Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1444545

Re: [RFC][PATCH 1/2 v2] proc: Relax /proc/<tid>/timerslack_ns capability requirements

Show all headers | View raw

On Fri, Jul 15, 2016 at 12:55 PM, Nick Kralevich <nnk@google.com> wrote:
> On Fri, Jul 15, 2016 at 10:24 AM, John Stultz <john.stultz@linaro.org> wrote:
>> +       if (!capable(CAP_SYS_NICE))
>> +               return -EPERM;
>> +
>>         p = get_proc_task(inode);
>>         if (!p)
>>                 return -ESRCH;
>
> The capable(CAP_SYS_NICE) permission check should be moved to this
> point, since it doesn't make sense to return EPERM if the task
> structure doesn't exist.

Ok. Will move it.

>> @@ -2300,22 +2300,21 @@ static int timerslack_ns_show(struct seq_file *m, void *v)
>>  {
>>         struct inode *inode = m->private;
>>         struct task_struct *p;
>> -       int err =  0;
>> +
>> +       if (!capable(CAP_SYS_NICE))
>> +               return -EPERM;
>
> This should also have a similar LSM check for reads. For the SELinux
> implementation, this can map to the PROCESS__GETSCHED permission.

Ok. I'll wire that in as well.

Would adding both selinux_task_get and set methods in the same patch
be ok? Or would folks prefer they be split into two?

Thanks for the feedback!
-john

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC][PATCH 1/2 v2] proc: Relax /proc/<tid>/timerslack_ns capability requirements John Stultz <john.stultz@linaro.org> - 2016-07-15 19:30 +0200
  Re: [RFC][PATCH 1/2 v2] proc: Relax /proc/<tid>/timerslack_ns  capability requirements Nick Kralevich <nnk@google.com> - 2016-07-15 20:00 +0200
    Re: [RFC][PATCH 1/2 v2] proc: Relax /proc/<tid>/timerslack_ns  capability requirements John Stultz <john.stultz@linaro.org> - 2016-07-15 20:50 +0200
      Re: [RFC][PATCH 1/2 v2] proc: Relax /proc/<tid>/timerslack_ns  capability requirements Kees Cook <keescook@chromium.org> - 2016-07-15 21:00 +0200
        Re: [RFC][PATCH 1/2 v2] proc: Relax /proc/<tid>/timerslack_ns  capability requirements Casey Schaufler <casey@schaufler-ca.com> - 2016-07-15 22:20 +0200
  Re: [RFC][PATCH 1/2 v2] proc: Relax /proc/<tid>/timerslack_ns  capability requirements Nick Kralevich <nnk@google.com> - 2016-07-15 22:00 +0200
    Re: [RFC][PATCH 1/2 v2] proc: Relax /proc/<tid>/timerslack_ns  capability requirements John Stultz <john.stultz@linaro.org> - 2016-07-15 22:10 +0200
      Re: [RFC][PATCH 1/2 v2] proc: Relax /proc/<tid>/timerslack_ns  capability requirements Nick Kralevich <nnk@google.com> - 2016-07-15 22:30 +0200

csiph-web