diff options
| author | Florian Walpen <dev@submerge.ch> | 2021-12-14 21:55:51 +0000 |
|---|---|---|
| committer | Konstantin Belousov <kib@FreeBSD.org> | 2021-12-14 22:01:58 +0000 |
| commit | e28767f0e17550d8ed030cff0918202e5de101ab (patch) | |
| tree | a2d1ea3523987cd71041df1ef36a7094c1d1948f /sys/security | |
| parent | 8b9fe05a49d7cd8079e3364f75fd48b2f53bf696 (diff) | |
| download | src-e28767f0e17550d8ed030cff0918202e5de101ab.tar.gz src-e28767f0e17550d8ed030cff0918202e5de101ab.zip | |
Thread creation privilege for realtime group
With the mac_priority(4) realtime policy active, users and processes in
the realtime group may promote existing threads and processes to
realtime scheduling priority. Extend the privileges granted to
PRIV_SCHED_SETPOLICY which allows explicit creation of new realtime
threads.
One use case of this is when the pthread scheduling policy is set to
SCHED_RR or SCHED_FIFO via pthread_attr_setschedpolicy(...) before
calling pthread_create(...). I ran into this when testing audio software
with realtime threads, particularly audio/ardour6.
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D33393
Diffstat (limited to 'sys/security')
| -rw-r--r-- | sys/security/mac_priority/mac_priority.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/security/mac_priority/mac_priority.c b/sys/security/mac_priority/mac_priority.c index 5c4db72ca657..f460e5195cb9 100644 --- a/sys/security/mac_priority/mac_priority.c +++ b/sys/security/mac_priority/mac_priority.c @@ -64,8 +64,8 @@ SYSCTL_INT(_security_mac_priority, OID_AUTO, idletime_gid, CTLFLAG_RWTUN, static int priority_priv_grant(struct ucred *cred, int priv) { - if (priv == PRIV_SCHED_RTPRIO && realtime_enabled && - groupmember(realtime_gid, cred)) + if ((priv == PRIV_SCHED_RTPRIO || priv == PRIV_SCHED_SETPOLICY) && + realtime_enabled && groupmember(realtime_gid, cred)) return (0); if (priv == PRIV_SCHED_IDPRIO && idletime_enabled && |