git: e28767f0e175 - main - Thread creation privilege for realtime group

The branch main has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=e28767f0e17550d8ed030cff0918202e5de101ab

commit e28767f0e17550d8ed030cff0918202e5de101ab
Author:     Florian Walpen <dev@submerge.ch>
AuthorDate: 2021-12-14 21:55:51 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2021-12-14 22:01:58 +0000

    Thread creation privilege for realtime group
    
    With the mac_priority(4) realtime policy active, users and processes in
    the realtime group may promote existing threads and processes to
    realtime scheduling priority. Extend the privileges granted to
    PRIV_SCHED_SETPOLICY which allows explicit creation of new realtime
    threads.
    
    One use case of this is when the pthread scheduling policy is set to
    SCHED_RR or SCHED_FIFO via pthread_attr_setschedpolicy(...) before
    calling pthread_create(...). I ran into this when testing audio software
    with realtime threads, particularly audio/ardour6.
    
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D33393
---
 share/man/man4/mac_priority.4            | 15 +++++++++------
 sys/security/mac_priority/mac_priority.c |  4 ++--
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/share/man/man4/mac_priority.4 b/share/man/man4/mac_priority.4
index 6dfb937d1596..868d027d5233 100644
--- a/share/man/man4/mac_priority.4
+++ b/share/man/man4/mac_priority.4
@@ -21,7 +21,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd December 7, 2021
+.Dd December 14, 2021
 .Dt MAC_PRIORITY 4
 .Os
 .Sh NAME
@@ -79,13 +79,16 @@ priority through the
 .Xr rtprio 2
 system calls.
 .Ss Privileges Granted
-The kernel privileges granted to any process running
-with the corresponding group gid is:
-.Bl -tag -width ".Dv PRIV_SCHED_RTPRIO" -offset indent
+The realtime policy grants the following kernel privileges to any process
+running with the realtime group id:
+.Bl -inset -offset indent -compact
 .It Dv PRIV_SCHED_RTPRIO
-If it is a member of the realtime group.
+.It Dv PRIV_SCHED_SETPOLICY
+.El
+.Pp
+The kernel privilege granted by the idletime policy is:
+.Bl -inset -offset indent -compact
 .It Dv PRIV_SCHED_IDPRIO
-If it is a member of the idletime group.
 .El
 .Ss Runtime Configuration
 The following
diff --git a/sys/security/mac_priority/mac_priority.c b/sys/security/mac_priority/mac_priority.c
index 5c4db72ca657..f460e5195cb9 100644
--- a/sys/security/mac_priority/mac_priority.c
+++ b/sys/security/mac_priority/mac_priority.c
@@ -64,8 +64,8 @@ SYSCTL_INT(_security_mac_priority, OID_AUTO, idletime_gid, CTLFLAG_RWTUN,
 static int
 priority_priv_grant(struct ucred *cred, int priv)
 {
-	if (priv == PRIV_SCHED_RTPRIO && realtime_enabled &&
-	    groupmember(realtime_gid, cred))
+	if ((priv == PRIV_SCHED_RTPRIO || priv == PRIV_SCHED_SETPOLICY) &&
+	    realtime_enabled && groupmember(realtime_gid, cred))
 		return (0);
 
 	if (priv == PRIV_SCHED_IDPRIO && idletime_enabled &&