Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1447628

Re: [RFC][PATCH 2/2 v3] security: Add task_settimerslack/task_gettimerslack LSM hook

Show all headers | View raw

On Tue, Jul 19, 2016 at 11:12 PM, James Morris <jmorris@namei.org> wrote:
> On Mon, 18 Jul 2016, John Stultz wrote:
>
>> As requested, this patch implements a task_settimerslack and
>> task_gettimerslack LSM hooks so that the /proc/<tid>/timerslack_ns
>> interface can have finer grained security policies applied to it.
>>
>> I've kept the CAP_SYS_NICE check in the timerslack_ns_write/show
>> functions, as hiding it in the LSM hook seems too opaque, and doesn't
>> seem like a widely enough adopted practice.
>>
>
> I may have missed something in the earlier discussion, but why do we need
> new LSM hooks here vs. calling the existing set/getscheduler hooks?

Mostly since adding a new hook was suggested originally. I don't think
there's much difference as it stands, but I guess more fine grained
checks could be added on the slack amounts, etc.

I can rework it, so let me know if using the existing hooks would be
preferred, but otherwise I'll be sending out the non-rfc patches
tomorrow.

thanks
-john

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC][PATCH 1/2 v3] proc: Relax /proc/<tid>/timerslack_ns capability requirements John Stultz <john.stultz@linaro.org> - 2016-07-18 22:20 +0200
  [RFC][PATCH 2/2 v3] security: Add task_settimerslack/task_gettimerslack LSM hook John Stultz <john.stultz@linaro.org> - 2016-07-18 22:20 +0200
    Re: [RFC][PATCH 2/2 v3] security: Add  task_settimerslack/task_gettimerslack LSM hook "Serge E. Hallyn" <serge@hallyn.com> - 2016-07-18 22:30 +0200
    Re: [RFC][PATCH 2/2 v3] security: Add task_settimerslack/task_gettimerslack  LSM hook Kees Cook <keescook@chromium.org> - 2016-07-18 22:50 +0200
    Re: [RFC][PATCH 2/2 v3] security: Add task_settimerslack/task_gettimerslack  LSM hook James Morris <jmorris@namei.org> - 2016-07-20 08:20 +0200
      Re: [RFC][PATCH 2/2 v3] security: Add task_settimerslack/task_gettimerslack  LSM hook John Stultz <john.stultz@linaro.org> - 2016-07-21 08:00 +0200
        Re: [RFC][PATCH 2/2 v3] security: Add task_settimerslack/task_gettimerslack  LSM hook James Morris <jmorris@namei.org> - 2016-07-21 13:50 +0200
  Re: [RFC][PATCH 1/2 v3] proc: Relax /proc/<tid>/timerslack_ns  capability requirements "Serge E. Hallyn" <serge@hallyn.com> - 2016-07-18 22:30 +0200
  Re: [RFC][PATCH 1/2 v3] proc: Relax /proc/<tid>/timerslack_ns  capability requirements Kees Cook <keescook@chromium.org> - 2016-07-18 22:50 +0200

csiph-web