1 .\" Copyright (c) 2021 Florian Walpen <dev@submerge.ch>
3 .\" Redistribution and use in source and binary forms, with or without
4 .\" modification, are permitted provided that the following conditions
6 .\" 1. Redistributions of source code must retain the above copyright
7 .\" notice, this list of conditions and the following disclaimer.
8 .\" 2. Redistributions in binary form must reproduce the above copyright
9 .\" notice, this list of conditions and the following disclaimer in the
10 .\" documentation and/or other materials provided with the distribution.
12 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
13 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
14 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
15 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
16 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
17 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
18 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
19 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
20 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
21 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 .Nd "policy for scheduling privileges of non-root users"
31 To compile the mac_priority policy into your kernel, place the following lines
32 in your kernel configuration file:
33 .Bd -ragged -offset indent
35 .Cd "options MAC_PRIORITY"
38 Alternately, to load the mac_priority policy module at boot time,
39 place the following line in your kernel configuration file:
40 .Bd -ragged -offset indent
46 .Bd -literal -offset indent
47 mac_priority_load="YES"
52 policy grants scheduling privileges based on
55 Users or processes in the group
57 (gid 47) are allowed to run threads and processes with realtime scheduling
59 Users or processes in the group
61 (gid 48) are allowed to run threads and processes with idle scheduling
66 realtime policy active, privileged users may use the
68 utility to start processes with realtime priority.
69 Privileged applications can promote threads and processes to realtime
74 When the idletime policy is active, privileged users may use the
76 utility to start processes with idle priority.
77 Privileged applications can demote threads and processes to idle
81 .Ss Privileges Granted
82 The realtime policy grants the following kernel privileges to any process
83 running with the realtime group id:
84 .Bl -inset -offset indent -compact
85 .It Dv PRIV_SCHED_RTPRIO
86 .It Dv PRIV_SCHED_SETPOLICY
89 The kernel privilege granted by the idletime policy is:
90 .Bl -inset -offset indent -compact
91 .It Dv PRIV_SCHED_IDPRIO
93 .Ss Runtime Configuration
96 MIBs are available for fine-tuning this MAC policy.
99 variables can also be set as
103 .Bl -tag -width indent
104 .It Va security.mac.priority.realtime
105 Enable the realtime policy.
107 .It Va security.mac.priority.realtime_gid
108 The numeric gid of the realtime group.
110 .It Va security.mac.priority.idletime
111 Enable the idletime policy.
113 .It Va security.mac.priority.idletime_gid
114 The numeric gid of the idletime group.
123 MAC first appeared in