On Wed, Aug 10, 2016 at 1:01 PM, Arjan van de Ven <ar...@linux.intel.com> wrote: > On 8/10/2016 12:03 PM, John Stultz wrote: > >> I wasn't entierly sure. I didn't think PR_SET_TIMERSLACK has a >> security hook, but looking again I now see the top-level >> security_task_prctl() check, so maybe not skipping it in this case >> would be good? > > > the easy fix would be to add back the ptrace check.. just either ptrace-able > OR CAP_SYS_NICE ;)
Well, I worry that just adds more complexity to trying to understand it. p==current OR CAP_SYS_NICE makes the most sense to me. > then you can prove you only added new stuff as well, and have all the LSM > from before The LSM bits (and how consistent or inconsistent they can be) is really the part that I have the most concern about, and I'm not sure what the best approach would be. thanks -john
