1.\" -*- nroff -*- 2.\" 3.\" Copyright (c) 2005 Doug Rabson 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 15.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25.\" SUCH DAMAGE. 26.\" 27.\" $FreeBSD$ 28.\" 29.\" The following commands are required for all man pages. 30.Dd January 26, 2010 31.Dt GSS_EXPORT_SEC_CONTEXT 3 PRM 32.Os 33.Sh NAME 34.Nm gss_export_sec_context 35.Nd Transfer a security context to another process 36.\" This next command is for sections 2 and 3 only. 37.\" .Sh LIBRARY 38.Sh SYNOPSIS 39.In "gssapi/gssapi.h" 40.Ft OM_uint32 41.Fo gss_export_sec_context 42.Fa "OM_uint32 *minor_status" 43.Fa "gss_ctx_id_t *context_handle" 44.Fa "gss_buffer_t interprocess_token" 45.Fc 46.Sh DESCRIPTION 47Provided to support the sharing of work between multiple processes. 48This routine will typically be used by the context-acceptor, 49in an application where a single process receives incoming connection 50requests and accepts security contexts over them, 51then passes the established context to one or more other processes for 52message exchange. 53.Fn gss_export_sec_context 54deactivates the security context for the calling process and creates 55an interprocess token which, 56when passed to 57.Fn gss_import_sec_context 58in another process, 59will re-activate the context in the second process. 60Only a single instantiation of a given context may be active at any 61one time; 62a subsequent attempt by a context exporter to access the exported security context will fail. 63.Pp 64The implementation may constrain the set of processes by which the 65interprocess token may be imported, 66either as a function of local security policy, 67or as a result of implementation decisions. 68For example, 69some implementations may constrain contexts to be passed only between 70processes that run under the same account, 71or which are part of the same process group. 72.Pp 73The interprocess token may contain security-sensitive information 74(for example cryptographic keys). 75While mechanisms are encouraged to either avoid placing such sensitive 76information within interprocess tokens, 77or to encrypt the token before returning it to the application, 78in a typical object-library GSS-API implementation this may not be 79possible. 80Thus the application must take care to protect the interprocess token, 81and ensure that any process to which the token is transferred is 82trustworthy. 83.Pp 84If creation of the interprocess token is successful, 85the implementation shall deallocate all process-wide resources 86associated with the security context, 87and set the context_handle to 88.Dv GSS_C_NO_CONTEXT . 89In the event of an error that makes it impossible to complete the 90export of the security context, 91the implementation must not return an interprocess token, 92and should strive to leave the security context referenced by the 93.Fa context_handle 94parameter untouched. 95If this is impossible, 96it is permissible for the implementation to delete the security 97context, 98providing it also sets the 99.Fa context_handle 100parameter to 101.Dv GSS_C_NO_CONTEXT . 102.Sh PARAMETERS 103.Bl -tag -width ".It interprocess_token" 104.It minor_status 105Mechanism specific status code. 106.It context_handle 107Context handle identifying the context to transfer. 108.It interprocess_token 109Token to be transferred to target process. 110Storage associated with this token must be freed by the application 111after use with a call to 112.Fn gss_release_buffer . 113.El 114.Sh RETURN VALUES 115.Bl -tag -width ".It GSS_S_CONTEXT_EXPIRED" 116.It GSS_S_COMPLETE 117Successful completion 118.It GSS_S_CONTEXT_EXPIRED 119The context has expired 120.It GSS_S_NO_CONTEXT 121The context was invalid 122.It GSS_S_UNAVAILABLE 123The operation is not supported 124.El 125.Sh SEE ALSO 126.Xr gss_import_sec_context 3 , 127.Xr gss_release_buffer 3 128.Sh STANDARDS 129.Bl -tag -width ".It RFC 2743" 130.It RFC 2743 131Generic Security Service Application Program Interface Version 2, Update 1 132.It RFC 2744 133Generic Security Service API Version 2 : C-bindings 134.El 135.Sh HISTORY 136The 137.Nm 138function first appeared in 139.Fx 7.0 . 140.Sh AUTHORS 141John Wray, Iris Associates 142.Sh COPYRIGHT 143Copyright (C) The Internet Society (2000). All Rights Reserved. 144.Pp 145This document and translations of it may be copied and furnished to 146others, and derivative works that comment on or otherwise explain it 147or assist in its implementation may be prepared, copied, published 148and distributed, in whole or in part, without restriction of any 149kind, provided that the above copyright notice and this paragraph are 150included on all such copies and derivative works. However, this 151document itself may not be modified in any way, such as by removing 152the copyright notice or references to the Internet Society or other 153Internet organizations, except as needed for the purpose of 154developing Internet standards in which case the procedures for 155copyrights defined in the Internet Standards process must be 156followed, or as required to translate it into languages other than 157English. 158.Pp 159The limited permissions granted above are perpetual and will not be 160revoked by the Internet Society or its successors or assigns. 161.Pp 162This document and the information contained herein is provided on an 163"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING 164TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 165BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION 166HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF 167MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 168