Add idle priority scheduling privilege group to MAC/priority.

[dev_submerge.ch]

Summary

Add an idletime user group that allows non-root users to run processes with idle scheduling priority. Privileges are granted by a MAC policy in the mac_priority module. For this purpose, the kernel privilege PRIV_SCHED_IDPRIO was added to sys/priv.h (kernel module ABI change).

Deprecate the system wide sysctl(8) knob security.bsd.unprivileged_idprio which lets any user run idle priority processes, regardless of context. While the knob is still working, it is marked as deprecated in the description and in the man pages.

Test Plan

Tested on FreeBSD 14.0-CURRENT:

• The mac_priority module builds and loads.
• Idle priority scheduling privilege is granted to group members.
• Enable / disable policy through sysctl security.mac.priority.idletime.
• Change group id through sysctl security.mac.priority.idletime_gid is effective.
• Realtime priority scheduling privilege works as before.
• Deprecated sysctl security.bsd.unprivileged_idprio still works.

[kib]

sys/kern/kern_resource.c

354

(error = priv_check()) != 0

356

I do not think you need the 'else' keyword there.

358

!= 0

448

Same notes as for sys_rtprio_thread()

[kib]

usr.sbin/rtprio/rtprio.1

119 ↗

(On Diff #99718)

I suggest to leave the description of the legacy sysctl there still, but add a note that the control is deprecated.

There are a lot of systems that apply the setting, so removing the documentation would be a disservice.

[dev_submerge.ch]

Changes:

• Code style fixes as suggested.
• Keep sysctl security.bsd.unprivileged_idprio description in the man pages, as being deprecated.

[dev_submerge.ch]

Thanks for the review. I had to reword the mentions of sysctl security.bsd.unprivileged_idprio a bit in the man pages, for clarity.