[PATCH v2 0/6] landlock: Add scoped access bit for SysV message queues

[Günther Noack]

On Mon, Aug 24, 2026 at 08:47:28AM -0400, Justin Suess wrote:
> On Mon, Aug 24, 2026 at 08:36:10AM +0200, Günther Noack wrote:
> > Agreed.  I am personally leaning on the side of closing the gap as
> > well, even if it reduces functionality somewhat.  SystemV Message
> > Queues are used very seldomly (as can be seen in Debian Code Search)
> > and it would affect few programs.
> >
> From msgget(2):
> 
>        A new message queue is created if key has the value IPC_PRIVATE or
>        key isn't IPC_PRIVATE, no message queue with the given key key
>        exists, and IPC_CREAT is specified in msgflg.
> 
> So more specifically, we will disallow if all three of these are true:
> 
> - IPC_CREAT is specified
> - IPC_PRIVATE is not specified.
> - The queue referenced by key does not already exist
> 
> Or if these two are true:
> 
> - The queue referenced by key already exists.
> - The queue referenced by the key is not part of the scope.
> 
> Effectively, this allows as much as possible, including msgget(2) on an
> existing queue within a scope.

We technically allow msgget(2) on an existing queue within a scope,
but if I understand this correctly, there is now no way to *create* such a
queue within the scope.  So effectively, that msgget(2) can not
succeed, no?


I agree with your sentiment that we don't need to implement the
allow-listing approach right now.  It seems like significant effort for
a very small number of use cases.

—Günther