# DF-2793 — rtprio()/lwp_rtprio() lack PRISON_CHECK: cross-jail read of
# host scheduling parameters

## What

`sys_rtprio()` (kern_resource.c:690-759) and `sys_lwp_rtprio()`
(:558-670) perform **no** prison check on any path, unlike every other
priority syscall in this file (getpriority :104/:123, setpriority
:208/:233/:277, ioprio_get :347/:366, ioprio_set :450/:475/:520), all of
which gate on `PRISON_CHECK(curtd->td_ucred, p->p_ucred)`
(sys/sys/proc.h:462 — same-prison-only).

Consequences:

* `RTP_LOOKUP` has **no credential check at all** before the copyout, so
  any jailed user whose uid matches a host user can read that host
  process's realtime scheduling parameters.
* The uid-ownership gate (:613-618, :711-716) short-circuits on
  `cr_uid == 0`, so **jailed root can RTP_LOOKUP any process on the
  host** — revealing which host processes run realtime/idle classes and
  their exact priorities.

(RTP_SET stays contained for unprivileged cross-jail callers: the
`caps_priv_check(SYSCAP_NOSCHED)` branch denies setting other pids
:620-625/:718-723, and jailed root lacks NOSCHED.)

## Build / Run (root — it jails a child to demonstrate the boundary)

```
cc -O2 -o jail_rtprio jail_rtprio.c
./jail_rtprio
```

The parent (host root) sets its own rtprio to {RTP_PRIO_NORMAL, 7} and
forks; the child jails itself via jail(2) (DF jail(2) auto-attaches,
kern_jail.c:227) and probes the parent's pid from inside the jail.

## Expected output

```
[jailed root] parent (host, pid 27363) rtprio probe:
  rtprio(RTP_LOOKUP, 27363)      = OK  type=1 prio=7   <== LEAK
  getpriority(PROCESS, 27363)    = No such process (prison-checked)
  setpriority(PROCESS, 27363, 10) = No such process (prison-checked)
  rtprio(RTP_LOOKUP, 1/init)  = OK  type=1 prio=0   <== LEAK
```

`rtprio` returns the host process's exact prio **7** across the jail
boundary while `getpriority` on the same pid correctly returns ESRCH.

## Fix

`fix.diff` — add `PRISON_CHECK` to both syscalls (ESRCH on mismatch),
matching the rest of the file. Authored post-verification; kernel rebuild
not performed for this Low finding (fix_status: not_testable).