Messages in this thread | | | From | Alistair Delva <> | Date | Mon, 15 Nov 2021 10:17:30 -0800 | Subject | Re: [PATCH] block: Check ADMIN before NICE for IOPRIO_CLASS_RT |
| |
On Mon, Nov 15, 2021 at 10:04 AM Jens Axboe <axboe@kernel.dk> wrote: > > On 11/15/21 10:38 AM, Alistair Delva wrote: > > Booting to Android userspace on 5.14 or newer triggers the following > > SELinux denial: > > > > avc: denied { sys_nice } for comm="init" capability=23 > > scontext=u:r:init:s0 tcontext=u:r:init:s0 tclass=capability > > permissive=0 > > > > Init is PID 0 running as root, so it already has CAP_SYS_ADMIN. For > > better compatibility with older SEPolicy, check ADMIN before NICE. > > Seems a bit wonky to me, but the end result is the same.
No argument from me..
> In any case, > this warrants a comment above it detailing why the ordering is > seemingly important.
Sent v2.
> -- > Jens Axboe >
| |