On Mon, 18 Jul 2016, John Stultz wrote: > As requested, this patch implements a task_settimerslack and > task_gettimerslack LSM hooks so that the /proc/<tid>/timerslack_ns > interface can have finer grained security policies applied to it. > > I've kept the CAP_SYS_NICE check in the timerslack_ns_write/show > functions, as hiding it in the LSM hook seems too opaque, and doesn't > seem like a widely enough adopted practice. >
I may have missed something in the earlier discussion, but why do we need new LSM hooks here vs. calling the existing set/getscheduler hooks? -- James Morris <jmor...@namei.org>
