Add idle priority scheduling privilege group to MAC/priority.
ClosedPublic
Actions

Authored by dev_submerge.ch on Dec 8 2021, 5:44 PM.

Details

Reviewers

kib
• hselasky

Commits

rGa9545eede43b: Add idle priority scheduling privilege group to MAC/priority
rGa20a2450cd5f: Add PRIV_SCHED_IDPRIO

Summary

Add an idletime user group that allows non-root users to run processes with idle scheduling priority. Privileges are granted by a MAC policy in the mac_priority module. For this purpose, the kernel privilege PRIV_SCHED_IDPRIO was added to sys/priv.h (kernel module ABI change).

Deprecate the system wide sysctl(8) knob security.bsd.unprivileged_idprio which lets any user run idle priority processes, regardless of context. While the knob is still working, it is marked as deprecated in the description and in the man pages.

Test Plan

Tested on FreeBSD 14.0-CURRENT:

The mac_priority module builds and loads.
Idle priority scheduling privilege is granted to group members.
Enable / disable policy through sysctl security.mac.priority.idletime.
Change group id through sysctl security.mac.priority.idletime_gid is effective.
Realtime priority scheduling privilege works as before.
Deprecated sysctl security.bsd.unprivileged_idprio still works.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

dev_submerge.ch created this revision.Dec 8 2021, 5:44 PM

Herald added a subscriber: imp. · View Herald TranscriptDec 8 2021, 5:44 PM

dev_submerge.ch requested review of this revision.Dec 8 2021, 5:44 PM

kib added inline comments.Dec 8 2021, 6:36 PM

sys/kern/kern_resource.c
355	`(error = priv_check()) != 0`
357	I do not think you need the 'else' keyword there.
359	`!= 0`
449	Same notes as for sys_rtprio_thread()

kib added inline comments.Dec 8 2021, 6:37 PM

usr.sbin/rtprio/rtprio.1
119	I suggest to leave the description of the legacy sysctl there still, but add a note that the control is deprecated. There are a lot of systems that apply the setting, so removing the documentation would be a disservice.