Date: Tue, 14 Dec 2021 22:02:17 GMT From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: e28767f0e175 - main - Thread creation privilege for realtime group Message-ID: <202112142202.1BEM2Hkk023786@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=e28767f0e17550d8ed030cff0918202e5de101ab commit e28767f0e17550d8ed030cff0918202e5de101ab Author: Florian Walpen <dev@submerge.ch> AuthorDate: 2021-12-14 21:55:51 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2021-12-14 22:01:58 +0000 Thread creation privilege for realtime group With the mac_priority(4) realtime policy active, users and processes in the realtime group may promote existing threads and processes to realtime scheduling priority. Extend the privileges granted to PRIV_SCHED_SETPOLICY which allows explicit creation of new realtime threads. One use case of this is when the pthread scheduling policy is set to SCHED_RR or SCHED_FIFO via pthread_attr_setschedpolicy(...) before calling pthread_create(...). I ran into this when testing audio software with realtime threads, particularly audio/ardour6. MFC after: 1 week Differential revision: https://reviews.freebsd.org/D33393 --- share/man/man4/mac_priority.4 | 15 +++++++++------ sys/security/mac_priority/mac_priority.c | 4 ++-- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/share/man/man4/mac_priority.4 b/share/man/man4/mac_priority.4 index 6dfb937d1596..868d027d5233 100644 --- a/share/man/man4/mac_priority.4 +++ b/share/man/man4/mac_priority.4 @@ -21,7 +21,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd December 7, 2021 +.Dd December 14, 2021 .Dt MAC_PRIORITY 4 .Os .Sh NAME @@ -79,13 +79,16 @@ priority through the .Xr rtprio 2 system calls. .Ss Privileges Granted -The kernel privileges granted to any process running -with the corresponding group gid is: -.Bl -tag -width ".Dv PRIV_SCHED_RTPRIO" -offset indent +The realtime policy grants the following kernel privileges to any process +running with the realtime group id: +.Bl -inset -offset indent -compact .It Dv PRIV_SCHED_RTPRIO -If it is a member of the realtime group. +.It Dv PRIV_SCHED_SETPOLICY +.El +.Pp +The kernel privilege granted by the idletime policy is: +.Bl -inset -offset indent -compact .It Dv PRIV_SCHED_IDPRIO -If it is a member of the idletime group. .El .Ss Runtime Configuration The following diff --git a/sys/security/mac_priority/mac_priority.c b/sys/security/mac_priority/mac_priority.c index 5c4db72ca657..f460e5195cb9 100644 --- a/sys/security/mac_priority/mac_priority.c +++ b/sys/security/mac_priority/mac_priority.c @@ -64,8 +64,8 @@ SYSCTL_INT(_security_mac_priority, OID_AUTO, idletime_gid, CTLFLAG_RWTUN, static int priority_priv_grant(struct ucred *cred, int priv) { - if (priv == PRIV_SCHED_RTPRIO && realtime_enabled && - groupmember(realtime_gid, cred)) + if ((priv == PRIV_SCHED_RTPRIO || priv == PRIV_SCHED_SETPOLICY) && + realtime_enabled && groupmember(realtime_gid, cred)) return (0); if (priv == PRIV_SCHED_IDPRIO && idletime_enabled &&
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202112142202.1BEM2Hkk023786>