Why are there no LSM hooks in the POSIX IPC APIs?
2
votes
1
answer
434
views
As I understand it, the Linux Security Module (LSM) framework has many hooks which are callbacks for security modules to register functions performing additional security checks before security-sensitive operations.
Most of the time, these hooks are placed before the access to an internal data structure like `
file
`.
One thing that I don't understand is why there are hooks in System V IPC APIs but not in the corresponding POSIX APIs. For example, there is `security_ipc_permission
which is a hook describe in
include/linux/lsm_hooks.h
` as "affecting all System V IPC operations" and several more hooks specialized for each APIs such as the message queues but no counterpart for the POSIX APIs. Manual investigation reveals that the System V hooks are not used in the POSIX functions (as expected, given the description). But in the case of POSIX message queues and System V message queues for example, while they don't have the same interface, they provide roughly the same functionality.
So my question is: what is the rationale for not putting LSM hooks in POSIX functions?
Asked by lgeorget
(14352 rep)
Jan 20, 2016, 10:23 AM
Last activity: Mar 28, 2017, 12:55 PM
Last activity: Mar 28, 2017, 12:55 PM