"You could create these sockets on demand - one for each security context. On linux typically a different security contexts will either have different UIDs - in

"You could create these sockets on demand - one for each security context. On linux typically a different security contexts will either have different UIDs - in which case filesystem permissions would be sufficient - or they have different mount namespaces - in which case you make different sockets visible in different namespaces." This is reminiscent of how Trusted Solaris[0] implements Mandatory Access Control (MAC) a la Orange Book[1]. [0] https://www.oracle.com/technetwork/server-storage/solaris10/overview/ds-ts8-150124.pdf https://www.oracle.com/technetwork/server-storage/solaris10/... [1] https://public.milcyber.org/activities/magazine/articles/2021/renda-the-orange-book https://public.milcyber.org/activities/magazine/articles/202...