From nobody Sat Dec 04 18:19:59 2021 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 510F118CB0D1; Sat, 4 Dec 2021 18:20:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4J5yf76BwKz50dP; Sat, 4 Dec 2021 18:19:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id B4B58DF0; Sat, 4 Dec 2021 18:19:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 1B4IJxqX072516; Sat, 4 Dec 2021 18:19:59 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 1B4IJx4d072515; Sat, 4 Dec 2021 18:19:59 GMT (envelope-from git) Date: Sat, 4 Dec 2021 18:19:59 GMT Message-Id: <202112041819.1B4IJx4d072515@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Konstantin Belousov Subject: git: bf2fa8d9d11c - main - MAC/priority module for realtime privilege group List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: bf2fa8d9d11c9f2ceff09bacc406876fa37096be Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1638641999; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LihjgJmrGQCJmFptzVWYejeXd/FimTc2Gsd3yvrZiwM=; b=my6q1cZEryPhcfdDk45JSAO32NKXua0RDJBsEFpvzkQHzcY3dH342DXYDCe3pAHCVHefCH G4dIanJ126Oc86Gvxfka/hTPFC2fQF1ShVuPvHW2qxf/03iF47Wcnon87T9aZGwsG9j6AQ DakCuV2SoD16oapDfkV3s8LzyHlfBIp6cC/YKm8eQUbVFzy5eUaBqlXMozGR7kv9IgHNY7 R9zR5hr4Jqpi4rxG1n5hAD5kgmxyeaPfdoz3ovKM1DZe+FaseLaH7JzMc4FOJvER3pZXDY S4amWXNk9Lraz3RNhBNMHIErcXXUbI5AvZEKw1xU1QiamZ2KYYLAdq8Xjny8tA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1638641999; a=rsa-sha256; cv=none; b=Cl7pKoO791NuLmyxaqNN/BRP0xQxzEUd1s+Su3IeeUK6zNIiQ1M6eMDNnk5tMSolBJby0z a04nl+czyM+xhgqwRrH2YP4rSCBkAPrX4d5mHQ2KToPSy4Rv+eqa8rLiVW3x99FpD80kMn yXSs1TPHU+nNeVgD32w6w5YC1/PLIfdtao2ynVMrG81a+ZsTl5/Ij+D3dq5hwhKjwe0IP1 IjPrVko02akS2FvKkHN4rTyQ479dr/FcJFWqlQtIp6a435dZxtMDmkwotEVkjTh+Hrb89d bAHkBAoP7oBttwsZ1oj+2U/jvI1XI819ZoZSye9NhzatehSCJEWPWxaEX00VHQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=bf2fa8d9d11c9f2ceff09bacc406876fa37096be commit bf2fa8d9d11c9f2ceff09bacc406876fa37096be Author: Florian Walpen AuthorDate: 2021-12-04 16:17:29 +0000 Commit: Konstantin Belousov CommitDate: 2021-12-04 18:19:25 +0000 MAC/priority module for realtime privilege group This is a MAC policy module that grants scheduling privileges based on group membership. Users or processes in the group realtime (gid 47) are allowed to run threads and processes with realtime scheduling priority. For timing-sensitive, low-latency software like audio/jack, running with realtime priority helps to avoid stutter and gaps. PR: 239125 MFC after: 2 weeks Differential revision: https://reviews.freebsd.org/D33191 --- etc/group | 1 + lib/libc/sys/rtprio.2 | 9 ++- share/man/man4/Makefile | 1 + share/man/man4/mac_priority.4 | 103 +++++++++++++++++++++++++++++++ sys/conf/NOTES | 1 + sys/conf/files | 1 + sys/conf/options | 1 + sys/modules/Makefile | 1 + sys/modules/mac_priority/Makefile | 6 ++ sys/security/mac_priority/mac_priority.c | 68 ++++++++++++++++++++ sys/sys/conf.h | 1 + usr.sbin/rtprio/rtprio.1 | 6 +- 12 files changed, 196 insertions(+), 3 deletions(-) diff --git a/etc/group b/etc/group index 9f24beda5aea..9986f1e2ed69 100644 --- a/etc/group +++ b/etc/group @@ -18,6 +18,7 @@ smmsp:*:25: mailnull:*:26: guest:*:31: video:*:44: +realtime:*:47: bind:*:53: unbound:*:59: proxy:*:62: diff --git a/lib/libc/sys/rtprio.2 b/lib/libc/sys/rtprio.2 index 3c11d25d94bb..37a66ec79ddf 100644 --- a/lib/libc/sys/rtprio.2 +++ b/lib/libc/sys/rtprio.2 @@ -53,7 +53,7 @@ .\" .\" $FreeBSD$ .\" -.Dd December 27, 2011 +.Dd November 29, 2021 .Dt RTPRIO 2 .Os .Sh NAME @@ -169,7 +169,11 @@ was out of range. .It Bq Er EPERM The calling thread is not allowed to set the realtime priority. Only -root is allowed to change the realtime priority of any thread, and non-root +root is allowed to change the realtime priority of any thread, +exceptional privileges can be granted through the +.Xr mac_priority 4 +policy and the realtime user group. +Non-root may only change the idle priority of threads the user owns, when the .Xr sysctl 8 @@ -185,6 +189,7 @@ The specified process or thread was not found or visible. .Xr rtprio 1 , .Xr setpriority 2 , .Xr nice 3 , +.Xr mac_priority 4 , .Xr renice 8 , .Xr p_cansee 9 .Sh AUTHORS diff --git a/share/man/man4/Makefile b/share/man/man4/Makefile index 9685bf8bbe9c..dcdd2e071b2a 100644 --- a/share/man/man4/Makefile +++ b/share/man/man4/Makefile @@ -285,6 +285,7 @@ MAN= aac.4 \ mac_ntpd.4 \ mac_partition.4 \ mac_portacl.4 \ + mac_priority.4 \ mac_seeotheruids.4 \ mac_stub.4 \ mac_test.4 \ diff --git a/share/man/man4/mac_priority.4 b/share/man/man4/mac_priority.4 new file mode 100644 index 000000000000..3d9df723def9 --- /dev/null +++ b/share/man/man4/mac_priority.4 @@ -0,0 +1,103 @@ +.\" Copyright (c) 2021 Florian Walpen +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.Dd November 29, 2021 +.Dt MAC_PRIORITY 4 +.Os +.Sh NAME +.Nm mac_priority +.Nd "policy for scheduling privileges of non-root users" +.Sh SYNOPSIS +To compile the mac_priority policy into your kernel, place the following lines +in your kernel configuration file: +.Bd -ragged -offset indent +.Cd "options MAC" +.Cd "options MAC_PRIORITY" +.Ed +.Pp +Alternately, to load the mac_priority policy module at boot time, +place the following line in your kernel configuration file: +.Bd -ragged -offset indent +.Cd "options MAC" +.Ed +.Pp +and in +.Xr loader.conf 5 : +.Bd -literal -offset indent +mac_priority_load="YES" +.Ed +.Sh DESCRIPTION +The +.Nm +policy grants scheduling privileges based on +.Xr group 5 +membership. +Users or processes in the group +.Sq realtime +(gid 47) are allowed to run threads and processes with realtime scheduling +priority. +.Pp +With the +.Nm +realtime policy active, privileged users may use the +.Xr rtprio 1 +utility to start processes with realtime priority. +Privileged applications can promote threads and processes to realtime +priority through the +.Xr rtprio 2 +system calls. +.Ss Privileges Granted +The kernel privilege granted to any process running +with the configured realtime group gid is: +.Bl -inset -compact -offset indent +.It Dv PRIV_SCHED_RTPRIO +.El +.Ss Runtime Configuration +The following +.Xr sysctl 8 +MIBs are available for fine-tuning this MAC policy. +All +.Xr sysctl 8 +variables can also be set as +.Xr loader 8 +tunables in +.Xr loader.conf 5 . +.Bl -tag -width indent +.It Va security.mac.priority.realtime +Enable the realtime policy. +(Default: 1). +.It Va security.mac.priority.realtime_gid +The numeric gid of the realtime group. +(Default: 47). +.El +.Sh SEE ALSO +.Xr rtprio 1 , +.Xr rtprio 2 , +.Xr mac 4 +.Sh HISTORY +MAC first appeared in +.Fx 5.0 +and +.Nm +first appeared in +.Fx 14.0 . diff --git a/sys/conf/NOTES b/sys/conf/NOTES index c5baff1c9307..89b3fe3bb500 100644 --- a/sys/conf/NOTES +++ b/sys/conf/NOTES @@ -1243,6 +1243,7 @@ options MAC_NONE options MAC_NTPD options MAC_PARTITION options MAC_PORTACL +options MAC_PRIORITY options MAC_SEEOTHERUIDS options MAC_STUB options MAC_TEST diff --git a/sys/conf/files b/sys/conf/files index 9b3683a45d80..476437847a78 100644 --- a/sys/conf/files +++ b/sys/conf/files @@ -5082,6 +5082,7 @@ security/mac_none/mac_none.c optional mac_none security/mac_ntpd/mac_ntpd.c optional mac_ntpd security/mac_partition/mac_partition.c optional mac_partition security/mac_portacl/mac_portacl.c optional mac_portacl +security/mac_priority/mac_priority.c optional mac_priority security/mac_seeotheruids/mac_seeotheruids.c optional mac_seeotheruids security/mac_stub/mac_stub.c optional mac_stub security/mac_test/mac_test.c optional mac_test diff --git a/sys/conf/options b/sys/conf/options index faa37d5bc67d..df856e4722fd 100644 --- a/sys/conf/options +++ b/sys/conf/options @@ -164,6 +164,7 @@ MAC_NONE opt_dontuse.h MAC_NTPD opt_dontuse.h MAC_PARTITION opt_dontuse.h MAC_PORTACL opt_dontuse.h +MAC_PRIORITY opt_dontuse.h MAC_SEEOTHERUIDS opt_dontuse.h MAC_STATIC opt_mac.h MAC_STUB opt_dontuse.h diff --git a/sys/modules/Makefile b/sys/modules/Makefile index e47160040798..5fd6625bfb05 100644 --- a/sys/modules/Makefile +++ b/sys/modules/Makefile @@ -222,6 +222,7 @@ SUBDIR= \ mac_ntpd \ mac_partition \ mac_portacl \ + mac_priority \ mac_seeotheruids \ mac_stub \ mac_test \ diff --git a/sys/modules/mac_priority/Makefile b/sys/modules/mac_priority/Makefile new file mode 100644 index 000000000000..727af9d44fd9 --- /dev/null +++ b/sys/modules/mac_priority/Makefile @@ -0,0 +1,6 @@ +.PATH: ${SRCTOP}/sys/security/mac_priority + +KMOD= mac_priority +SRCS= mac_priority.c + +.include diff --git a/sys/security/mac_priority/mac_priority.c b/sys/security/mac_priority/mac_priority.c new file mode 100644 index 000000000000..faf9455aa098 --- /dev/null +++ b/sys/security/mac_priority/mac_priority.c @@ -0,0 +1,68 @@ +/*- + * SPDX-License-Identifier: BSD-2-Clause + * + * Copyright (c) 2021 Florian Walpen + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include +#include +#include +#include +#include +#include +#include + +#include + +SYSCTL_DECL(_security_mac); + +static SYSCTL_NODE(_security_mac, OID_AUTO, priority, + CTLFLAG_RW | CTLFLAG_MPSAFE, 0, + "mac_priority policy controls"); + +static int realtime_enabled = 1; +SYSCTL_INT(_security_mac_priority, OID_AUTO, realtime, CTLFLAG_RWTUN, + &realtime_enabled, 0, + "Enable realtime policy for group realtime_gid"); + +static int realtime_gid = GID_RT_PRIO; +SYSCTL_INT(_security_mac_priority, OID_AUTO, realtime_gid, CTLFLAG_RWTUN, + &realtime_gid, 0, + "Group id of the realtime privilege group"); + +static int +priority_priv_grant(struct ucred *cred, int priv) +{ + if (priv == PRIV_SCHED_RTPRIO && realtime_enabled && + groupmember(realtime_gid, cred)) + return (0); + return (EPERM); +} + +static struct mac_policy_ops priority_ops = { + .mpo_priv_grant = priority_priv_grant, +}; + +MAC_POLICY_SET(&priority_ops, mac_priority, "MAC/priority", + MPC_LOADTIME_FLAG_UNLOADOK, NULL); diff --git a/sys/sys/conf.h b/sys/sys/conf.h index 053cf6ddb016..d9301eb9584e 100644 --- a/sys/sys/conf.h +++ b/sys/sys/conf.h @@ -159,6 +159,7 @@ typedef int dumper_hdr_t(struct dumperinfo *di, struct kerneldumpheader *kdh); #define GID_BIN 7 #define GID_GAMES 13 #define GID_VIDEO 44 +#define GID_RT_PRIO 47 #define GID_DIALER 68 #define GID_NOGROUP 65533 #define GID_NOBODY 65534 diff --git a/usr.sbin/rtprio/rtprio.1 b/usr.sbin/rtprio/rtprio.1 index 85130c87f7e0..e6ce855d8561 100644 --- a/usr.sbin/rtprio/rtprio.1 +++ b/usr.sbin/rtprio/rtprio.1 @@ -30,7 +30,7 @@ .\" .\" $FreeBSD$ .\" -.Dd September 29, 2012 +.Dd November 29, 2021 .Dt RTPRIO 1 .Os .Sh NAME @@ -113,6 +113,9 @@ highest priority of 0 means "the current process". .Pp Only root is allowed to set realtime or idle priority for a process. +Exceptional privileges can be granted through the +.Xr mac_priority 4 +policy and the realtime user group. A user may modify the idle priority of their own processes if the .Xr sysctl 8 variable @@ -162,6 +165,7 @@ To make depend while not disturbing other machine usage: .Xr rtprio 2 , .Xr setpriority 2 , .Xr nice 3 , +.Xr mac_priority 4 , .Xr renice 8 .Sh HISTORY The