Make similar changes to fo_stat() and fo_poll() as made earlier to

fo_read() and fo_write(): explicitly use the cred argument to fo_poll()
as "active_cred" using the passed file descriptor's f_cred reference
to provide access to the file credential.  Add an active_cred
argument to fo_stat() so that implementers have access to the active
credential as well as the file credential.  Generally modify callers
of fo_stat() to pass in td->td_ucred rather than fp->f_cred, which
was redundantly provided via the fp argument.  This set of modifications
also permits threads to perform these operations on behalf of another
thread without modifying their credential.

Trickle this change down into fo_stat/poll() implementations:

- badfo_poll(), badfo_stat(): modify/add arguments.
- kqueue_poll(), kqueue_stat(): modify arguments.
- pipe_poll(), pipe_stat(): modify/add arguments, pass active_cred to
  MAC checks rather than td->td_ucred.
- soo_poll(), soo_stat(): modify/add arguments, pass fp->f_cred rather
  than cred to pru_sopoll() to maintain current semantics.
- sopoll(): moidfy arguments.
- vn_poll(), vn_statfile(): modify/add arguments, pass new arguments
  to vn_stat().  Pass active_cred to MAC and fp->f_cred to VOP_POLL()
  to maintian current semantics.
- vn_close(): rename cred to file_cred to reflect reality while I'm here.
- vn_stat(): Add active_cred and file_cred arguments to vn_stat()
  and consumers so that this distinction is maintained at the VFS
  as well as 'struct file' layer.  Pass active_cred instead of
  td->td_ucred to MAC and to VOP_GETATTR() to maintain current semantics.

- fifofs: modify the creation of a "filetemp" so that the file
  credential is properly initialized and can be used in the socket
  code if desired.  Pass ap->a_td->td_ucred as the active
  credential to soo_poll().  If we teach the vnop interface about
  the distinction between file and active credentials, we would use
  the active credential here.

Note that current inconsistent passing of active_cred vs. file_cred to
VOP's is maintained.  It's not clear why GETATTR would be authorized
using active_cred while POLL would be authorized using file_cred at
the file system level.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, NAI Labs

16 files changed, 101 insertions, 82 deletions

diff --git a/sys/alpha/osf1/osf1_misc.c b/sys/alpha/osf1/osf1_misc.c
index 0b74fab..8dca370 100644
--- a/sys/alpha/osf1/osf1_misc.c
+++ b/sys/alpha/osf1/osf1_misc.c
@@ -618,7 +618,7 @@ osf1_stat(td, uap)
 	    SCARG(uap, path), td);
 	if ((error = namei(&nd)))
 		return (error);
-	error = vn_stat(nd.ni_vp, &sb, td);
+	error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td);
 	vput(nd.ni_vp);
 	if (error)
 		return (error);
@@ -649,7 +649,7 @@ osf1_lstat(td, uap)
 	    SCARG(uap, path), td);
 	if ((error = namei(&nd)))
 		return (error);
-	error = vn_stat(nd.ni_vp, &sb, td);
+	error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td);
 	vput(nd.ni_vp);
 	if (error)
 		return (error);
@@ -674,7 +674,7 @@ osf1_fstat(td, uap)
 
 	if ((error = fget(td, uap->fd, &fp)) != 0)
 		return (error);
-	error = fo_stat(fp, &ub, td);
+	error = fo_stat(fp, &ub, td->td_ucred, td);
 	fdrop(fp, td);
 	cvtstat2osf1(&ub, &oub);
 	if (error == 0)
diff --git a/sys/compat/linux/linux_stats.c b/sys/compat/linux/linux_stats.c
index e99bc67..ad90ffc 100644
--- a/sys/compat/linux/linux_stats.c
+++ b/sys/compat/linux/linux_stats.c
@@ -112,7 +112,7 @@ linux_newstat(struct thread *td, struct linux_newstat_args *args)
 		return (error);
 	NDFREE(&nd, NDF_ONLY_PNBUF);
 
-	error = vn_stat(nd.ni_vp, &buf, td);
+	error = vn_stat(nd.ni_vp, &buf, td->td_ucred, NOCRED, td);
 	vput(nd.ni_vp);
 	if (error)
 		return (error);
@@ -143,7 +143,7 @@ linux_newlstat(struct thread *td, struct linux_newlstat_args *args)
 		return (error);
 	NDFREE(&nd, NDF_ONLY_PNBUF); 
 
-	error = vn_stat(nd.ni_vp, &sb, td);
+	error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td);
 	vput(nd.ni_vp);
 	if (error)
 		return (error);
@@ -166,7 +166,7 @@ linux_newfstat(struct thread *td, struct linux_newfstat_args *args)
 	if ((error = fget(td, args->fd, &fp)) != 0)
 		return (error);
 
-	error = fo_stat(fp, &buf, td);
+	error = fo_stat(fp, &buf, td->td_ucred, td);
 	fdrop(fp, td);
 	if (!error)
 		error = newstat_copyout(&buf, args->buf);
@@ -433,7 +433,7 @@ linux_stat64(struct thread *td, struct linux_stat64_args *args)
 		return (error);
 	NDFREE(&nd, NDF_ONLY_PNBUF);
 
-	error = vn_stat(nd.ni_vp, &buf, td);
+	error = vn_stat(nd.ni_vp, &buf, td->td_ucred, NOCRED, td);
 	vput(nd.ni_vp);
 	if (error)
 		return (error);
@@ -464,7 +464,7 @@ linux_lstat64(struct thread *td, struct linux_lstat64_args *args)
 		return (error);
 	NDFREE(&nd, NDF_ONLY_PNBUF); 
 
-	error = vn_stat(nd.ni_vp, &sb, td);
+	error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td);
 	vput(nd.ni_vp);
 	if (error)
 		return (error);
@@ -490,7 +490,7 @@ linux_fstat64(struct thread *td, struct linux_fstat64_args *args)
 	    (fp = fdp->fd_ofiles[args->fd]) == NULL)
 		return (EBADF);
 
-	error = fo_stat(fp, &buf, td);
+	error = fo_stat(fp, &buf, td->td_ucred, td);
 	if (!error)
 		error = stat64_copyout(&buf, args->statbuf);
 
diff --git a/sys/fs/fdescfs/fdesc_vnops.c b/sys/fs/fdescfs/fdesc_vnops.c
index 1cc8db5..5438024 100644
--- a/sys/fs/fdescfs/fdesc_vnops.c
+++ b/sys/fs/fdescfs/fdesc_vnops.c
@@ -302,7 +302,7 @@ fdesc_getattr(ap)
 			return (error);
 
 		bzero(&stb, sizeof(stb));
-		error = fo_stat(fp, &stb, ap->a_td);
+		error = fo_stat(fp, &stb, ap->a_td->td_ucred, ap->a_td);
 		fdrop(fp, ap->a_td);
 		if (error == 0) {
 			VATTR_NULL(vap);
diff --git a/sys/fs/fifofs/fifo_vnops.c b/sys/fs/fifofs/fifo_vnops.c
index 36e8f7c..f862309 100644
--- a/sys/fs/fifofs/fifo_vnops.c
+++ b/sys/fs/fifofs/fifo_vnops.c
@@ -474,9 +474,10 @@ fifo_poll(ap)
 		}
 
 		filetmp.f_data = (caddr_t)ap->a_vp->v_fifoinfo->fi_readsock;
+		filetmp.f_cred = ap->a_cred;
 		if (filetmp.f_data)
-			revents |= soo_poll(&filetmp, events, ap->a_cred,
-			    ap->a_td);
+			revents |= soo_poll(&filetmp, events,
+			    ap->a_td->td_ucred, ap->a_td);
 
 		/* Reverse the above conversion. */
 		if ((revents & POLLINIGNEOF) &&
diff --git a/sys/kern/kern_descrip.c b/sys/kern/kern_descrip.c
index f291424..bc09bfd 100644
--- a/sys/kern/kern_descrip.c
+++ b/sys/kern/kern_descrip.c
@@ -103,9 +103,10 @@ static int badfo_readwrite(struct file *fp, struct uio *uio,
 static int badfo_ioctl(struct file *fp, u_long com, void *data,
     struct thread *td);
 static int badfo_poll(struct file *fp, int events,
-    struct ucred *cred, struct thread *td);
+    struct ucred *active_cred, struct thread *td);
 static int badfo_kqfilter(struct file *fp, struct knote *kn);
-static int badfo_stat(struct file *fp, struct stat *sb, struct thread *td);
+static int badfo_stat(struct file *fp, struct stat *sb,
+    struct ucred *active_cred, struct thread *td);
 static int badfo_close(struct file *fp, struct thread *td);
 
 /*
@@ -831,7 +832,7 @@ ofstat(td, uap)
 	mtx_lock(&Giant);
 	if ((error = fget(td, uap->fd, &fp)) != 0)
 		goto done2;
-	error = fo_stat(fp, &ub, td);
+	error = fo_stat(fp, &ub, td->td_ucred, td);
 	if (error == 0) {
 		cvtstat(&ub, &oub);
 		error = copyout(&oub, uap->sb, sizeof (oub));
@@ -868,7 +869,7 @@ fstat(td, uap)
 	mtx_lock(&Giant);
 	if ((error = fget(td, uap->fd, &fp)) != 0)
 		goto done2;
-	error = fo_stat(fp, &ub, td);
+	error = fo_stat(fp, &ub, td->td_ucred, td);
 	if (error == 0)
 		error = copyout(&ub, uap->sb, sizeof (ub));
 	fdrop(fp, td);
@@ -903,7 +904,7 @@ nfstat(td, uap)
 	mtx_lock(&Giant);
 	if ((error = fget(td, uap->fd, &fp)) != 0)
 		goto done2;
-	error = fo_stat(fp, &ub, td);
+	error = fo_stat(fp, &ub, td->td_ucred, td);
 	if (error == 0) {
 		cvtnstat(&ub, &nub);
 		error = copyout(&nub, uap->sb, sizeof (nub));
@@ -2169,10 +2170,10 @@ badfo_ioctl(fp, com, data, td)
 }
 
 static int
-badfo_poll(fp, events, cred, td)
+badfo_poll(fp, events, active_cred, td)
 	struct file *fp;
 	int events;
-	struct ucred *cred;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 
@@ -2189,9 +2190,10 @@ badfo_kqfilter(fp, kn)
 }
 
 static int
-badfo_stat(fp, sb, td)
+badfo_stat(fp, sb, active_cred, td)
 	struct file *fp;
 	struct stat *sb;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 
diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c
index 723565c..abc1f24 100644
--- a/sys/kern/kern_event.c
+++ b/sys/kern/kern_event.c
@@ -62,10 +62,11 @@ static int	kqueue_write(struct file *fp, struct uio *uio,
 		    struct ucred *active_cred, int flags, struct thread *td);
 static int	kqueue_ioctl(struct file *fp, u_long com, void *data,
 		    struct thread *td);
-static int 	kqueue_poll(struct file *fp, int events, struct ucred *cred,
-		    struct thread *td);
+static int 	kqueue_poll(struct file *fp, int events,
+		    struct ucred *active_cred, struct thread *td);
 static int 	kqueue_kqfilter(struct file *fp, struct knote *kn);
-static int 	kqueue_stat(struct file *fp, struct stat *st, struct thread *td);
+static int 	kqueue_stat(struct file *fp, struct stat *st,
+		    struct ucred *active_cred, struct thread *td);
 static int 	kqueue_close(struct file *fp, struct thread *td);
 static void 	kqueue_wakeup(struct kqueue *kq);
 
@@ -800,7 +801,8 @@ kqueue_ioctl(struct file *fp, u_long com, void *data, struct thread *td)
 
 /*ARGSUSED*/
 static int
-kqueue_poll(struct file *fp, int events, struct ucred *cred, struct thread *td)
+kqueue_poll(struct file *fp, int events, struct ucred *active_cred,
+    struct thread *td)
 {
 	struct kqueue *kq;
 	int revents = 0;
@@ -821,7 +823,8 @@ kqueue_poll(struct file *fp, int events, struct ucred *cred, struct thread *td)
 
 /*ARGSUSED*/
 static int
-kqueue_stat(struct file *fp, struct stat *st, struct thread *td)
+kqueue_stat(struct file *fp, struct stat *st, struct ucred *active_cred,
+    struct thread *td)
 {
 	struct kqueue *kq;
 
diff --git a/sys/kern/sys_generic.c b/sys/kern/sys_generic.c
index ebe61b3..55babb2 100644
--- a/sys/kern/sys_generic.c
+++ b/sys/kern/sys_generic.c
@@ -899,7 +899,8 @@ selscan(td, ibits, obits, nfd)
 					FILEDESC_UNLOCK(fdp);
 					return (EBADF);
 				}
-				if (fo_poll(fp, flag[msk], fp->f_cred, td)) {
+				if (fo_poll(fp, flag[msk], td->td_ucred,
+				    td)) {
 					obits[msk][(fd)/NFDBITS] |=
 					    ((fd_mask)1 << ((fd) % NFDBITS));
 					n++;
@@ -1072,7 +1073,7 @@ pollscan(td, fds, nfd)
 				 * POLLERR if appropriate.
 				 */
 				fds->revents = fo_poll(fp, fds->events,
-				    fp->f_cred, td);
+				    td->td_ucred, td);
 				if (fds->revents != 0)
 					n++;
 			}
diff --git a/sys/kern/sys_pipe.c b/sys/kern/sys_pipe.c
index cfba2de..4873f80 100644
--- a/sys/kern/sys_pipe.c
+++ b/sys/kern/sys_pipe.c
@@ -99,12 +99,13 @@ static int pipe_read(struct file *fp, struct uio *uio,
 static int pipe_write(struct file *fp, struct uio *uio, 
 		struct ucred *active_cred, int flags, struct thread *td);
 static int pipe_close(struct file *fp, struct thread *td);
-static int pipe_poll(struct file *fp, int events, struct ucred *cred,
+static int pipe_poll(struct file *fp, int events, struct ucred *active_cred,
 		struct thread *td);
 static int pipe_kqfilter(struct file *fp, struct knote *kn);
-static int pipe_stat(struct file *fp, struct stat *sb, struct thread *td);
+static int pipe_stat(struct file *fp, struct stat *sb,
+		struct ucred *active_cred,  struct thread *td);
 static int pipe_ioctl(struct file *fp, u_long cmd, void *data,
-    struct thread *td);
+		struct thread *td);
 
 static struct fileops pipeops = {
 	pipe_read, pipe_write, pipe_ioctl, pipe_poll, pipe_kqfilter,
@@ -1215,10 +1216,10 @@ pipe_ioctl(fp, cmd, data, td)
 }
 
 int
-pipe_poll(fp, events, cred, td)
+pipe_poll(fp, events, active_cred, td)
 	struct file *fp;
 	int events;
-	struct ucred *cred;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 	struct pipe *rpipe = (struct pipe *)fp->f_data;
@@ -1231,7 +1232,7 @@ pipe_poll(fp, events, cred, td)
 	wpipe = rpipe->pipe_peer;
 	PIPE_LOCK(rpipe);
 #ifdef MAC
-	error = mac_check_pipe_op(td->td_ucred, rpipe, MAC_OP_PIPE_POLL);
+	error = mac_check_pipe_op(active_cred, rpipe, MAC_OP_PIPE_POLL);
 	if (error)
 		goto locked_error;
 #endif
@@ -1276,9 +1277,10 @@ locked_error:
  * be a natural race.
  */
 static int
-pipe_stat(fp, ub, td)
+pipe_stat(fp, ub, active_cred, td)
 	struct file *fp;
 	struct stat *ub;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 	struct pipe *pipe = (struct pipe *)fp->f_data;
@@ -1286,7 +1288,7 @@ pipe_stat(fp, ub, td)
 	int error;
 
 	/* XXXMAC: Pipe should be locked for this check. */
-	error = mac_check_pipe_op(td->td_ucred, pipe, MAC_OP_PIPE_STAT);
+	error = mac_check_pipe_op(active_cred, pipe, MAC_OP_PIPE_STAT);
 	if (error)
 		return (error);
 #endif
diff --git a/sys/kern/sys_socket.c b/sys/kern/sys_socket.c
index 19f4d9b..53ca5b9 100644
--- a/sys/kern/sys_socket.c
+++ b/sys/kern/sys_socket.c
@@ -157,20 +157,22 @@ soo_ioctl(fp, cmd, data, td)
 }
 
 int
-soo_poll(fp, events, cred, td)
+soo_poll(fp, events, active_cred, td)
 	struct file *fp;
 	int events;
-	struct ucred *cred;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 	struct socket *so = (struct socket *)fp->f_data;
-	return so->so_proto->pr_usrreqs->pru_sopoll(so, events, cred, td);
+	return so->so_proto->pr_usrreqs->pru_sopoll(so, events,
+	    fp->f_cred, td);
 }
 
 int
-soo_stat(fp, ub, td)
+soo_stat(fp, ub, active_cred, td)
 	struct file *fp;
 	struct stat *ub;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 	struct socket *so = (struct socket *)fp->f_data;
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index 61cef61..7b71f00 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -1687,7 +1687,8 @@ sohasoutofband(so)
 }
 
 int
-sopoll(struct socket *so, int events, struct ucred *cred, struct thread *td)
+sopoll(struct socket *so, int events, struct ucred *active_cred,
+    struct thread *td)
 {
 	int revents = 0;
 	int s = splnet();
diff --git a/sys/kern/vfs_extattr.c b/sys/kern/vfs_extattr.c
index 197829b..39f8423 100644
--- a/sys/kern/vfs_extattr.c
+++ b/sys/kern/vfs_extattr.c
@@ -1435,7 +1435,7 @@ ostat(td, uap)
 	if ((error = namei(&nd)) != 0)
 		return (error);
 	NDFREE(&nd, NDF_ONLY_PNBUF);
-	error = vn_stat(nd.ni_vp, &sb, td);
+	error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td);
 	vput(nd.ni_vp);
 	if (error)
 		return (error);
@@ -1473,7 +1473,7 @@ olstat(td, uap)
 	if ((error = namei(&nd)) != 0)
 		return (error);
 	vp = nd.ni_vp;
-	error = vn_stat(vp, &sb, td);
+	error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td);
 	NDFREE(&nd, NDF_ONLY_PNBUF);
 	vput(vp);
 	if (error)
@@ -1544,7 +1544,7 @@ stat(td, uap)
 #endif
 	if ((error = namei(&nd)) != 0)
 		return (error);
-	error = vn_stat(nd.ni_vp, &sb, td);
+	error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td);
 	NDFREE(&nd, NDF_ONLY_PNBUF);
 	vput(nd.ni_vp);
 	if (error)
@@ -1581,7 +1581,7 @@ lstat(td, uap)
 	if ((error = namei(&nd)) != 0)
 		return (error);
 	vp = nd.ni_vp;
-	error = vn_stat(vp, &sb, td);
+	error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td);
 	NDFREE(&nd, NDF_ONLY_PNBUF);
 	vput(vp);
 	if (error)
@@ -1646,7 +1646,7 @@ nstat(td, uap)
 	if ((error = namei(&nd)) != 0)
 		return (error);
 	NDFREE(&nd, NDF_ONLY_PNBUF);
-	error = vn_stat(nd.ni_vp, &sb, td);
+	error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td);
 	vput(nd.ni_vp);
 	if (error)
 		return (error);
@@ -1685,7 +1685,7 @@ nlstat(td, uap)
 		return (error);
 	vp = nd.ni_vp;
 	NDFREE(&nd, NDF_ONLY_PNBUF);
-	error = vn_stat(vp, &sb, td);
+	error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td);
 	vput(vp);
 	if (error)
 		return (error);
@@ -3478,7 +3478,7 @@ fhstat(td, uap)
 		return (ESTALE);
 	if ((error = VFS_FHTOVP(mp, &fh.fh_fid, &vp)))
 		return (error);
-	error = vn_stat(vp, &sb, td);
+	error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td);
 	vput(vp);
 	if (error)
 		return (error);
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 197829b..39f8423 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -1435,7 +1435,7 @@ ostat(td, uap)
 	if ((error = namei(&nd)) != 0)
 		return (error);
 	NDFREE(&nd, NDF_ONLY_PNBUF);
-	error = vn_stat(nd.ni_vp, &sb, td);
+	error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td);
 	vput(nd.ni_vp);
 	if (error)
 		return (error);
@@ -1473,7 +1473,7 @@ olstat(td, uap)
 	if ((error = namei(&nd)) != 0)
 		return (error);
 	vp = nd.ni_vp;
-	error = vn_stat(vp, &sb, td);
+	error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td);
 	NDFREE(&nd, NDF_ONLY_PNBUF);
 	vput(vp);
 	if (error)
@@ -1544,7 +1544,7 @@ stat(td, uap)
 #endif
 	if ((error = namei(&nd)) != 0)
 		return (error);
-	error = vn_stat(nd.ni_vp, &sb, td);
+	error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td);
 	NDFREE(&nd, NDF_ONLY_PNBUF);
 	vput(nd.ni_vp);
 	if (error)
@@ -1581,7 +1581,7 @@ lstat(td, uap)
 	if ((error = namei(&nd)) != 0)
 		return (error);
 	vp = nd.ni_vp;
-	error = vn_stat(vp, &sb, td);
+	error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td);
 	NDFREE(&nd, NDF_ONLY_PNBUF);
 	vput(vp);
 	if (error)
@@ -1646,7 +1646,7 @@ nstat(td, uap)
 	if ((error = namei(&nd)) != 0)
 		return (error);
 	NDFREE(&nd, NDF_ONLY_PNBUF);
-	error = vn_stat(nd.ni_vp, &sb, td);
+	error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td);
 	vput(nd.ni_vp);
 	if (error)
 		return (error);
@@ -1685,7 +1685,7 @@ nlstat(td, uap)
 		return (error);
 	vp = nd.ni_vp;
 	NDFREE(&nd, NDF_ONLY_PNBUF);
-	error = vn_stat(vp, &sb, td);
+	error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td);
 	vput(vp);
 	if (error)
 		return (error);
@@ -3478,7 +3478,7 @@ fhstat(td, uap)
 		return (ESTALE);
 	if ((error = VFS_FHTOVP(mp, &fh.fh_fid, &vp)))
 		return (error);
-	error = vn_stat(vp, &sb, td);
+	error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td);
 	vput(vp);
 	if (error)
 		return (error);
diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c
index fdde26d..af5faed 100644
--- a/sys/kern/vfs_vnops.c
+++ b/sys/kern/vfs_vnops.c
@@ -68,10 +68,11 @@ static int vn_ioctl(struct file *fp, u_long com, void *data,
 		struct thread *td);
 static int vn_read(struct file *fp, struct uio *uio, 
 		struct ucred *active_cred, int flags, struct thread *td);
-static int vn_poll(struct file *fp, int events, struct ucred *cred,
+static int vn_poll(struct file *fp, int events, struct ucred *active_cred,
 		struct thread *td);
 static int vn_kqfilter(struct file *fp, struct knote *kn);
-static int vn_statfile(struct file *fp, struct stat *sb, struct thread *td);
+static int vn_statfile(struct file *fp, struct stat *sb,
+		struct ucred *active_cred, struct thread *td);
 static int vn_write(struct file *fp, struct uio *uio, 
 		struct ucred *active_cred, int flags, struct thread *td);
 
@@ -295,17 +296,17 @@ vn_writechk(vp)
  * Vnode close call
  */
 int
-vn_close(vp, flags, cred, td)
+vn_close(vp, flags, file_cred, td)
 	register struct vnode *vp;
 	int flags;
-	struct ucred *cred;
+	struct ucred *file_cred;
 	struct thread *td;
 {
 	int error;
 
 	if (flags & FWRITE)
 		vp->v_writecount--;
-	error = VOP_CLOSE(vp, flags, cred, td);
+	error = VOP_CLOSE(vp, flags, file_cred, td);
 	/*
 	 * XXX - In certain instances VOP_CLOSE has to do the vrele
 	 * itself. If the vrele has been done, it will return EAGAIN
@@ -578,16 +579,17 @@ vn_write(fp, uio, active_cred, flags, td)
  * File table vnode stat routine.
  */
 static int
-vn_statfile(fp, sb, td)
+vn_statfile(fp, sb, active_cred, td)
 	struct file *fp;
 	struct stat *sb;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 	struct vnode *vp = (struct vnode *)fp->f_data;
 	int error;
 
 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
-	error = vn_stat(vp, sb, td);
+	error = vn_stat(vp, sb, active_cred, fp->f_cred, td);
 	VOP_UNLOCK(vp, 0, td);
 
 	return (error);
@@ -597,9 +599,11 @@ vn_statfile(fp, sb, td)
  * Stat a vnode; implementation for the stat syscall
  */
 int
-vn_stat(vp, sb, td)
+vn_stat(vp, sb, active_cred, file_cred, td)
 	struct vnode *vp;
 	register struct stat *sb;
+	struct ucred *active_cred;
+	struct ucred *file_cred;
 	struct thread *td;
 {
 	struct vattr vattr;
@@ -608,13 +612,13 @@ vn_stat(vp, sb, td)
 	u_short mode;
 
 #ifdef MAC
-	error = mac_check_vnode_stat(td->td_ucred, vp);
+	error = mac_check_vnode_stat(active_cred, vp);
 	if (error)
 		return (error);
 #endif
 
 	vap = &vattr;
-	error = VOP_GETATTR(vp, vap, td->td_ucred, td);
+	error = VOP_GETATTR(vp, vap, active_cred, td);
 	if (error)
 		return (error);
 
@@ -788,10 +792,10 @@ vn_ioctl(fp, com, data, td)
  * File table vnode poll routine.
  */
 static int
-vn_poll(fp, events, cred, td)
+vn_poll(fp, events, active_cred, td)
 	struct file *fp;
 	int events;
-	struct ucred *cred;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 	struct vnode *vp;
@@ -802,13 +806,13 @@ vn_poll(fp, events, cred, td)
 	vp = (struct vnode *)fp->f_data;
 #ifdef MAC
 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
-	error = mac_check_vnode_op(cred, vp, MAC_OP_VNODE_POLL);
+	error = mac_check_vnode_op(active_cred, vp, MAC_OP_VNODE_POLL);
 	VOP_UNLOCK(vp, 0, td);
 	if (error)
 		return (error);
 #endif
 
-	return (VOP_POLL(vp, events, cred, td));
+	return (VOP_POLL(vp, events, fp->f_cred, td));
 }
 
 /*
diff --git a/sys/sys/file.h b/sys/sys/file.h
index d2e31d2..9b1ad41 100644
--- a/sys/sys/file.h
+++ b/sys/sys/file.h
@@ -90,10 +90,10 @@ struct file {
 		int	(*fo_ioctl)(struct file *fp, u_long com, void *data,
 			    struct thread *td);
 		int	(*fo_poll)(struct file *fp, int events,
-			    struct ucred *cred, struct thread *td);
+			    struct ucred *active_cred, struct thread *td);
 		int	(*fo_kqfilter)(struct file *fp, struct knote *kn);
 		int	(*fo_stat)(struct file *fp, struct stat *sb,
-			    struct thread *td);
+			    struct ucred *active_cred, struct thread *td);
 		int	(*fo_close)(struct file *fp, struct thread *td);
 	} *f_ops;
 	int	f_seqcount;	/*
@@ -182,9 +182,9 @@ static __inline int fo_write(struct file *fp, struct uio *uio,
 static __inline int fo_ioctl(struct file *fp, u_long com, void *data,
     struct thread *td);
 static __inline int fo_poll(struct file *fp, int events,
-    struct ucred *cred, struct thread *td);
+    struct ucred *active_cred, struct thread *td);
 static __inline int fo_stat(struct file *fp, struct stat *sb,
-    struct thread *td);
+    struct ucred *active_cred, struct thread *td);
 static __inline int fo_close(struct file *fp, struct thread *td);
 static __inline int fo_kqfilter(struct file *fp, struct knote *kn);
 struct proc;
@@ -225,24 +225,25 @@ fo_ioctl(fp, com, data, td)
 }
 
 static __inline int
-fo_poll(fp, events, cred, td)
+fo_poll(fp, events, active_cred, td)
 	struct file *fp;
 	int events;
-	struct ucred *cred;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 
-	return ((*fp->f_ops->fo_poll)(fp, events, cred, td));
+	return ((*fp->f_ops->fo_poll)(fp, events, active_cred, td));
 }
 
 static __inline int
-fo_stat(fp, sb, td)
+fo_stat(fp, sb, active_cred, td)
 	struct file *fp;
 	struct stat *sb;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 
-	return ((*fp->f_ops->fo_stat)(fp, sb, td));
+	return ((*fp->f_ops->fo_stat)(fp, sb, active_cred, td));
 }
 
 static __inline int
diff --git a/sys/sys/socketvar.h b/sys/sys/socketvar.h
index e597951..e352b4f 100644
--- a/sys/sys/socketvar.h
+++ b/sys/sys/socketvar.h
@@ -352,9 +352,10 @@ int	soo_write(struct file *fp, struct uio *uio,
 int	soo_close(struct file *fp, struct thread *td);
 int	soo_ioctl(struct file *fp, u_long cmd, void *data,
 	    struct thread *td);
-int	soo_poll(struct file *fp, int events, struct ucred *cred,
+int	soo_poll(struct file *fp, int events, struct ucred *active_cred,
+	    struct thread *td);
+int	soo_stat(struct file *fp, struct stat *ub, struct ucred *active_cred,
 	    struct thread *td);
-int	soo_stat(struct file *fp, struct stat *ub, struct thread *td);
 int	sokqfilter(struct file *fp, struct knote *kn);
 
 /*
@@ -418,7 +419,7 @@ int	soopt_getm(struct sockopt *sopt, struct mbuf **mp);
 int	soopt_mcopyin(struct sockopt *sopt, struct mbuf *m);
 int	soopt_mcopyout(struct sockopt *sopt, struct mbuf *m);
 
-int	sopoll(struct socket *so, int events, struct ucred *cred,
+int	sopoll(struct socket *so, int events, struct ucred *active_cred,
 	    struct thread *td);
 int	soreceive(struct socket *so, struct sockaddr **paddr, struct uio *uio,
 	    struct mbuf **mp0, struct mbuf **controlp, int *flagsp);
diff --git a/sys/sys/vnode.h b/sys/sys/vnode.h
index 8bd1bac..d977be3 100644
--- a/sys/sys/vnode.h
+++ b/sys/sys/vnode.h
@@ -701,7 +701,7 @@ void	vprint(char *label, struct vnode *vp);
 int	vrecycle(struct vnode *vp, struct mtx *inter_lkp,
 	    struct thread *td);
 int	vn_close(struct vnode *vp,
-	    int flags, struct ucred *cred, struct thread *td);
+	    int flags, struct ucred *file_cred, struct thread *td);
 void	vn_finished_write(struct mount *mp);
 int	vn_isdisk(struct vnode *vp, int *errp);
 int	vn_lock(struct vnode *vp, int flags, struct thread *td);
@@ -725,7 +725,8 @@ int	vn_rdwr_inchunks(enum uio_rw rw, struct vnode *vp, caddr_t base,
 	    int len, off_t offset, enum uio_seg segflg, int ioflg,
 	    struct ucred *active_cred, struct ucred *file_cred, int *aresid,
 	    struct thread *td);
-int	vn_stat(struct vnode *vp, struct stat *sb, struct thread *td);
+int	vn_stat(struct vnode *vp, struct stat *sb, struct ucred *active_cred,
+	    struct ucred *file_cred, struct thread *td);
 int	vn_start_write(struct vnode *vp, struct mount **mpp, int flags);
 dev_t	vn_todev(struct vnode *vp);
 int	vn_write_suspend_wait(struct vnode *vp, struct mount *mp,