ubuntu - Linux, store credentials with process and it's children, grandchildren? -

i'm working on little side project on linux(ubuntu) require 1 authenticated access service. idea authentication should stored process , it's children, , not linux user itself.

this authentication should done calling example "myapplogin" username, password , script/application(any application) run these credentials. want possible retain these credentials in children made process, , grandchildren , on.

i have looked @ few options capability.

1. store login id or in environment variables. is, far know, passed on children. however, environment variables can written process, allowing possibly gain access should not have.

2. when logging in, store process id of process logged in, , on every operation service, check if has stored pid, or if anywhere in it's ancestry stored pid exists. possibly become slow if ancestry grows large, , if service accessed often. option cache pid in ancestry, can have security implications pid reuse in os.

3. using process groups , link login, can changed process itself, allowing possibly join existing group without logging in.

is there way this? preferably should stored process, new children inherits, not possible process overwrite, , readable externally kernel module.

maybe i'm overlooking obvious? grateful input on =)

i can provide 2 methods depends on kinds of "services" mentioned:

1.if services mentioned like: network management, disk mounting/umounting, etc. following:

the linux kernel implements capability mechanism. kernel has defined various capabilities. these capabilities can assigned different users. , basic rule of capability is: assign minimum set of privilege 1 user accomplish mission.

so can use capability idea, need is:

(1) list services need limit access.

(2) define new capabilities or use existing capabilities listed services.

(3) change kernel source codes check capabilities of 1 process when access services listed. usually, these checks located in system call entries.

(4) make changes init/login processes' source codes, when user login system, assign necessary capabilities different users according access control rules.

2.if services mentioned executing kind of system commands.

(1) create file such watch_dog or else under /etc/ directory, in file, can define format list specific users can execute specific commands. of course, file format can fancy, such regular expression can used. parse file, bison or lex/yacc can used.

(2) during linux kernel initialization, file /etc/watch_dog can parsed.

(3) during process fork(), set /etc/watch_dog rules process related task_struct.

(4) in exec() entry, apply /etc/watch_dog rules check whether can execute program or not.