Re: [PATCH] proc: Fix timerslack_ns CAP_SYS_NICE check when adjusting self

[John Stultz]

On Wed, Aug 10, 2016 at 1:01 PM, Arjan van de Ven <arjan@xxxxxxxxxxxxxxx> wrote:
> On 8/10/2016 12:03 PM, John Stultz wrote:
>
>> I wasn't entierly sure. I didn't think PR_SET_TIMERSLACK has a
>> security hook, but looking again I now see the top-level
>> security_task_prctl() check, so maybe not skipping it in this case
>> would be good?
>
>
> the easy fix would be to add back the ptrace check.. just either ptrace-able
> OR CAP_SYS_NICE ;)

Well, I worry that just adds more complexity to trying to understand it.
p==current OR CAP_SYS_NICE makes the most sense to me.

> then you can prove you only added new stuff as well, and have all the LSM
> from before

The LSM bits (and how consistent or inconsistent they can be) is
really the part that I have the most concern about, and I'm not sure
what the best approach would be.

thanks
-john