.th K_invoke II 4/21/86
.sh NAME
K_invoke - invoke trusted intermediary process
.sh "MODULA SYNOPSIS"
.nh
.na
 CONST immSeid: seid;
.br
 CONST arg: seg_des;
.br
 VAR stat: K_err_num;
.br
 . . .
.br
 stat := NK_invoke(immSeid, arg);
.br
.hy
.ad
.sp
.sh "C SYNOPSIS"
.nh
.na
 seid immSeid;
.br
 seg_des arg;
.br
 int stat;
.br
 . . .
.br
 stat = K_invoke (immSeid, arg);
.br
.hy
.ad
.sh DESCRIPTION
The purpose of the K_invoke primitive is the invocation of potentially
privileged software.  The effect of this call is to replace the
existing segment map (including the executing text segment) by a new
process image.  All segments will be released except for the argument
segment specified by arg.  The new process image has only the
intermediary segment and the argument segment active (mapped in).
Arguments for use by the intermediary process may be placed in the
argument segment.  The exact format of the argument segment is
determined by the particular intermediary specified in the call.  The
argument segment may be used by the intermediary as a scratch pad as
the intermediary builds any other segments it requires.  It is the
responsibility of the newly executing program (the intermediary) to
create its own working segments.  The privileges of the process are set
to those associated with the intermediary segment.  In the PDP-11/70
implementation, the intermediary is mapped into location 0 of the
supervisor domain instruction space, and the argument segment is mapped
out.  The intermediary may perform any arbitrary function.  Thus,
applications on the KSOS Kernel may elect to create specialized
intermediaries to perform specific functions.  The only pre-defined
intermediary is the Process Bootstrapper, described next.
.sp
The Process Bootstrapper segments implement a trusted process whose
sole purpose is the creation of other, potentially trusted,
environments by replacing itself with an image from the prototype file
whose name is passed in as an argument.  The Process Bootstrapper has
the following privileges:
.nf

to set privileges

to set the effective owner

to set the security and integrity level

to realize execute permissions (i.e. use the execute 
permissions for read access attempts)

.fi
.sp
Using the parameters specified in the argument segment, the Process
Bootstrapper builds a new set of process segments conforming to the
process prototype file.  The privileges for the new environment are
obtained from the process prototype file.  If the prototype file has no
privileges associated with it, the new environment is unprivileged.  If
the prototype file specifies that it is to execute in a different
discretionary access domain, the bootstrap changes the effective user
and/or group of the process to the owner of the prototype file.  The
new trusted process is then set into execution by the Process
Bootstrapper.  Note that a completely trusted path exists from the
K_invoke call, through process construction, to the execution of the
trusted software.
.sp
The use of the K_invoke call is not limited to the invocation of
trusted processes.  Untrusted processes may also be executed through
the K_invoke call.  If change of discretionary access domain or
privilege is not required by the type dependent information associated
with the process prototype file, the Process Bootstrapper simply
removes all privileges prior to setting the new image into execution.
.sp
The privilege information associated with a process prototype file is
controlled by the Privilege Control Editor (PCE),
a restricted use program.
.sh EXCEPTIONS
.lp 22 15
XbLcArgSg	Bad location of argument segment.
Argument segment is not located in
proper virtual memory domain.
.lp 22 15
XbSgDes	Bad segment descriptor. Segment
descriptor of argument segment is
invalid.
.lp 22 15
XncnDo	System Resource exhaustion. Cannot
create more segments.
.lp 22 15
XnSgDes	seg_des is not a valid segment descriptor.
.lp 22 15
XnWrtArgSeg	Cannot write to argument segment.
.lp 22 15
XnoProc	System Resource exhaustion. Cannot create another process.
.lp 22 15
XsgNoAcc	No access to segment.
.lp 22 15
XshSg	Process has a shared segment, cannot
fork process.
.i0
.sh "SEE ALSO"
PCE(VIII),
PBB(VIII), K_spawn(II)
