On 8/1/2018 2:04 PM, David Howells wrote: > How about if I apply the attached patch? It creates a new LSM hook that gets > called each time a notification is about to be posted on a queue. It is given > the creds from the /dev/watch_queue opener, the creds of whoever triggered the > watchpoint and a pointer to the notification message. > > The notification message includes metadata describing the source/type of the > message and the subtype within that, plus subtype-specific flags. This looks like it will solve the problem for security modules. I still think there should be some sort of default controls. The idea that the default is that anyone can listen for everyone's events, and there's no way to control it does not sit well. You could implement that as a security module with the one hook that does UID based controls, but I don't see a lot of advantages to doing it that way. At the least a process should be able to hide the events it would generate from everyone. Better would be to have a specification (e.g. mod bits, an ACL) for who should receive them.
