/* Rationale: code calling task_setscheduler, task_setioprio, and task_setnice, assumes that . if capable(cap_sys_nice), then those actions should be allowed . if not capable(cap_sys_nice), but acting on your own processes, then those actions should be allowed This is insufficient now since you can call code without suid, but yet with increased caps. So we check for increased caps on the target process.  */
static int cap_safe_nice(struct task_struct *p)
/* Rationale: code calling task_setscheduler, task_setioprio, and task_setnice, assumes that . if capable(cap_sys_nice), then those actions should be allowed . if not capable(cap_sys_nice), but acting on your own processes, then those actions should be allowed This is insufficient now since you can call code without suid, but yet with increased caps. So we check for increased caps on the target process.  */
static int cap_safe_nice(struct task_struct *p)
{
	int is_subset;
	rcu_read_lock();
	is_subset = cap_issubset(__task_cred(p)->cap_permitted,
				 current_cred()->cap_permitted);
	rcu_read_unlock();
	if (!is_subset && !capable(CAP_SYS_NICE))
		return -EPERM;
	return 0;
}