lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH] block: Check ADMIN before NICE for IOPRIO_CLASS_RT
    On Mon, Nov 15, 2021 at 10:04 AM Jens Axboe <axboe@kernel.dk> wrote:
    >
    > On 11/15/21 10:38 AM, Alistair Delva wrote:
    > > Booting to Android userspace on 5.14 or newer triggers the following
    > > SELinux denial:
    > >
    > > avc: denied { sys_nice } for comm="init" capability=23
    > > scontext=u:r:init:s0 tcontext=u:r:init:s0 tclass=capability
    > > permissive=0
    > >
    > > Init is PID 0 running as root, so it already has CAP_SYS_ADMIN. For
    > > better compatibility with older SEPolicy, check ADMIN before NICE.
    >
    > Seems a bit wonky to me, but the end result is the same.

    No argument from me..

    > In any case,
    > this warrants a comment above it detailing why the ordering is
    > seemingly important.

    Sent v2.

    > --
    > Jens Axboe
    >

    \
     
     \ /
      Last update: 2021-11-16 02:11    [W:2.726 / U:0.152 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site