Date: Sun, 19 Dec 2021 02:44:38 GMT From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 10b999149239 - stable/13 - Thread creation privilege for realtime group Message-ID: <202112190244.1BJ2icGQ012811@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/13 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=10b99914923936fcf244af720c2ad8fc4b395378 commit 10b99914923936fcf244af720c2ad8fc4b395378 Author: Florian Walpen <dev@submerge.ch> AuthorDate: 2021-12-14 21:55:51 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2021-12-19 02:42:52 +0000 Thread creation privilege for realtime group (cherry picked from commit e28767f0e17550d8ed030cff0918202e5de101ab) --- share/man/man4/mac_priority.4 | 15 +++++++++------ sys/security/mac_priority/mac_priority.c | 4 ++-- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/share/man/man4/mac_priority.4 b/share/man/man4/mac_priority.4 index 6dfb937d1596..868d027d5233 100644 --- a/share/man/man4/mac_priority.4 +++ b/share/man/man4/mac_priority.4 @@ -21,7 +21,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd December 7, 2021 +.Dd December 14, 2021 .Dt MAC_PRIORITY 4 .Os .Sh NAME @@ -79,13 +79,16 @@ priority through the .Xr rtprio 2 system calls. .Ss Privileges Granted -The kernel privileges granted to any process running -with the corresponding group gid is: -.Bl -tag -width ".Dv PRIV_SCHED_RTPRIO" -offset indent +The realtime policy grants the following kernel privileges to any process +running with the realtime group id: +.Bl -inset -offset indent -compact .It Dv PRIV_SCHED_RTPRIO -If it is a member of the realtime group. +.It Dv PRIV_SCHED_SETPOLICY +.El +.Pp +The kernel privilege granted by the idletime policy is: +.Bl -inset -offset indent -compact .It Dv PRIV_SCHED_IDPRIO -If it is a member of the idletime group. .El .Ss Runtime Configuration The following diff --git a/sys/security/mac_priority/mac_priority.c b/sys/security/mac_priority/mac_priority.c index 5c4db72ca657..f460e5195cb9 100644 --- a/sys/security/mac_priority/mac_priority.c +++ b/sys/security/mac_priority/mac_priority.c @@ -64,8 +64,8 @@ SYSCTL_INT(_security_mac_priority, OID_AUTO, idletime_gid, CTLFLAG_RWTUN, static int priority_priv_grant(struct ucred *cred, int priv) { - if (priv == PRIV_SCHED_RTPRIO && realtime_enabled && - groupmember(realtime_gid, cred)) + if ((priv == PRIV_SCHED_RTPRIO || priv == PRIV_SCHED_SETPOLICY) && + realtime_enabled && groupmember(realtime_gid, cred)) return (0); if (priv == PRIV_SCHED_IDPRIO && idletime_enabled &&
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202112190244.1BJ2icGQ012811>