Re: cap exchange race with map/unmap

[Jonathan S. Shapiro]

On Tue, 2005-10-18 at 23:14 +0200, Espen Skoglund wrote:
> [Jonathan S Shapiro]
> > In the absence of any authority to fabricate new capabilities, the
> > following chain of mappings is now in effect after the exchange:
> 
> >       RevCopy                RevCopy
> >    A ----------> CapServer -----------> B
> 
> > If process A now exits, all of its capabilities are revoked. In
> > consequence the Cap held by CapServer is revoked. In consequence the
> > Cap held by B is revoked.
> 
> > Can somebody explain what authority or feature in the system design
> > gives the CapServer sufficient power that it can create a capability
> > that does not depend on A's continued existence?
> 
> If CapServer can identify that it posesses an identical capability it
> can map this capability to B.

How does CapServer obtain this capability if it is not the original
creator of the object?