From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S261185AbVAGCgt (ORCPT ); Thu, 6 Jan 2005 21:36:49 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S261162AbVAGCgt (ORCPT ); Thu, 6 Jan 2005 21:36:49 -0500 Received: from viper.oldcity.dca.net ([216.158.38.4]:59557 "HELO viper.oldcity.dca.net") by vger.kernel.org with SMTP id S261185AbVAGCgc (ORCPT ); Thu, 6 Jan 2005 21:36:32 -0500 Subject: Re: [PATCH] [request for inclusion] Realtime LSM From: Lee Revell To: Matt Mackall Cc: Alan Cox , Andreas Steinmetz , Linux Kernel Mailing List , Andrew Morton , Ingo Molnar , "Jack O'Quin" In-Reply-To: <20050107011820.GC2995@waste.org> References: <1104374603.9732.32.camel@krustophenia.net> <20050103140359.GA19976@infradead.org> <1104862614.8255.1.camel@krustophenia.net> <20050104182010.GA15254@infradead.org> <1104865034.8346.4.camel@krustophenia.net> <41DB4476.8080400@domdv.de> <1104898693.24187.162.camel@localhost.localdomain> <20050107011820.GC2995@waste.org> Content-Type: text/plain Date: Thu, 06 Jan 2005 21:36:30 -0500 Message-Id: <1105065390.16117.4.camel@krustophenia.net> Mime-Version: 1.0 X-Mailer: Evolution 2.0.3 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 2005-01-06 at 17:18 -0800, Matt Mackall wrote: > Why can't this be done with a simple SUID helper to promote given > tasks to RT with sched_setschedule, doing essentially all the checks > this LSM is doing? > > Objections of "because it requires dangerous root or suid" don't fly, > an RT app under user control can DoS the box trivially. Never mind you > need root to configure the LSM anyway.. Yes but a bug in an app running as root can trash the filesystem. The worst you can do with RT privileges is lock up the machine. Lee