On Wed, Nov 15, 2017 at 2:05 PM, Peter Zijlstra <peterz@xxxxxxxxxxxxx> wrote: > On Thu, Oct 26, 2017 at 04:07:48PM +0200, Martijn Coenen wrote: >> Allows a binder node to specify whether it wants to >> inherit real-time scheduling policy from a caller. This >> inheritance may not always be desirable, for example in >> cases where the binder call runs untrusted and therefore >> potentially unbounded code. > > Isn't that backwards? That is, binder should enforce not inheriting > across a trust boundary, not let a node opt out voluntary. That's a good point. In practice on Android, nodes are constructed with the default policy of "don't inherit", and we have an internal API (not available to untrusted code) to change it. That said, somebody could talk directly to the kernel driver and present a node with the flag set. I'll look into this. That said, I think we want this change regardless of enforcing across the trust boundary; that is, we don't want to inherit by default even if the callee is trusted. In Android O, all of the framework runs with binder PI disabled; it's mostly the HALs serving latency-critical data that need it. _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
