On Wed, Aug 17, 2016 at 2:21 PM, Paul Moore <paul@xxxxxxxxxxxxxx> wrote: > On Thu, Jul 21, 2016 at 4:24 PM, John Stultz <john.stultz@xxxxxxxxxx> wrote: >> As requested, this patch checks the existing LSM hooks >> task_getscheduler/task_setscheduler when reading or modifying >> the task's timerslack value. >> >> Previous versions added new get/settimerslack LSM hooks, but >> since they checked the same PROCESS__SET/GETSCHED values as >> existing hooks, it was suggested we just use the existing ones. >> >> Cc: Kees Cook <keescook@xxxxxxxxxxxx> >> Cc: "Serge E. Hallyn" <serge@xxxxxxxxxx> >> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> >> Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx> >> CC: Arjan van de Ven <arjan@xxxxxxxxxxxxxxx> >> Cc: Oren Laadan <orenl@xxxxxxxxxxx> >> Cc: Ruchi Kandoi <kandoiruchi@xxxxxxxxxx> >> Cc: Rom Lemarchand <romlem@xxxxxxxxxxx> >> Cc: Todd Kjos <tkjos@xxxxxxxxxx> >> Cc: Colin Cross <ccross@xxxxxxxxxxx> >> Cc: Nick Kralevich <nnk@xxxxxxxxxx> >> Cc: Dmitry Shmidt <dimitrysh@xxxxxxxxxx> >> Cc: Elliott Hughes <enh@xxxxxxxxxx> >> Cc: James Morris <jmorris@xxxxxxxxx> >> Cc: Android Kernel Team <kernel-team@xxxxxxxxxxx> >> Cc: linux-security-module@xxxxxxxxxxxxxxx >> Cc: selinux@xxxxxxxxxxxxx >> Signed-off-by: John Stultz <john.stultz@xxxxxxxxxx> >> --- >> v2: >> * Initial swing at adding settimerslack LSM hook >> v3: >> * Fix current/p switchup bug noted by NickK >> * Add gettimerslack hook suggested by NickK >> v4: >> * Dropped adding get/settimerslack LSM hooks, and >> just reuse the get/setscheduler ones. >> >> fs/proc/base.c | 10 ++++++++++ >> 1 file changed, 10 insertions(+) > > For some reason I'm having a hard time finding patch 1/2 in the > patchset, but this patch looks reasonable to me. We already have some https://lkml.org/lkml/2016/7/21/522 > LSM checking via the ptrace_may_access() call, but this adds some > additional granularity which could be a good thing. > > Acked-by: Paul Moore <paul@xxxxxxxxxxxxxx> Thanks. There's also this follow-on patch (and discussion thread) that adds a fix to the 1/2 patch linked above. https://lkml.org/lkml/2016/8/9/876 thanks -john _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
