In this lesson, you will learn how to use Mandatory Access Control (MAC) systems like SELinux to restrict how processes communicate through Inter-Process Communication (IPC) channels.
Understanding IPC Security
In Linux, processes often exchange data using Unix sockets or shared memory regions. While Discretionary Access Control (DAC) relies on standard file permissions, it is often insufficient for complex applications because if a process is compromised, the attacker inherits those permissions. Mandatory Access Control allows us to enforce strict "need-to-know" policies that govern which specific process domains are allowed to talk to each other, regardless of who owns the process.
Restricting Unix Sockets and Shared Memory
Unix sockets appear in the filesystem, but they function as communication gateways. Under MAC, we don't just check if a user can read a file; we check if a process with a specific security context (e.g., httpd_t) is authorized to connect to a socket created by another context (e.g., db_t).
Similarly, shared memory segments are memory regions accessed via keys. By applying a security label to these IPC objects, the kernel LSM (Linux Security Module) verifies that the calling process possesses the specific permission to unix_stream_connect or shm_associate.
For example, in an SELinux policy, you might define a rule to block unauthorized inter-domain chatter:
# Allow the web server to connect to a specific database socket
allow httpd_t db_socket_t:unix_stream_socket { connectto };
# Deny everything else by default
neverallow unconfined_t db_socket_t:unix_stream_socket { connectto };
Why it Matters
By locking down IPC, you prevent "lateral movement." If an attacker manages to exploit a service, MAC ensures they cannot simply attach to the shared memory of a sensitive neighboring process to steal credentials or inject malicious data. Even if the process has the right filesystem permissions, the kernel will block the IPC request because the security labels do not allow that specific cross-domain interaction.
Key Takeaway: Mandatory Access Control secures IPC by enforcing label-based communication policies, ensuring processes can only exchange data with authorized partners regardless of standard file permissions.