setusercontext(): Set priority from '~/.login_conf' as well

Setting the process priority is done only when the current process'
effective UID corresponds to that for which context is to be set.
Consequently, setting priority is done with appropriate credentials and
will fail if the target user tries to raise it unduly via his
'~/.login_conf'.

PR:                     271751
Reviewed by:            kib, Andrew Gierth <andrew_tao173.riddles.org.uk>
Approved by:            emaste (mentor)
MFC after:              3 days
Relnotes:               yes
Sponsored by:           Kumacom SAS
Differential Revision:  https://reviews.freebsd.org/D40352

1 files changed, 2 insertions, 0 deletions

diff --git a/lib/libutil/login_class.c b/lib/libutil/login_class.c
index 314ab0999320..5ae0fbfb80b8 100644
--- a/lib/libutil/login_class.c
+++ b/lib/libutil/login_class.c
@@ -621,6 +621,8 @@ setusercontext(login_cap_t *lc, const struct passwd *pwd, uid_t uid, unsigned in
      */
     if (geteuid() == uid && (lc = login_getuserclass(pwd)) != NULL) {
 	setlogincontext(lc, pwd, flags);
+	if (flags & LOGIN_SETPRIORITY)
+	    setclasspriority(lc, pwd);
 	login_close(lc);
     }