Re: [PATCH 2/2] proc: Add /proc/<pid>/timerslack_ns interface

[Kees Cook]

On Thu, Jul 14, 2016 at 10:49 AM, Serge E. Hallyn <serge@xxxxxxxxxx> wrote:
> Kees, you said adding a capability is hard - can you expound on that?

Best I can find at the moment was discussion around CAP_COMPROMISE_KERNEL:
http://thread.gmane.org/gmane.linux.kernel/1459165

Basically, adding a new capability for an interface can create
userspace compatibility problems (though perhaps in this case, it's a
new interface, so a new capability would be okay, but it's such a
narrow use-case and CAP_SYS_NICE fits fine).

-Kees

-- 
Kees Cook
Chrome OS & Brillo Security