Re: [RFC][PATCH 2/2 v3] security: Add task_settimerslack/task_gettimerslack LSM hook

[James Morris]

On Mon, 18 Jul 2016, John Stultz wrote:

> As requested, this patch implements a task_settimerslack and
> task_gettimerslack LSM hooks so that the /proc/<tid>/timerslack_ns
> interface can have finer grained security policies applied to it.
> 
> I've kept the CAP_SYS_NICE check in the timerslack_ns_write/show
> functions, as hiding it in the LSM hook seems too opaque, and doesn't
> seem like a widely enough adopted practice.
> 

I may have missed something in the earlier discussion, but why do we need 
new LSM hooks here vs. calling the existing set/getscheduler hooks?


-- 
James Morris
<jmorris@xxxxxxxxx>