Sample Header Ad - 728x90

Why are there no LSM hooks in the POSIX IPC APIs?

2 votes
1 answer
434 views
As I understand it, the Linux Security Module (LSM) framework has many hooks which are callbacks for security modules to register functions performing additional security checks before security-sensitive operations. Most of the time, these hooks are placed before the access to an internal data structure like `file`. One thing that I don't understand is why there are hooks in System V IPC APIs but not in the corresponding POSIX APIs. For example, there is `security_ipc_permission which is a hook describe in include/linux/lsm_hooks.h` as "affecting all System V IPC operations" and several more hooks specialized for each APIs such as the message queues but no counterpart for the POSIX APIs. Manual investigation reveals that the System V hooks are not used in the POSIX functions (as expected, given the description). But in the case of POSIX message queues and System V message queues for example, while they don't have the same interface, they provide roughly the same functionality. So my question is: what is the rationale for not putting LSM hooks in POSIX functions?
Asked by lgeorget (14352 rep)
Jan 20, 2016, 10:23 AM
Last activity: Mar 28, 2017, 12:55 PM