lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 24 Aug 2020 18:51:53 -0500 From: "Serge E. Hallyn" <serge@...lyn.com> To: Khazhismel Kumykov <khazhy@...gle.com> Cc: Jens Axboe <axboe@...nel.dk>, Serge Hallyn <serge@...lyn.com>, Paolo Valente <paolo.valente@...aro.org>, Bart Van Assche <bvanassche@....org>, linux-block@...r.kernel.org, linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org Subject: Re: [PATCH v2] block: grant IOPRIO_CLASS_RT to CAP_SYS_NICE On Mon, Aug 24, 2020 at 03:10:34PM -0700, Khazhismel Kumykov wrote: > CAP_SYS_ADMIN is too broad, and ionice fits into CAP_SYS_NICE's grouping. > > Retain CAP_SYS_ADMIN permission for backwards compatibility. > > Signed-off-by: Khazhismel Kumykov <khazhy@...gle.com> Acked-by: Serge Hallyn <serge@...lyn.com> > --- > block/ioprio.c | 2 +- > include/uapi/linux/capability.h | 2 ++ > 2 files changed, 3 insertions(+), 1 deletion(-) > > v2: fix embarrassing logic mistake > diff --git a/block/ioprio.c b/block/ioprio.c > index 77bcab11dce5..276496246fe9 100644 > --- a/block/ioprio.c > +++ b/block/ioprio.c > @@ -69,7 +69,7 @@ int ioprio_check_cap(int ioprio) > > switch (class) { > case IOPRIO_CLASS_RT: > - if (!capable(CAP_SYS_ADMIN)) > + if (!capable(CAP_SYS_NICE) && !capable(CAP_SYS_ADMIN)) > return -EPERM; > /* fall through */ > /* rt has prio field too */ > diff --git a/include/uapi/linux/capability.h b/include/uapi/linux/capability.h > index 395dd0df8d08..c6ca33034147 100644 > --- a/include/uapi/linux/capability.h > +++ b/include/uapi/linux/capability.h > @@ -288,6 +288,8 @@ struct vfs_ns_cap_data { > processes and setting the scheduling algorithm used by another > process. */ > /* Allow setting cpu affinity on other processes */ > +/* Allow setting realtime ioprio class */ > +/* Allow setting ioprio class on other processes */ > > #define CAP_SYS_NICE 23 > > -- > 2.28.0.297.g1956fa8f8d-goog
Powered by blists - more mailing lists