---
name: "mac_priority"
section: "4"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/mac_priority"
---

# mac\_priority(4)

policy for scheduling privileges of non-root users

## NAME

**mac\_priority** – policy for scheduling privileges of non-root users

## SYNOPSIS

To compile the mac\_priority policy into your kernel, place the following lines in your kernel configuration file:

**options MAC** **options MAC\_PRIORITY**

Alternately, to load the mac\_priority policy module at boot time, place the following line in your kernel configuration file:

**options MAC**

and in [loader.conf(5)](/loader.conf/5.md):

```
mac_priority_load="YES"
```

## DESCRIPTION

The **mac\_priority** policy grants scheduling privileges based on [group(5)](/group/5.md) membership. Users or processes in the group ‘realtime’ (gid 47) are allowed to run threads and processes with realtime scheduling priority. Users or processes in the group ‘idletime’ (gid 48) are allowed to run threads and processes with idle scheduling priority.

With the **mac\_priority** realtime policy active, privileged users may use the [rtprio(1)](/rtprio/1.md) utility to start processes with realtime priority. Privileged applications can promote threads and processes to realtime priority through the [rtprio(2)](/rtprio/2.md) system calls.

When the idletime policy is active, privileged users may use the [idprio(1)](/idprio/1.md) utility to start processes with idle priority. Privileged applications can demote threads and processes to idle priority through the [rtprio(2)](/rtprio/2.md) system calls.

### Privileges Granted

The realtime policy grants the following kernel privileges to any process running with the realtime group id:

- PRIV\_SCHED\_RTPRIO

  - PRIV\_SCHED\_SETPOLICY

  The kernel privilege granted by the idletime policy is:

- PRIV\_SCHED\_IDPRIO

  ### Runtime Configuration

The following [sysctl(8)](/sysctl/8.md) MIBs are available for fine-tuning this MAC policy. All [sysctl(8)](/sysctl/8.md) variables can also be set as [loader(8)](/loader/8.md) tunables in [loader.conf(5)](/loader.conf/5.md).

- *security.mac.priority.realtime*

  Enable the realtime policy. (Default: 1).

- *security.mac.priority.realtime\_gid*

  The numeric gid of the realtime group. (Default: 47).

- *security.mac.priority.idletime*

  Enable the idletime policy. (Default: 1).

- *security.mac.priority.idletime\_gid*

  The numeric gid of the idletime group. (Default: 48).

## SEE ALSO

[idprio(1)](/idprio/1.md), [rtprio(1)](/rtprio/1.md), [rtprio(2)](/rtprio/2.md), [mac(4)](/mac/4.md)

## HISTORY

MAC first appeared in FreeBSD 5.0 and **mac\_priority** first appeared in FreeBSD 13.1.