diff options
| -rw-r--r-- | share/man/man4/mac_priority.4 | 15 | ||||
| -rw-r--r-- | sys/security/mac_priority/mac_priority.c | 4 |
2 files changed, 11 insertions, 8 deletions
diff --git a/share/man/man4/mac_priority.4 b/share/man/man4/mac_priority.4 index 6dfb937d1596..868d027d5233 100644 --- a/share/man/man4/mac_priority.4 +++ b/share/man/man4/mac_priority.4 @@ -21,7 +21,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd December 7, 2021 +.Dd December 14, 2021 .Dt MAC_PRIORITY 4 .Os .Sh NAME @@ -79,13 +79,16 @@ priority through the .Xr rtprio 2 system calls. .Ss Privileges Granted -The kernel privileges granted to any process running -with the corresponding group gid is: -.Bl -tag -width ".Dv PRIV_SCHED_RTPRIO" -offset indent +The realtime policy grants the following kernel privileges to any process +running with the realtime group id: +.Bl -inset -offset indent -compact .It Dv PRIV_SCHED_RTPRIO -If it is a member of the realtime group. +.It Dv PRIV_SCHED_SETPOLICY +.El +.Pp +The kernel privilege granted by the idletime policy is: +.Bl -inset -offset indent -compact .It Dv PRIV_SCHED_IDPRIO -If it is a member of the idletime group. .El .Ss Runtime Configuration The following diff --git a/sys/security/mac_priority/mac_priority.c b/sys/security/mac_priority/mac_priority.c index 5c4db72ca657..f460e5195cb9 100644 --- a/sys/security/mac_priority/mac_priority.c +++ b/sys/security/mac_priority/mac_priority.c @@ -64,8 +64,8 @@ SYSCTL_INT(_security_mac_priority, OID_AUTO, idletime_gid, CTLFLAG_RWTUN, static int priority_priv_grant(struct ucred *cred, int priv) { - if (priv == PRIV_SCHED_RTPRIO && realtime_enabled && - groupmember(realtime_gid, cred)) + if ((priv == PRIV_SCHED_RTPRIO || priv == PRIV_SCHED_SETPOLICY) && + realtime_enabled && groupmember(realtime_gid, cred)) return (0); if (priv == PRIV_SCHED_IDPRIO && idletime_enabled && |