6 files changed, 41 insertions, 43 deletions

diff --git a/sys/dev/cxgb/ulp/tom/cxgb_cpl_io.c b/sys/dev/cxgb/ulp/tom/cxgb_cpl_io.c
index 952a05b3e450..b12c367ffab7 100644
--- a/sys/dev/cxgb/ulp/tom/cxgb_cpl_io.c
+++ b/sys/dev/cxgb/ulp/tom/cxgb_cpl_io.c
@@ -1663,8 +1663,8 @@ t3_ip_ctloutput(struct socket *so, struct sockopt *sopt)
 	if (error)
 		return (error);
 
-	if (optval > IPTOS_PREC_CRITIC_ECP && !suser(curthread))
-		return (EPERM);
+	if (optval > IPTOS_PREC_CRITIC_ECP)
+		return (EINVAL);
 
 	inp = so_sotoinpcb(so);
 	inp_wlock(inp);
diff --git a/sys/kern/kern_priv.c b/sys/kern/kern_priv.c
index 87cce7741210..100f6d4c69ed 100644
--- a/sys/kern/kern_priv.c
+++ b/sys/kern/kern_priv.c
@@ -133,24 +133,3 @@ priv_check(struct thread *td, int priv)
 
 	return (priv_check_cred(td->td_ucred, priv, 0));
 }
-
-/*
- * Historical suser() wrapper functions, which now simply request PRIV_ROOT.
- * These will be removed in the near future, and exist solely because
- * the kernel and modules are not yet fully adapted to the new model.
- */
-int
-suser_cred(struct ucred *cred, int flags)
-{
-
-	return (priv_check_cred(cred, PRIV_ROOT, flags));
-}
-
-int
-suser(struct thread *td)
-{
-
-	KASSERT(td == curthread, ("suser: td != curthread"));
-
-	return (suser_cred(td->td_ucred, 0));
-}
diff --git a/sys/netipx/ipx.c b/sys/netipx/ipx.c
index 5ae0d4bf32ce..57616365feac 100644
--- a/sys/netipx/ipx.c
+++ b/sys/netipx/ipx.c
@@ -99,7 +99,7 @@ ipx_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp,
 	struct ifaddr *ifa;
 	struct ipx_ifaddr *oia;
 	int dstIsNew, hostIsNew;
-	int error = 0;
+	int error = 0, priv;
 
 	/*
 	 * Find address for this interface, if it exists.
@@ -135,12 +135,13 @@ ipx_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp,
 		return (0);
 	}
 
-	if (td && (error = suser(td)) != 0)
-		return (error);
-
 	switch (cmd) {
 	case SIOCAIFADDR:
 	case SIOCDIFADDR:
+		priv = (cmd == SIOCAIFADDR) ? PRIV_NET_ADDIFADDR :
+		    PRIV_NET_DELIFADDR;
+		if (td && (error = priv_check(td, priv)) != 0)
+			return (error);
 		if (ifra->ifra_addr.sipx_family == AF_IPX)
 		    for (oia = ia; ia != NULL; ia = ia->ia_next) {
 			if (ia->ia_ifp == ifp  &&
@@ -154,6 +155,8 @@ ipx_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp,
 
 	case SIOCSIFADDR:
 	case SIOCSIFDSTADDR:
+		if (td && (error = priv_check(td, PRIV_NET_SETLLADDR)) != 0)
+			return (error);
 		if (ia == NULL) {
 			oia = (struct ipx_ifaddr *)
 				malloc(sizeof(*ia), M_IFADDR,
@@ -183,6 +186,10 @@ ipx_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp,
 				ia->ia_broadaddr.sipx_addr.x_host = ipx_broadhost;
 			}
 		}
+		break;
+	default:
+		if (td && (error = priv_check(td, PRIV_NET_HWIOCTL)) != 0)
+			return (error);
 	}
 
 	switch (cmd) {
diff --git a/sys/nfsserver/nfs_serv.c b/sys/nfsserver/nfs_serv.c
index 15c6624a4169..901a4bd8f887 100644
--- a/sys/nfsserver/nfs_serv.c
+++ b/sys/nfsserver/nfs_serv.c
@@ -1802,7 +1802,8 @@ nfsrv_create(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 			if (vap->va_type == VCHR && rdev == 0xffffffff)
 				vap->va_type = VFIFO;
                         if (vap->va_type != VFIFO &&
-                            (error = suser_cred(cred, 0))) {
+			    (error = priv_check_cred(cred, PRIV_VFS_MKNOD_DEV,
+			    0))) {
 				goto ereply;
                         }
 			vap->va_rdev = rdev;
@@ -2024,7 +2025,8 @@ nfsrv_mknod(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 		if (error)
 			NDFREE(&nd, NDF_ONLY_PNBUF);
 	} else {
-		if (vtyp != VFIFO && (error = suser_cred(cred, 0)))
+		if (vtyp != VFIFO && (error = priv_check_cred(cred,
+		    PRIV_VFS_MKNOD_DEV, 0)))
 			goto out;
 		error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, vap);
 		if (error) {
diff --git a/sys/security/mac_bsdextended/mac_bsdextended.c b/sys/security/mac_bsdextended/mac_bsdextended.c
index cb993dbfba26..93befaee7552 100644
--- a/sys/security/mac_bsdextended/mac_bsdextended.c
+++ b/sys/security/mac_bsdextended/mac_bsdextended.c
@@ -221,7 +221,7 @@ static int
 ugidfw_rulecheck(struct mac_bsdextended_rule *rule,
     struct ucred *cred, struct vnode *vp, struct vattr *vap, int acc_mode)
 {
-	int match;
+	int mac_granted, match, priv_granted;
 	int i;
 
 	/*
@@ -372,9 +372,31 @@ ugidfw_rulecheck(struct mac_bsdextended_rule *rule,
 	}
 
 	/*
+	 * MBI_APPEND should not be here as it should get converted to
+	 * MBI_WRITE.
+	 */
+	priv_granted = 0;
+	mac_granted = rule->mbr_mode;
+	if ((acc_mode & MBI_ADMIN) && (mac_granted & MBI_ADMIN) == 0 &&
+	    priv_check_cred(cred, PRIV_VFS_ADMIN, 0) == 0)
+		priv_granted |= MBI_ADMIN;
+	if ((acc_mode & MBI_EXEC) && (mac_granted & MBI_EXEC) == 0 &&
+	    priv_check_cred(cred, (vap->va_type == VDIR) ? PRIV_VFS_LOOKUP :
+	    PRIV_VFS_EXEC, 0) == 0)
+		priv_granted |= MBI_EXEC;
+	if ((acc_mode & MBI_READ) && (mac_granted & MBI_READ) == 0 &&
+	    priv_check_cred(cred, PRIV_VFS_READ, 0) == 0)
+		priv_granted |= MBI_READ;
+	if ((acc_mode & MBI_STAT) && (mac_granted & MBI_STAT) == 0 &&
+	    priv_check_cred(cred, PRIV_VFS_STAT, 0) == 0)
+		priv_granted |= MBI_STAT;
+	if ((acc_mode & MBI_WRITE) && (mac_granted & MBI_WRITE) == 0 &&
+	    priv_check_cred(cred, PRIV_VFS_WRITE, 0) == 0)
+		priv_granted |= MBI_WRITE;
+	/*
 	 * Is the access permitted?
 	 */
-	if ((rule->mbr_mode & acc_mode) != acc_mode) {
+	if (((mac_granted | priv_granted) & acc_mode) != acc_mode) {
 		if (ugidfw_logging)
 			log(LOG_AUTHPRIV, "mac_bsdextended: %d:%d request %d"
 			    " on %d:%d failed. \n", cred->cr_ruid,
@@ -400,12 +422,6 @@ ugidfw_check(struct ucred *cred, struct vnode *vp, struct vattr *vap,
 	int error, i;
 
 	/*
-	 * XXXRW: More specific privilege selection needed.
-	 */
-	if (suser_cred(cred, 0) == 0)
-		return (0);
-
-	/*
 	 * Since we do not separately handle append, map append to write.
 	 */
 	if (acc_mode & MBI_APPEND) {
diff --git a/sys/sys/priv.h b/sys/sys/priv.h
index 4c0fdcaa7dd7..c56c99dd3606 100644
--- a/sys/sys/priv.h
+++ b/sys/sys/priv.h
@@ -485,12 +485,6 @@ struct thread;
 struct ucred;
 int	priv_check(struct thread *td, int priv);
 int	priv_check_cred(struct ucred *cred, int priv, int flags);
-
-/*
- * Continue to support external modules that rely on suser(9) -- for now.
- */
-int	suser(struct thread *td);
-int	suser_cred(struct ucred *cred, int flags);
 #endif
 
 #endif /* !_SYS_PRIV_H_ */