As I understand it, the Linux Security Module (LSM) framework has many hooks which are callbacks for security modules to register functions performing additional security checks before security-sensitive operations.

Most of the time, these hooks are placed before the access to an internal data structure like ``file''.

One thing that I don't understand is why there are hooks in System V IPC APIs but not in the corresponding POSIX APIs. For example, there is security_ipc_permission'' which is a hook describe in include/linux/lsm_hooks.h'' as "affecting all System V IPC operations" and several more hooks specialized for each APIs such as the message queues but no counterpart for the POSIX APIs. Manual investigation reveals that the System V hooks are not used in the POSIX functions (as expected, given the description). But in the case of POSIX message queues and System V message queues for example, while they don't have the same interface, they provide roughly the same functionality.

So my question is: what is the rationale for not putting LSM hooks in POSIX functions?

As I understand it, the Linux Security Module (LSM) framework has many hooks which are callbacks for security modules to register functions performing additional security checks before security-sensitive operations.

Most of the time, these hooks are placed before the access to an internal data structure like file.

One thing that I don't understand is why there are hooks in System V IPC APIs but not in the corresponding POSIX APIs. For example, there is security_ipc_permission which is a hook describe in include/linux/lsm_hooks.h as "affecting all System V IPC operations" and several more hooks specialized for each APIs such as the message queues but no counterpart for the POSIX APIs. Manual investigation reveals that the System V hooks are not used in the POSIX functions (as expected, given the description). But in the case of POSIX message queues and System V message queues for example, while they don't have the same interface, they provide roughly the same functionality.

So my question is: what is the rationale for not putting LSM hooks in POSIX functions?

As I understand it, the LSM framework has many hooks which are callbacks for security modules to register functions performing additional security checks before security-sensitive operations.

Most of the time, these hooks are placed before the access to an internal data structure like ``file''.

One thing that I don't understand is why there are hooks in System V IPC APIs but not in the corresponding POSIX APIs. For example, there is security_ipc_permission'' which is a hook describe in include/linux/lsm_hooks.h'' as "affecting all System V IPC operations" and several more hooks specialized for each APIs such as the message queues but no counterpart for the POSIX APIs. Manual investigation reveals that the System V hooks are not used in the POSIX functions (as expected, given the description). But in the case of POSIX message queues and System V message queues for example, while they don't have the same interface, they provide roughly the same functionality.

So my question is: what is the rationale for not putting LSM hooks in POSIX functions?

As I understand it, the Linux Security Module (LSM) framework has many hooks which are callbacks for security modules to register functions performing additional security checks before security-sensitive operations.

Most of the time, these hooks are placed before the access to an internal data structure like ``file''.

One thing that I don't understand is why there are hooks in System V IPC APIs but not in the corresponding POSIX APIs. For example, there is security_ipc_permission'' which is a hook describe in include/linux/lsm_hooks.h'' as "affecting all System V IPC operations" and several more hooks specialized for each APIs such as the message queues but no counterpart for the POSIX APIs. Manual investigation reveals that the System V hooks are not used in the POSIX functions (as expected, given the description). But in the case of POSIX message queues and System V message queues for example, while they don't have the same interface, they provide roughly the same functionality.

So my question is: what is the rationale for not putting LSM hooks in POSIX functions?