I have seen so far, we'll be
going to full dynamic linking.

}-- End of excerpt from Bill Studenmund