--- a/usr/src/man/man5/privileges.5	Tue May 24 23:08:51 2011 -0700
+++ b/usr/src/man/man5/privileges.5	Sat Jul 27 18:17:16 2013 -0700
@@ -1,5 +1,6 @@
 '\" te
 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
+.\" Copyright 2013, Joyent, Inc. All Rights Reserved.
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
 .\"  See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with
 .\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
@@ -489,13 +490,23 @@
 .sp
 .ne 2
 .na
+\fB\fBPRIV_PROC_PRIOUP\fR\fR
+.ad
+.sp .6
+.RS 4n
+Allow a process to elevate its priority above its current level.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBPRIV_PROC_PRIOCNTL\fR\fR
 .ad
 .sp .6
 .RS 4n
-Allow a process to elevate its priority above its current level. Allow a
-process to change its scheduling class to any scheduling class, including the
-RT class.
+Allows all that PRIV_PROC_PRIOUP allows.
+Allow a process to change its scheduling class to any scheduling class,
+including the RT class.
 .RE
 
 .sp
@@ -698,10 +709,21 @@
 .sp
 .ne 2
 .na
+\fB\fBPRIV_SYS_RES_BIND\fR\fR
+.ad
+.sp .6
+.RS 4n
+Allows a process to bind processes to processor sets.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBPRIV_SYS_RES_CONFIG\fR\fR
 .ad
 .sp .6
 .RS 4n
+Allows all that PRIV_SYS_RES_BIND allows.
 Allow a process to create and delete processor sets, assign CPUs to processor
 sets and override the \fBPSET_NOESCAPE\fR property. Allow a process to change
 the operational status of CPUs in the system using \fBp_online\fR(2). Allow a

--- a/usr/src/uts/common/disp/fss.c	Tue May 24 23:08:51 2011 -0700
+++ b/usr/src/uts/common/disp/fss.c	Sat Jul 27 18:17:16 2013 -0700
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 1994, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2013, Joyent, Inc. All rights reserved.
  */
 
 #include <sys/types.h>
@@ -1708,7 +1709,7 @@
 	 */
 	if ((reqpcredp != NULL) &&
 	    (reqfssuprilim > fssproc->fss_uprilim) &&
-	    secpolicy_setpriority(reqpcredp) != 0)
+	    secpolicy_raisepriority(reqpcredp) != 0)
 		return (EPERM);
 
 	/*
@@ -2355,7 +2356,7 @@
 		return (0);
 	}
 
-	if ((incr < 0 || incr > 2 * NZERO) && secpolicy_setpriority(cr) != 0)
+	if ((incr < 0 || incr > 2 * NZERO) && secpolicy_raisepriority(cr) != 0)
 		return (EPERM);
 
 	/*

--- a/usr/src/uts/common/disp/fx.c	Tue May 24 23:08:51 2011 -0700
+++ b/usr/src/uts/common/disp/fx.c	Sat Jul 27 18:17:16 2013 -0700
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 1994, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2013, Joyent, Inc. All rights reserved.
  */
 
 #include <sys/types.h>
@@ -1046,7 +1047,7 @@
 	if ((reqpcredp != NULL) &&
 	    (reqfxuprilim > fxpp->fx_uprilim ||
 	    ((fxkparmsp->fx_cflags & FX_DOTQ) != 0)) &&
-	    secpolicy_setpriority(reqpcredp) != 0) {
+	    secpolicy_raisepriority(reqpcredp) != 0) {
 		thread_unlock(tx);
 		return (EPERM);
 	}
@@ -1498,7 +1499,7 @@
 	}
 
 	if ((incr < 0 || incr > 2 * NZERO) &&
-	    secpolicy_setpriority(cr) != 0)
+	    secpolicy_raisepriority(cr) != 0)
 		return (EPERM);
 
 	/*

--- a/usr/src/uts/common/disp/rt.c	Tue May 24 23:08:51 2011 -0700
+++ b/usr/src/uts/common/disp/rt.c	Sat Jul 27 18:17:16 2013 -0700
@@ -22,13 +22,12 @@
 /*
  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
+ * Copyright 2013 Joyent, Inc.  All rights reserved.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
 /*	  All Rights Reserved  	*/
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/sysmacros.h>
@@ -870,7 +869,7 @@
 	 * we check it here.
 	 */
 	if (reqpcredp != NULL && reqpcid != rt_cid &&
-	    secpolicy_setpriority(reqpcredp) != 0)
+	    secpolicy_raisepriority(reqpcredp) != 0)
 		return (EPERM);
 
 	thread_lock(tx);

--- a/usr/src/uts/common/disp/ts.c	Tue May 24 23:08:51 2011 -0700
+++ b/usr/src/uts/common/disp/ts.c	Sat Jul 27 18:17:16 2013 -0700
@@ -21,6 +21,7 @@
 
 /*
  * Copyright (c) 1994, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2013, Joyent, Inc. All rights reserved.
  */
 
 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
@@ -1197,7 +1198,7 @@
 	 */
 	if (reqpcredp != NULL &&
 	    reqtsuprilim > tspp->ts_uprilim &&
-	    secpolicy_setpriority(reqpcredp) != 0)
+	    secpolicy_raisepriority(reqpcredp) != 0)
 		return (EPERM);
 
 	/*
@@ -1250,7 +1251,7 @@
 	 */
 
 	if (reqpcredp != NULL && !groupmember(IA_gid, reqpcredp) &&
-	    secpolicy_setpriority(reqpcredp) != 0) {
+	    secpolicy_raisepriority(reqpcredp) != 0) {
 		/*
 		 * Silently fail in case this is just a priocntl
 		 * call with upri and uprilim set to IA_NOCHANGE.
@@ -2097,7 +2098,7 @@
 	}
 
 	if ((incr < 0 || incr > 2 * NZERO) &&
-	    secpolicy_setpriority(cr) != 0)
+	    secpolicy_raisepriority(cr) != 0)
 		return (EPERM);
 
 	/*

--- a/usr/src/uts/common/os/policy.c	Tue May 24 23:08:51 2011 -0700
+++ b/usr/src/uts/common/os/policy.c	Sat Jul 27 18:17:16 2013 -0700
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2013, Joyent, Inc. All rights reserved.
  */
 
 #include <sys/types.h>
@@ -553,7 +554,18 @@
 }
 
 /*
- * Changing process priority
+ * Raising process priority
+ */
+int
+secpolicy_raisepriority(const cred_t *cr)
+{
+	if (PRIV_POLICY(cr, PRIV_PROC_PRIOUP, B_FALSE, EPERM, NULL) == 0)
+		return (0);
+	return (secpolicy_setpriority(cr));
+}
+
+/*
+ * Changing process priority or scheduling class
  */
 int
 secpolicy_setpriority(const cred_t *cr)

--- a/usr/src/uts/common/os/priv_defs	Tue May 24 23:08:51 2011 -0700
+++ b/usr/src/uts/common/os/priv_defs	Sat Jul 27 18:17:16 2013 -0700
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2013, Joyent, Inc. All rights reserved.
  *
 INSERT COMMENT
  */
@@ -303,9 +304,13 @@
 	effective uid is 0.
 	Allows a process to bind arbitrary processes to CPUs.
 
+privilege PRIV_PROC_PRIOUP
+
+	Allows a process to elevate its priority above its current level.
+
 privilege PRIV_PROC_PRIOCNTL
 
-	Allows a process to elevate its priority above its current level.
+	Allows all that PRIV_PROC_PRIOUP allows.
 	Allows a process to change its scheduling class to any scheduling class,
 	including the RT class.
 

--- a/usr/src/uts/common/sys/policy.h	Tue May 24 23:08:51 2011 -0700
+++ b/usr/src/uts/common/sys/policy.h	Sat Jul 27 18:17:16 2013 -0700
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2013, Joyent, Inc. All rights reserved.
  */
 
 #ifndef	_SYS_POLICY_H
@@ -136,6 +137,7 @@
 int secpolicy_resource_anon_mem(const cred_t *);
 int secpolicy_rpcmod_open(const cred_t *);
 int secpolicy_rsm_access(const cred_t *, uid_t, mode_t);
+int secpolicy_raisepriority(const cred_t *);
 int secpolicy_setpriority(const cred_t *);
 int secpolicy_settime(const cred_t *);
 int secpolicy_smb(const cred_t *);