Landlock System Five Message Queue Control

📧 Review thread | 🐞 Bug

Idea: LANDLOCK_SCOPE_SYSV_MSG_QUEUE as a scoped bit restricts the use of SystemV message queues

Notes on the SystemV message queue mechanism

• msqid live in a IPC-namespace-wide registry and can be used by any process if the file-like permission bits allow it based on UID and GID
  • A msqid is not a file descriptor - any process guessing the right msqid can try to use it
• 💡 SystemV message queues have a key squatting problem:
  • Before the queue is created, another process can create a queue with the same key by predicting the key and creating it. Many programs with fall for it and use that queue, because they create the queue on demand and don’t check properly who owns it.
  • Without Landlock, if process permissions are determined purely based on UID and GID, processes can protect against key squatting by using msgctl() with IPC_STAT and checking the CUID and CGID in struct ipc_perm (creator UID and GID)
  • Both the key and the msqid can be predicted:
    • Keys are often static. ftok(3) returns a key that might be guessable as well.
    • Msqids can be listed with a msgctl(2) call or from proc, as implemented in the ipcs tool.

Overview