On Wed, 20 Jul 2016, John Stultz wrote: > On Tue, Jul 19, 2016 at 11:12 PM, James Morris <jmor...@namei.org> wrote: > > On Mon, 18 Jul 2016, John Stultz wrote: > > > >> As requested, this patch implements a task_settimerslack and > >> task_gettimerslack LSM hooks so that the /proc/<tid>/timerslack_ns > >> interface can have finer grained security policies applied to it. > >> > >> I've kept the CAP_SYS_NICE check in the timerslack_ns_write/show > >> functions, as hiding it in the LSM hook seems too opaque, and doesn't > >> seem like a widely enough adopted practice. > >> > > > > I may have missed something in the earlier discussion, but why do we need > > new LSM hooks here vs. calling the existing set/getscheduler hooks? > > Mostly since adding a new hook was suggested originally. I don't think > there's much difference as it stands, but I guess more fine grained > checks could be added on the slack amounts, etc. > > I can rework it, so let me know if using the existing hooks would be > preferred, but otherwise I'll be sending out the non-rfc patches > tomorrow.
I'd prefer to re-use the existing hooks, unless there is a specific need for the extra granularity. -- James Morris <jmor...@namei.org>
