git: 10b999149239 - stable/13 - Thread creation privilege for realtime group

The branch stable/13 has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=10b99914923936fcf244af720c2ad8fc4b395378

commit 10b99914923936fcf244af720c2ad8fc4b395378
Author:     Florian Walpen <dev@submerge.ch>
AuthorDate: 2021-12-14 21:55:51 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2021-12-19 02:42:52 +0000

    Thread creation privilege for realtime group
    
    (cherry picked from commit e28767f0e17550d8ed030cff0918202e5de101ab)
---
 share/man/man4/mac_priority.4            | 15 +++++++++------
 sys/security/mac_priority/mac_priority.c |  4 ++--
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/share/man/man4/mac_priority.4 b/share/man/man4/mac_priority.4
index 6dfb937d1596..868d027d5233 100644
--- a/share/man/man4/mac_priority.4
+++ b/share/man/man4/mac_priority.4
@@ -21,7 +21,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd December 7, 2021
+.Dd December 14, 2021
 .Dt MAC_PRIORITY 4
 .Os
 .Sh NAME
@@ -79,13 +79,16 @@ priority through the
 .Xr rtprio 2
 system calls.
 .Ss Privileges Granted
-The kernel privileges granted to any process running
-with the corresponding group gid is:
-.Bl -tag -width ".Dv PRIV_SCHED_RTPRIO" -offset indent
+The realtime policy grants the following kernel privileges to any process
+running with the realtime group id:
+.Bl -inset -offset indent -compact
 .It Dv PRIV_SCHED_RTPRIO
-If it is a member of the realtime group.
+.It Dv PRIV_SCHED_SETPOLICY
+.El
+.Pp
+The kernel privilege granted by the idletime policy is:
+.Bl -inset -offset indent -compact
 .It Dv PRIV_SCHED_IDPRIO
-If it is a member of the idletime group.
 .El
 .Ss Runtime Configuration
 The following
diff --git a/sys/security/mac_priority/mac_priority.c b/sys/security/mac_priority/mac_priority.c
index 5c4db72ca657..f460e5195cb9 100644
--- a/sys/security/mac_priority/mac_priority.c
+++ b/sys/security/mac_priority/mac_priority.c
@@ -64,8 +64,8 @@ SYSCTL_INT(_security_mac_priority, OID_AUTO, idletime_gid, CTLFLAG_RWTUN,
 static int
 priority_priv_grant(struct ucred *cred, int priv)
 {
-	if (priv == PRIV_SCHED_RTPRIO && realtime_enabled &&
-	    groupmember(realtime_gid, cred))
+	if ((priv == PRIV_SCHED_RTPRIO || priv == PRIV_SCHED_SETPOLICY) &&
+	    realtime_enabled && groupmember(realtime_gid, cred))
 		return (0);
 
 	if (priv == PRIV_SCHED_IDPRIO && idletime_enabled &&