Channel-based mandatory access controls

A method to enforce mandatory access control in a message-based operating system, the method comprising:

• identifying a first process configured to receive a message via a communication channel in the message-based operation system, wherein calls to operating system logic are passed as messages over communication channels in the message-based operating system;
• identifying the communication channel;
• identifying, based on a channel policy, an access rule governing access to the communication channel;
• and
• controlling, in a kernel of a message-based operating system, the access to the communication channel by a second process based on the access rule, the second process configured to execute invocation logic, the invocation logic executable to send the message via the communication channel.

A computer readable medium comprising instructions executable by a processor, the instructions comprising:

• instructions executable to identify a first process configured to receive a message via a communication channel in a message-based operation system, wherein calls to operating system logic are passed as messages over communication channels in the message-based operating system;
• instructions executable to identify the communication channel;
• instructions executable to identify, based on a channel policy, an access rule governing access to the communication channel;
• and
• instructions executable to control, in a kernel of a message-based operating system, the access to the communication channel by a second process based on the access rule, the second process configured to execute invocation logic, the invocation logic executable to send the message via the communication channel.