Thank you all for so many solutions. I want to control some IPC object (shm, msg queue, semphore) can be accessed by which named user or named group just like file objects ACL do. I studied the solution you all referred, The SELinux is powerful but may be somewhat complicated. And I am confused with Christoph Hellwig‘s solution using tmpfs. 2010/1/21 Christoph Hellwig <hch@xxxxxxxxxxxxx>: > On Wed, Jan 20, 2010 at 07:02:27PM -0800, Casey Schaufler wrote: >> zhou peng wrote: >> > Hi all, >> > >> > There are ACL in file system, but why there are no ACL implementation >> > in IPC object, eg. shm, message queue, FIFO? >> > >> >> Most people haven't noticed that IPC objects are even there, much less >> that they have mode bits and not ACLs. Even when we were doing security >> evaluations on Unix boxes in the 1990's they were considered insufficiently >> interesting to justify the additional work to do ACLs. >> >> If you really want ACLs on IPC objects it would make a dandy little >> project for a summer. I would be happy to review patches. Thanks. It's interesting to add ACL over IPC objects. I want to have a try. > > Or use the posix IPC mechanisms. The Posix shared memory has ACL by > using tmpfs as the backing store, and we could add similar support to > Posix messages queues as they are also backed by a normal filesystem. Christoph Hellwig, This way may be convinent. Could you give some detailed message. :) I only find /proc/ipc/shm file which contain the info of shm objs,and tmpfs on /dev/shm which is empty. > > Adding this support to the old SYSV IPC mechanisms would be much harder > as they do not fit into the file backed model we use everywhere else at > all. Just like file objects, the mode bits are implment over IPC objects without file backed, so I think adding ACL support to IPC objects may be somewhat reasonable :) > > -- zhoupeng -- To unsubscribe from this list: send the line "unsubscribe linux-next" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
