git: 2198221bd9df - main - sched_setscheduler(2): Change realtime privilege check

The branch main has been updated by olce:

URL: https://cgit.FreeBSD.org/src/commit/?id=2198221bd9df0ceb69945120bc477309a5729241

commit 2198221bd9df0ceb69945120bc477309a5729241
Author:     Florian Walpen <dev@submerge.ch>
AuthorDate: 2024-02-14 13:50:44 +0000
Commit:     Olivier Certner <olce@FreeBSD.org>
CommitDate: 2024-02-14 14:24:11 +0000

    sched_setscheduler(2): Change realtime privilege check
    
    Check for privilege PRIV_SCHED_SETPOLICY instead of PRIV_SCHED_SET, to
    at least make it coherent with what is done at thread creation when
    a realtime policy is requested, and have users authorized by
    mac_priority(4) pass it.
    
    This change is good enough in practice since it only allows 'root' (as
    before) and mac_priority(4)'s authorized users in (the point of this
    change), without other side effects.  More changes in this area, to
    generally ensure that all privilege checks are consistent, are going to
    come as olce's priority revamp project lands.
    
    (olce: Expanded the explanations.)
    
    PR:                     276962
    Reported by:            jbeich
    Reviewed by:            olce
    Approved by:            emaste (mentor)
    MFC after:              3 days
    Differential Revision:  https://reviews.freebsd.org/D43835
---
 sys/kern/p1003_1b.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/kern/p1003_1b.c b/sys/kern/p1003_1b.c
index 21c9e3a27039..6259f7092487 100644
--- a/sys/kern/p1003_1b.c
+++ b/sys/kern/p1003_1b.c
@@ -233,8 +233,8 @@ kern_sched_setscheduler(struct thread *td, struct thread *targettd,
 	targetp = targettd->td_proc;
 	PROC_LOCK_ASSERT(targetp, MA_OWNED);
 
-	/* Don't allow non root user to set a scheduler policy. */
-	error = priv_check(td, PRIV_SCHED_SET);
+	/* Only privileged users are allowed to set a scheduler policy. */
+	error = priv_check(td, PRIV_SCHED_SETPOLICY);
 	if (error)
 		return (error);