On Tue, Jul 19, 2016 at 11:12 PM, James Morris <jmorris@xxxxxxxxx> wrote: > On Mon, 18 Jul 2016, John Stultz wrote: > >> As requested, this patch implements a task_settimerslack and >> task_gettimerslack LSM hooks so that the /proc/<tid>/timerslack_ns >> interface can have finer grained security policies applied to it. >> >> I've kept the CAP_SYS_NICE check in the timerslack_ns_write/show >> functions, as hiding it in the LSM hook seems too opaque, and doesn't >> seem like a widely enough adopted practice. >> > > I may have missed something in the earlier discussion, but why do we need > new LSM hooks here vs. calling the existing set/getscheduler hooks? Mostly since adding a new hook was suggested originally. I don't think there's much difference as it stands, but I guess more fine grained checks could be added on the slack amounts, etc. I can rework it, so let me know if using the existing hooks would be preferred, but otherwise I'll be sending out the non-rfc patches tomorrow. thanks -john _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
