From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752090AbcGTGOT (ORCPT ); Wed, 20 Jul 2016 02:14:19 -0400 Received: from [65.99.196.166] ([65.99.196.166]:43899 "EHLO namei.org" rhost-flags-FAIL-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1751213AbcGTGOS (ORCPT ); Wed, 20 Jul 2016 02:14:18 -0400 Date: Wed, 20 Jul 2016 16:12:51 +1000 (AEST) From: James Morris To: John Stultz cc: lkml , Kees Cook , "Serge E. Hallyn" , Andrew Morton , Thomas Gleixner , Arjan van de Ven , Oren Laadan , Ruchi Kandoi , Rom Lemarchand , Todd Kjos , Colin Cross , Nick Kralevich , Dmitry Shmidt , Elliott Hughes , Android Kernel Team , linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov Subject: Re: [RFC][PATCH 2/2 v3] security: Add task_settimerslack/task_gettimerslack LSM hook In-Reply-To: <1468872671-9002-2-git-send-email-john.stultz@linaro.org> Message-ID: References: <1468872671-9002-1-git-send-email-john.stultz@linaro.org> <1468872671-9002-2-git-send-email-john.stultz@linaro.org> User-Agent: Alpine 2.20 (LRH 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 18 Jul 2016, John Stultz wrote: > As requested, this patch implements a task_settimerslack and > task_gettimerslack LSM hooks so that the /proc//timerslack_ns > interface can have finer grained security policies applied to it. > > I've kept the CAP_SYS_NICE check in the timerslack_ns_write/show > functions, as hiding it in the LSM hook seems too opaque, and doesn't > seem like a widely enough adopted practice. > I may have missed something in the earlier discussion, but why do we need new LSM hooks here vs. calling the existing set/getscheduler hooks? -- James Morris