In continuation of early fileop credential changes, modify fo_ioctl() to

accept an 'active_cred' argument reflecting the credential of the thread
initiating the ioctl operation.

- Change fo_ioctl() to accept active_cred; change consumers of the
  fo_ioctl() interface to generally pass active_cred from td->td_ucred.
- In fifofs, initialize filetmp.f_cred to ap->a_cred so that the
  invocations of soo_ioctl() are provided access to the calling f_cred.
  Pass ap->a_td->td_ucred as the active_cred, but note that this is
  required because we don't yet distinguish file_cred and active_cred
  in invoking VOP's.
- Update kqueue_ioctl() for its new argument.
- Update pipe_ioctl() for its new argument, pass active_cred rather
  than td_ucred to MAC for authorization.
- Update soo_ioctl() for its new argument.
- Update vn_ioctl() for its new argument, use active_cred rather than
  td->td_ucred to authorize VOP_IOCTL() and the associated VOP_GETATTR().

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, NAI Labs

22 files changed, 138 insertions, 79 deletions

diff --git a/sys/compat/linux/linux_file.c b/sys/compat/linux/linux_file.c
index 847e23e..fc634ba 100644
--- a/sys/compat/linux/linux_file.c
+++ b/sys/compat/linux/linux_file.c
@@ -143,7 +143,8 @@ linux_open(struct thread *td, struct linux_open_args *args)
 	PROC_UNLOCK(p);
 	if (!error) {
 		if (fp->f_type == DTYPE_VNODE)
-			fo_ioctl(fp, TIOCSCTTY, (caddr_t) 0, td);
+			fo_ioctl(fp, TIOCSCTTY, (caddr_t) 0, td->td_ucred,
+			    td);
 	    fdrop(fp, td);
 	}
     } else {
diff --git a/sys/compat/linux/linux_ioctl.c b/sys/compat/linux/linux_ioctl.c
index 77e2942..05fc0bd 100644
--- a/sys/compat/linux/linux_ioctl.c
+++ b/sys/compat/linux/linux_ioctl.c
@@ -113,7 +113,8 @@ linux_ioctl_disk(struct thread *td, struct linux_ioctl_args *args)
 		return (error);
 	switch (args->cmd & 0xffff) {
 	case LINUX_BLKGETSIZE:
-		error = fo_ioctl(fp, DIOCGDINFO, (caddr_t)&dl, td);
+		error = fo_ioctl(fp, DIOCGDINFO, (caddr_t)&dl, td->td_ucred,
+		    td);
 		fdrop(fp, td);
 		if (error)
 			return (error);
@@ -560,7 +561,8 @@ linux_ioctl_termio(struct thread *td, struct linux_ioctl_args *args)
 	switch (args->cmd & 0xffff) {
 
 	case LINUX_TCGETS:
-		error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bios, td);
+		error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bios, td->td_ucred,
+		    td);
 		if (error)
 			break;
 		bsd_to_linux_termios(&bios, &lios);
@@ -572,7 +574,8 @@ linux_ioctl_termio(struct thread *td, struct linux_ioctl_args *args)
 		if (error)
 			break;
 		linux_to_bsd_termios(&lios, &bios);
-		error = (fo_ioctl(fp, TIOCSETA, (caddr_t)&bios, td));
+		error = (fo_ioctl(fp, TIOCSETA, (caddr_t)&bios, td->td_ucred,
+		    td));
 		break;
 
 	case LINUX_TCSETSW:
@@ -580,7 +583,8 @@ linux_ioctl_termio(struct thread *td, struct linux_ioctl_args *args)
 		if (error)
 			break;
 		linux_to_bsd_termios(&lios, &bios);
-		error = (fo_ioctl(fp, TIOCSETAW, (caddr_t)&bios, td));
+		error = (fo_ioctl(fp, TIOCSETAW, (caddr_t)&bios, td->td_ucred,
+		    td));
 		break;
 
 	case LINUX_TCSETSF:
@@ -588,11 +592,13 @@ linux_ioctl_termio(struct thread *td, struct linux_ioctl_args *args)
 		if (error)
 			break;
 		linux_to_bsd_termios(&lios, &bios);
-		error = (fo_ioctl(fp, TIOCSETAF, (caddr_t)&bios, td));
+		error = (fo_ioctl(fp, TIOCSETAF, (caddr_t)&bios, td->td_ucred,
+		    td));
 		break;
 
 	case LINUX_TCGETA:
-		error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bios, td);
+		error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bios, td->td_ucred,
+		    td);
 		if (error)
 			break;
 		bsd_to_linux_termio(&bios, &lio);
@@ -604,7 +610,8 @@ linux_ioctl_termio(struct thread *td, struct linux_ioctl_args *args)
 		if (error)
 			break;
 		linux_to_bsd_termio(&lio, &bios);
-		error = (fo_ioctl(fp, TIOCSETA, (caddr_t)&bios, td));
+		error = (fo_ioctl(fp, TIOCSETA, (caddr_t)&bios, td->td_ucred,
+		    td));
 		break;
 
 	case LINUX_TCSETAW:
@@ -612,7 +619,8 @@ linux_ioctl_termio(struct thread *td, struct linux_ioctl_args *args)
 		if (error)
 			break;
 		linux_to_bsd_termio(&lio, &bios);
-		error = (fo_ioctl(fp, TIOCSETAW, (caddr_t)&bios, td));
+		error = (fo_ioctl(fp, TIOCSETAW, (caddr_t)&bios, td->td_ucred,
+		    td));
 		break;
 
 	case LINUX_TCSETAF:
@@ -620,7 +628,8 @@ linux_ioctl_termio(struct thread *td, struct linux_ioctl_args *args)
 		if (error)
 			break;
 		linux_to_bsd_termio(&lio, &bios);
-		error = (fo_ioctl(fp, TIOCSETAF, (caddr_t)&bios, td));
+		error = (fo_ioctl(fp, TIOCSETAF, (caddr_t)&bios, td->td_ucred,
+		    td));
 		break;
 
 	/* LINUX_TCSBRK */
@@ -637,7 +646,8 @@ linux_ioctl_termio(struct thread *td, struct linux_ioctl_args *args)
 		case LINUX_TCION: {
 			int c;
 			struct write_args wr;
-			error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bios, td);
+			error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bios,
+			    td->td_ucred, td);
 			if (error)
 				break;
 			fdrop(fp, td);
@@ -799,14 +809,16 @@ linux_ioctl_termio(struct thread *td, struct linux_ioctl_args *args)
 			fdrop(fp, td);
 			return (EINVAL);
 		}
-		error = (fo_ioctl(fp, TIOCSETD, (caddr_t)&line, td));
+		error = (fo_ioctl(fp, TIOCSETD, (caddr_t)&line, td->td_ucred,
+		    td));
 		break;
 	}
 
 	case LINUX_TIOCGETD: {
 		int linux_line;
 		int bsd_line = TTYDISC;
-		error = fo_ioctl(fp, TIOCGETD, (caddr_t)&bsd_line, td);
+		error = fo_ioctl(fp, TIOCGETD, (caddr_t)&bsd_line,
+		    td->td_ucred, td);
 		if (error)
 			return (error);
 		switch (bsd_line) {
@@ -1275,7 +1287,8 @@ linux_ioctl_cdrom(struct thread *td, struct linux_ioctl_args *args)
 	case LINUX_CDROMREADTOCHDR: {
 		struct ioc_toc_header th;
 		struct linux_cdrom_tochdr lth;
-		error = fo_ioctl(fp, CDIOREADTOCHEADER, (caddr_t)&th, td);
+		error = fo_ioctl(fp, CDIOREADTOCHEADER, (caddr_t)&th,
+		    td->td_ucred, td);
 		if (!error) {
 			lth.cdth_trk0 = th.starting_track;
 			lth.cdth_trk1 = th.ending_track;
@@ -1290,7 +1303,8 @@ linux_ioctl_cdrom(struct thread *td, struct linux_ioctl_args *args)
 		struct ioc_read_toc_single_entry irtse;
 		irtse.address_format = ltep->cdte_format;
 		irtse.track = ltep->cdte_track;
-		error = fo_ioctl(fp, CDIOREADTOCENTRY, (caddr_t)&irtse, td);
+		error = fo_ioctl(fp, CDIOREADTOCENTRY, (caddr_t)&irtse,
+		    td->td_ucred, td);
 		if (!error) {
 			lte = *ltep;
 			lte.cdte_ctrl = irtse.entry.control;
@@ -1331,7 +1345,8 @@ linux_ioctl_cdrom(struct thread *td, struct linux_ioctl_args *args)
 		bsdsc.track = 0;
 		bsdsc.data_len = sizeof(struct cd_sub_channel_info);
 		bsdsc.data = bsdinfo;
-		error = fo_ioctl(fp, CDIOCREADSUBCHANNEL, (caddr_t)&bsdsc, td);
+		error = fo_ioctl(fp, CDIOCREADSUBCHANNEL, (caddr_t)&bsdsc,
+		    td->td_ucred, td);
 		if (error)
 			break;
 		error = copyin((caddr_t)args->arg, &sc,
@@ -1397,7 +1412,8 @@ linux_ioctl_cdrom(struct thread *td, struct linux_ioctl_args *args)
 		error = linux_to_bsd_dvd_struct(&lds, &bds);
 		if (error)
 			break;
-		error = fo_ioctl(fp, DVDIOCREADSTRUCTURE, (caddr_t)&bds, td);
+		error = fo_ioctl(fp, DVDIOCREADSTRUCTURE, (caddr_t)&bds,
+		    td->td_ucred, td);
 		if (error)
 			break;
 		error = bsd_to_linux_dvd_struct(&bds, &lds);
@@ -1422,7 +1438,8 @@ linux_ioctl_cdrom(struct thread *td, struct linux_ioctl_args *args)
 		error = linux_to_bsd_dvd_authinfo(&lda, &bcode, &bda);
 		if (error)
 			break;
-		error = fo_ioctl(fp, bcode, (caddr_t)&bda, td);
+		error = fo_ioctl(fp, bcode, (caddr_t)&bda, td->td_ucred,
+		    td);
 		if (error) {
 			if (lda.type == LINUX_DVD_HOST_SEND_KEY2) {
 				lda.type = LINUX_DVD_AUTH_FAILURE;
@@ -1759,7 +1776,8 @@ linux_ioctl_console(struct thread *td, struct linux_ioctl_args *args)
 			fdrop(fp, td);
 			return (EINVAL);
 		}
-		error = (fo_ioctl(fp, KDSKBMODE, (caddr_t)&kbdmode, td));
+		error = (fo_ioctl(fp, KDSKBMODE, (caddr_t)&kbdmode,
+		    td->td_ucred, td));
 		break;
 	}
 
diff --git a/sys/compat/svr4/svr4_fcntl.c b/sys/compat/svr4/svr4_fcntl.c
index e63ac02..fa4ddf2 100644
--- a/sys/compat/svr4/svr4_fcntl.c
+++ b/sys/compat/svr4/svr4_fcntl.c
@@ -399,7 +399,8 @@ svr4_sys_open(td, uap)
 			return (EBADF);	/* XXX: correct errno? */
 		/* ignore any error, just give it a try */
 		if (fp->f_type == DTYPE_VNODE)
-			fo_ioctl(fp, TIOCSCTTY, (caddr_t) 0, td);
+			fo_ioctl(fp, TIOCSCTTY, (caddr_t) 0, td->td_ucred,
+			    td);
 		fdrop(fp, td);
 	} else {
 		PROC_UNLOCK(p);
diff --git a/sys/compat/svr4/svr4_filio.c b/sys/compat/svr4/svr4_filio.c
index ef9b8b6..c2bad1d 100644
--- a/sys/compat/svr4/svr4_filio.c
+++ b/sys/compat/svr4/svr4_filio.c
@@ -219,7 +219,7 @@ svr4_fil_ioctl(fp, td, retval, fd, cmd, data)
 #ifdef SVR4_DEBUG
 		if (cmd == FIOASYNC) DPRINTF(("FIOASYNC\n"));
 #endif
-		error = fo_ioctl(fp, cmd, (caddr_t) &num, td);
+		error = fo_ioctl(fp, cmd, (caddr_t) &num, td->td_ucred, td);
 
 		if (error)
 			return error;
diff --git a/sys/compat/svr4/svr4_sockio.c b/sys/compat/svr4/svr4_sockio.c
index 9f41e10..7bb25e0 100644
--- a/sys/compat/svr4/svr4_sockio.c
+++ b/sys/compat/svr4/svr4_sockio.c
@@ -125,7 +125,8 @@ svr4_sock_ioctl(fp, td, retval, fd, cmd, data)
 			(void) strncpy(br.ifr_name, sr.svr4_ifr_name,
 			    sizeof(br.ifr_name));
 			if ((error = fo_ioctl(fp, SIOCGIFFLAGS, 
-					    (caddr_t) &br, td)) != 0) {
+					    (caddr_t) &br, td->td_ucred,
+					    td)) != 0) {
 				DPRINTF(("SIOCGIFFLAGS (%s) %s: error %d\n", 
 					 br.ifr_name, sr.svr4_ifr_name, error));
 				return error;
@@ -149,7 +150,8 @@ svr4_sock_ioctl(fp, td, retval, fd, cmd, data)
 				sc.svr4_ifc_len));
 
 			if ((error = fo_ioctl(fp, OSIOCGIFCONF,
-					    (caddr_t) &sc, td)) != 0)
+					    (caddr_t) &sc, td->td_ucred,
+					    td)) != 0)
 				return error;
 
 			DPRINTF(("SIOCGIFCONF\n"));
diff --git a/sys/compat/svr4/svr4_stream.c b/sys/compat/svr4/svr4_stream.c
index 2f0d5e3..1618ac1 100644
--- a/sys/compat/svr4/svr4_stream.c
+++ b/sys/compat/svr4/svr4_stream.c
@@ -1267,7 +1267,8 @@ i_nread(fp, td, retval, fd, cmd, dat)
 	 * for us, and if we do, then we assume that we have at least one
 	 * message waiting for us.
 	 */
-	if ((error = fo_ioctl(fp, FIONREAD, (caddr_t) &nread, td)) != 0)
+	if ((error = fo_ioctl(fp, FIONREAD, (caddr_t) &nread, td->td_ucred,
+	    td)) != 0)
 		return error;
 
 	if (nread != 0)
diff --git a/sys/compat/svr4/svr4_termios.c b/sys/compat/svr4/svr4_termios.c
index 5fdd5a6..ab1e799 100644
--- a/sys/compat/svr4/svr4_termios.c
+++ b/sys/compat/svr4/svr4_termios.c
@@ -499,7 +499,8 @@ svr4_term_ioctl(fp, td, retval, fd, cmd, data)
 	case SVR4_TCGETA:
 	case SVR4_TCGETS:
 		DPRINTF(("ioctl(TCGET%c);\n", cmd == SVR4_TCGETA ? 'A' : 'S'));
-		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t) &bt, td)) != 0)
+		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t) &bt,
+		    td->td_ucred, td)) != 0)
 			return error;
 
 		memset(&st, 0, sizeof(st));
@@ -526,7 +527,8 @@ svr4_term_ioctl(fp, td, retval, fd, cmd, data)
 	case SVR4_TCSETSF:
 	        DPRINTF(("TCSET{A,S,AW,SW,AF,SF}\n"));
 		/* get full BSD termios so we don't lose information */
-		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t) &bt, td)) != 0)
+		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t) &bt,
+		    td->td_ucred, td)) != 0)
 			return error;
 
 		switch (cmd) {
@@ -577,14 +579,15 @@ svr4_term_ioctl(fp, td, retval, fd, cmd, data)
 		print_svr4_termios(&st);
 #endif /* DEBUG_SVR4 */
 
-		return fo_ioctl(fp, cmd, (caddr_t) &bt, td);
+		return fo_ioctl(fp, cmd, (caddr_t) &bt, td->td_ucred, td);
 
 	case SVR4_TIOCGWINSZ:
 	        DPRINTF(("TIOCGWINSZ\n"));
 		{
 			struct svr4_winsize ws;
 
-			error = fo_ioctl(fp, TIOCGWINSZ, (caddr_t) &ws, td);
+			error = fo_ioctl(fp, TIOCGWINSZ, (caddr_t) &ws,
+			    td->td_ucred, td);
 			if (error)
 				return error;
 			return copyout(&ws, data, sizeof(ws));
@@ -597,7 +600,8 @@ svr4_term_ioctl(fp, td, retval, fd, cmd, data)
 
 			if ((error = copyin(data, &ws, sizeof(ws))) != 0)
 				return error;
-			return fo_ioctl(fp, TIOCSWINSZ, (caddr_t) &ws, td);
+			return fo_ioctl(fp, TIOCSWINSZ, (caddr_t) &ws,
+			    td->td_ucred, td);
 		}
 
 	default:
diff --git a/sys/compat/svr4/svr4_ttold.c b/sys/compat/svr4/svr4_ttold.c
index 47a8135..7e4f234 100644
--- a/sys/compat/svr4/svr4_ttold.c
+++ b/sys/compat/svr4/svr4_ttold.c
@@ -192,8 +192,9 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 		{
 			pid_t pid;
 
-			if ((error = fo_ioctl(fp, TIOCGPGRP, (caddr_t) &pid, td)) != 0)
-			    return error;
+			if ((error = fo_ioctl(fp, TIOCGPGRP, (caddr_t) &pid,
+			    td->td_ucred, td)) != 0)
+				return error;
 
 			DPRINTF(("TIOCGPGRP %d\n", pid));
 
@@ -211,14 +212,16 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 
 			DPRINTF(("TIOCSPGRP %d\n", pid));
 
-			return fo_ioctl(fp, TIOCSPGRP, (caddr_t) &pid, td);
+			return fo_ioctl(fp, TIOCSPGRP, (caddr_t) &pid,
+			    td->td_ucred, td);
 		}
 
 	case SVR4_TIOCGSID:
 		{
 #if defined(TIOCGSID)
 			pid_t pid;
-			if ((error = fo_ioctl(fp, TIOCGSID, (caddr_t) &pid, td)) != 0)
+			if ((error = fo_ioctl(fp, TIOCGSID, (caddr_t) &pid,
+			    td->td_ucred, td)) != 0)
 				return error;
 
 			DPRINTF(("TIOCGSID %d\n", pid));
@@ -235,7 +238,8 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 			struct sgttyb bs;
 			struct svr4_sgttyb ss;
 
-			error = fo_ioctl(fp, TIOCGETP, (caddr_t) &bs, td);
+			error = fo_ioctl(fp, TIOCGETP, (caddr_t) &bs,
+			    td->td_ucred, td);
 			if (error)
 				return error;
 
@@ -260,7 +264,8 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 			print_svr4_sgttyb("SVR4_TIOCSET{P,N}", &ss);
 #endif /* DEBUG_SVR4 */
 			cmd = (cmd == SVR4_TIOCSETP) ? TIOCSETP : TIOCSETN;
-			return fo_ioctl(fp, cmd, (caddr_t) &bs, td);
+			return fo_ioctl(fp, cmd, (caddr_t) &bs,
+			    td->td_ucred, td);
 		}
 
 	case SVR4_TIOCGETC:
@@ -268,7 +273,8 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 			struct tchars bt;
 			struct svr4_tchars st;
 
-			error = fo_ioctl(fp, TIOCGETC, (caddr_t) &bt, td);
+			error = fo_ioctl(fp, TIOCGETC, (caddr_t) &bt,
+			    td->td_ucred, td);
 			if (error)
 				return error;
 
@@ -291,7 +297,8 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 #ifdef DEBUG_SVR4
 			print_svr4_tchars("SVR4_TIOCSETC", &st);
 #endif /* DEBUG_SVR4 */
-			return fo_ioctl(fp, TIOCSETC, (caddr_t) &bt, td);
+			return fo_ioctl(fp, TIOCSETC, (caddr_t) &bt,
+			    td->td_ucred, td);
 		}
 
 	case SVR4_TIOCGLTC:
@@ -299,7 +306,8 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 			struct ltchars bl;
 			struct svr4_ltchars sl;
 
-			error = fo_ioctl(fp, TIOCGLTC, (caddr_t) &bl, td);
+			error = fo_ioctl(fp, TIOCGLTC, (caddr_t) &bl,
+			    td->td_ucred, td);
 			if (error)
 				return error;
 
@@ -322,13 +330,15 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 #ifdef DEBUG_SVR4
 			print_svr4_ltchars("SVR4_TIOCSLTC", &sl);
 #endif /* DEBUG_SVR4 */
-			return fo_ioctl(fp, TIOCSLTC, (caddr_t) &bl, td);
+			return fo_ioctl(fp, TIOCSLTC, (caddr_t) &bl,
+			    td->td_ucred, td);
 		}
 
 	case SVR4_TIOCLGET:
 		{
 			int flags;
-			if ((error = fo_ioctl(fp, TIOCLGET, (caddr_t) &flags, td)) != 0)
+			if ((error = fo_ioctl(fp, TIOCLGET, (caddr_t) &flags,
+			    td->td_ucred, td)) != 0)
 				return error;
 			DPRINTF(("SVR4_TIOCLGET %o\n", flags));
 			return copyout(&flags, data, sizeof(flags));
@@ -356,7 +366,8 @@ svr4_ttold_ioctl(fp, td, retval, fd, cmd, data)
 			}
 
 			DPRINTF(("SVR4_TIOCL{SET,BIS,BIC} %o\n", flags));
-			return fo_ioctl(fp, cmd, (caddr_t) &flags, td);
+			return fo_ioctl(fp, cmd, (caddr_t) &flags,
+			    td->td_ucred, td);
 		}
 
 	default:
diff --git a/sys/dev/aac/aac.c b/sys/dev/aac/aac.c
index 8b3b55e..6192550 100644
--- a/sys/dev/aac/aac.c
+++ b/sys/dev/aac/aac.c
@@ -2535,7 +2535,7 @@ aac_linux_ioctl(struct thread *td, struct linux_ioctl_args *args)
 	/*
 	 * Pass the ioctl off to our standard handler.
 	 */
-	error = (fo_ioctl(fp, cmd, (caddr_t)args->arg, td));
+	error = (fo_ioctl(fp, cmd, (caddr_t)args->arg, td->td_ucred, td));
 	fdrop(fp, td);
 	return (error);
 }
diff --git a/sys/dev/drm/drm_drv.h b/sys/dev/drm/drm_drv.h
index 7013955..cb50e1e 100644
--- a/sys/dev/drm/drm_drv.h
+++ b/sys/dev/drm/drm_drv.h
@@ -1439,7 +1439,11 @@ DRM(linux_ioctl)(DRM_OS_STRUCTPROC *p, struct linux_ioctl_args* args)
     /*
      * Pass the ioctl off to our standard handler.
      */
+#if (__FreeBSD_version >= 500000)
+    return(fo_ioctl(fp, cmd, data, p->td_ucred, p));
+#else
     return(fo_ioctl(fp, cmd, data, p));
+#endif
 }
 #endif /* DRM_LINUX */
 #endif /* __FreeBSD__ */
diff --git a/sys/dev/tdfx/tdfx_pci.c b/sys/dev/tdfx/tdfx_pci.c
index 3184925..0530cd8 100644
--- a/sys/dev/tdfx/tdfx_pci.c
+++ b/sys/dev/tdfx/tdfx_pci.c
@@ -848,7 +848,7 @@ linux_ioctl_tdfx(struct thread *td, struct linux_ioctl_args* args)
 	   return (error);
    /* We simply copy the data and send it right to ioctl */
    copyin((caddr_t)args->arg, &d_pio, sizeof(d_pio));
-   error = fo_ioctl(fp, cmd, (caddr_t)&d_pio, td);
+   error = fo_ioctl(fp, cmd, (caddr_t)&d_pio, td->td_ucred, td);
    fdrop(fp, td);
    return error;
 }
diff --git a/sys/fs/fifofs/fifo_vnops.c b/sys/fs/fifofs/fifo_vnops.c
index f862309..9a674fc 100644
--- a/sys/fs/fifofs/fifo_vnops.c
+++ b/sys/fs/fifofs/fifo_vnops.c
@@ -348,13 +348,17 @@ fifo_ioctl(ap)
 		return (0);
 	if (ap->a_fflag & FREAD) {
 		filetmp.f_data = (caddr_t)ap->a_vp->v_fifoinfo->fi_readsock;
-		error = soo_ioctl(&filetmp, ap->a_command, ap->a_data, ap->a_td);
+		filetmp.f_cred = ap->a_cred;
+		error = soo_ioctl(&filetmp, ap->a_command, ap->a_data,
+		    ap->a_td->td_ucred, ap->a_td);
 		if (error)
 			return (error);
 	}
 	if (ap->a_fflag & FWRITE) {
 		filetmp.f_data = (caddr_t)ap->a_vp->v_fifoinfo->fi_writesock;
-		error = soo_ioctl(&filetmp, ap->a_command, ap->a_data, ap->a_td);
+		filetmp.f_cred = ap->a_cred;
+		error = soo_ioctl(&filetmp, ap->a_command, ap->a_data,
+		    ap->a_td->td_ucred, ap->a_td);
 		if (error)
 			return (error);
 	}
diff --git a/sys/i386/ibcs2/ibcs2_fcntl.c b/sys/i386/ibcs2/ibcs2_fcntl.c
index 1a2a22a..6ada6c9 100644
--- a/sys/i386/ibcs2/ibcs2_fcntl.c
+++ b/sys/i386/ibcs2/ibcs2_fcntl.c
@@ -203,7 +203,8 @@ ibcs2_open(td, uap)
 
 		/* ignore any error, just give it a try */
 		if (fp->f_type == DTYPE_VNODE)
-			fo_ioctl(fp, TIOCSCTTY, (caddr_t) 0, td);
+			fo_ioctl(fp, TIOCSCTTY, (caddr_t) 0, td->td_ucred,
+			    td);
 		fdrop(fp, td);
 	} else
 		PROC_UNLOCK(p);
diff --git a/sys/i386/ibcs2/ibcs2_ioctl.c b/sys/i386/ibcs2/ibcs2_ioctl.c
index b192b61..dc25012 100644
--- a/sys/i386/ibcs2/ibcs2_ioctl.c
+++ b/sys/i386/ibcs2/ibcs2_ioctl.c
@@ -365,7 +365,8 @@ ibcs2_ioctl(td, uap)
 		struct ibcs2_termios sts;
 		struct ibcs2_termio st;
 	
-		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bts, td)) != 0)
+		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bts,
+		    td->td_ucred, td)) != 0)
 			break;
 	
 		btios2stios (&bts, &sts);
@@ -403,7 +404,8 @@ ibcs2_ioctl(td, uap)
 		}
 
 		/* get full BSD termios so we don't lose information */
-		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bts, td)) != 0) {
+		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bts,
+		    td->td_ucred, td)) != 0) {
 			DPRINTF(("ibcs2_ioctl(%d): TCSET ctl failed fd %d ",
 				 p->p_pid, SCARG(uap, fd)));
 			break;
@@ -418,7 +420,7 @@ ibcs2_ioctl(td, uap)
 		stios2btios(&sts, &bts);
 
 		error = fo_ioctl(fp, SCARG(uap, cmd) - IBCS2_TCSETA + TIOCSETA,
-			      (caddr_t)&bts, td);
+			      (caddr_t)&bts, td->td_ucred, td);
 		break;
 	    }
 
@@ -434,7 +436,7 @@ ibcs2_ioctl(td, uap)
 			break;
 		stios2btios (&sts, &bts);
 		error = fo_ioctl(fp, SCARG(uap, cmd) - IBCS2_XCSETA + TIOCSETA,
-			      (caddr_t)&bts, td);
+			      (caddr_t)&bts, td->td_ucred, td);
 		break;
 	    }
 
@@ -450,7 +452,7 @@ ibcs2_ioctl(td, uap)
 			break;
 		stios2btios (&sts, &bts);
 		error = fo_ioctl(fp, SCARG(uap, cmd) - IBCS2_OXCSETA + TIOCSETA,
-			      (caddr_t)&bts, td);
+			      (caddr_t)&bts, td->td_ucred, td);
 		break;
 	    }
 
@@ -468,10 +470,12 @@ ibcs2_ioctl(td, uap)
 			error = ENOSYS;
 			break;
 		case 2:
-			error = fo_ioctl(fp, TIOCSTOP, (caddr_t)0, td);
+			error = fo_ioctl(fp, TIOCSTOP, (caddr_t)0,
+			    td->td_ucred, td);
 			break;
 		case 3:
-			error = fo_ioctl(fp, TIOCSTART, (caddr_t)1, td);
+			error = fo_ioctl(fp, TIOCSTART, (caddr_t)1,
+			    td->td_ucred, td);
 			break;
 		default:
 			error = EINVAL;
@@ -498,7 +502,8 @@ ibcs2_ioctl(td, uap)
 			fdrop(fp, td);
 			return EINVAL;
 		}
-		error = fo_ioctl(fp, TIOCFLUSH, (caddr_t)&arg, td);
+		error = fo_ioctl(fp, TIOCFLUSH, (caddr_t)&arg, td->td_ucred,
+		    td);
 		break;
 	    }
 
diff --git a/sys/kern/kern_descrip.c b/sys/kern/kern_descrip.c
index bc09bfd..37dc894 100644
--- a/sys/kern/kern_descrip.c
+++ b/sys/kern/kern_descrip.c
@@ -101,7 +101,7 @@ static int do_dup(struct filedesc *fdp, int old, int new, register_t *retval,
 static int badfo_readwrite(struct file *fp, struct uio *uio,
     struct ucred *active_cred, int flags, struct thread *td);
 static int badfo_ioctl(struct file *fp, u_long com, void *data,
-    struct thread *td);
+    struct ucred *active_cred, struct thread *td);
 static int badfo_poll(struct file *fp, int events,
     struct ucred *active_cred, struct thread *td);
 static int badfo_kqfilter(struct file *fp, struct knote *kn);
@@ -315,34 +315,35 @@ fcntl(td, uap)
 		fp->f_flag &= ~FCNTLFLAGS;
 		fp->f_flag |= FFLAGS(uap->arg & ~O_ACCMODE) & FCNTLFLAGS;
 		tmp = fp->f_flag & FNONBLOCK;
-		error = fo_ioctl(fp, FIONBIO, &tmp, td);
+		error = fo_ioctl(fp, FIONBIO, &tmp, td->td_ucred, td);
 		if (error) {
 			fdrop(fp, td);
 			break;
 		}
 		tmp = fp->f_flag & FASYNC;
-		error = fo_ioctl(fp, FIOASYNC, &tmp, td);
+		error = fo_ioctl(fp, FIOASYNC, &tmp, td->td_ucred, td);
 		if (!error) {
 			fdrop(fp, td);
 			break;
 		}
 		fp->f_flag &= ~FNONBLOCK;
 		tmp = 0;
-		(void)fo_ioctl(fp, FIONBIO, &tmp, td);
+		(void)fo_ioctl(fp, FIONBIO, &tmp, td->td_ucred, td);
 		fdrop(fp, td);
 		break;
 
 	case F_GETOWN:
 		fhold(fp);
 		FILEDESC_UNLOCK(fdp);
-		error = fo_ioctl(fp, FIOGETOWN, (void *)td->td_retval, td);
+		error = fo_ioctl(fp, FIOGETOWN, (void *)td->td_retval,
+		    td->td_ucred, td);
 		fdrop(fp, td);
 		break;
 
 	case F_SETOWN:
 		fhold(fp);
 		FILEDESC_UNLOCK(fdp);
-		error = fo_ioctl(fp, FIOSETOWN, &uap->arg, td);
+		error = fo_ioctl(fp, FIOSETOWN, &uap->arg, td->td_ucred, td);
 		fdrop(fp, td);
 		break;
 
@@ -2159,10 +2160,11 @@ badfo_readwrite(fp, uio, active_cred, flags, td)
 }
 
 static int
-badfo_ioctl(fp, com, data, td)
+badfo_ioctl(fp, com, data, active_cred, td)
 	struct file *fp;
 	u_long com;
 	void *data;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 
diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c
index 820775d..d8bc894 100644
--- a/sys/kern/kern_event.c
+++ b/sys/kern/kern_event.c
@@ -61,7 +61,7 @@ static int 	kqueue_read(struct file *fp, struct uio *uio,
 static int	kqueue_write(struct file *fp, struct uio *uio,
 		    struct ucred *active_cred, int flags, struct thread *td);
 static int	kqueue_ioctl(struct file *fp, u_long com, void *data,
-		    struct thread *td);
+		    struct ucred *active_cred, struct thread *td);
 static int 	kqueue_poll(struct file *fp, int events,
 		    struct ucred *active_cred, struct thread *td);
 static int 	kqueue_kqfilter(struct file *fp, struct knote *kn);
@@ -794,7 +794,8 @@ kqueue_write(struct file *fp, struct uio *uio, struct ucred *active_cred,
 
 /*ARGSUSED*/
 static int
-kqueue_ioctl(struct file *fp, u_long com, void *data, struct thread *td)
+kqueue_ioctl(struct file *fp, u_long com, void *data,
+	struct ucred *active_cred, struct thread *td)
 {
 	return (ENOTTY);
 }
diff --git a/sys/kern/sys_generic.c b/sys/kern/sys_generic.c
index 55babb2..8e209bb 100644
--- a/sys/kern/sys_generic.c
+++ b/sys/kern/sys_generic.c
@@ -656,7 +656,7 @@ ioctl(td, uap)
 		else
 			fp->f_flag &= ~FNONBLOCK;
 		FILE_UNLOCK(fp);
-		error = fo_ioctl(fp, FIONBIO, &tmp, td);
+		error = fo_ioctl(fp, FIONBIO, &tmp, td->td_ucred, td);
 		break;
 
 	case FIOASYNC:
@@ -666,11 +666,11 @@ ioctl(td, uap)
 		else
 			fp->f_flag &= ~FASYNC;
 		FILE_UNLOCK(fp);
-		error = fo_ioctl(fp, FIOASYNC, &tmp, td);
+		error = fo_ioctl(fp, FIOASYNC, &tmp, td->td_ucred, td);
 		break;
 
 	default:
-		error = fo_ioctl(fp, com, data, td);
+		error = fo_ioctl(fp, com, data, td->td_ucred, td);
 		/*
 		 * Copy any data to user, size was
 		 * already set and checked above.
diff --git a/sys/kern/sys_pipe.c b/sys/kern/sys_pipe.c
index 624ac6b..d956501 100644
--- a/sys/kern/sys_pipe.c
+++ b/sys/kern/sys_pipe.c
@@ -105,7 +105,7 @@ static int pipe_kqfilter(struct file *fp, struct knote *kn);
 static int pipe_stat(struct file *fp, struct stat *sb,
 		struct ucred *active_cred, struct thread *td);
 static int pipe_ioctl(struct file *fp, u_long cmd, void *data,
-		struct thread *td);
+		struct ucred *active_cred, struct thread *td);
 
 static struct fileops pipeops = {
 	pipe_read, pipe_write, pipe_ioctl, pipe_poll, pipe_kqfilter,
@@ -1155,10 +1155,11 @@ pipe_write(fp, uio, active_cred, flags, td)
  * we implement a very minimal set of ioctls for compatibility with sockets.
  */
 int
-pipe_ioctl(fp, cmd, data, td)
+pipe_ioctl(fp, cmd, data, active_cred, td)
 	struct file *fp;
 	u_long cmd;
 	void *data;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 	struct pipe *mpipe = (struct pipe *)fp->f_data;
@@ -1166,7 +1167,7 @@ pipe_ioctl(fp, cmd, data, td)
 	int error;
 
 	/* XXXMAC: Pipe should be locked for this check. */
-	error = mac_check_pipe_ioctl(td->td_ucred, mpipe, cmd, data);
+	error = mac_check_pipe_ioctl(active_cred, mpipe, cmd, data);
 	if (error)
 		return (error);
 #endif
diff --git a/sys/kern/sys_socket.c b/sys/kern/sys_socket.c
index 53ca5b9..b4a9442 100644
--- a/sys/kern/sys_socket.c
+++ b/sys/kern/sys_socket.c
@@ -93,10 +93,11 @@ soo_write(fp, uio, active_cred, flags, td)
 }
 
 int
-soo_ioctl(fp, cmd, data, td)
+soo_ioctl(fp, cmd, data, active_cred, td)
 	struct file *fp;
 	u_long cmd;
 	void *data;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 	register struct socket *so = (struct socket *)fp->f_data;
diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c
index af5faed..07e5fc9 100644
--- a/sys/kern/vfs_vnops.c
+++ b/sys/kern/vfs_vnops.c
@@ -65,7 +65,7 @@
 
 static int vn_closefile(struct file *fp, struct thread *td);
 static int vn_ioctl(struct file *fp, u_long com, void *data, 
-		struct thread *td);
+		struct ucred *active_cred, struct thread *td);
 static int vn_read(struct file *fp, struct uio *uio, 
 		struct ucred *active_cred, int flags, struct thread *td);
 static int vn_poll(struct file *fp, int events, struct ucred *active_cred,
@@ -721,10 +721,11 @@ vn_stat(vp, sb, active_cred, file_cred, td)
  * File table vnode ioctl routine.
  */
 static int
-vn_ioctl(fp, com, data, td)
+vn_ioctl(fp, com, data, active_cred, td)
 	struct file *fp;
 	u_long com;
 	void *data;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 	register struct vnode *vp = ((struct vnode *)fp->f_data);
@@ -738,7 +739,7 @@ vn_ioctl(fp, com, data, td)
 	case VDIR:
 		if (com == FIONREAD) {
 			vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
-			error = VOP_GETATTR(vp, &vattr, td->td_ucred, td);
+			error = VOP_GETATTR(vp, &vattr, active_cred, td);
 			VOP_UNLOCK(vp, 0, td);
 			if (error)
 				return (error);
@@ -762,7 +763,7 @@ vn_ioctl(fp, com, data, td)
 			*(int *)data = devsw(vp->v_rdev)->d_flags & D_TYPEMASK;
 			return (0);
 		}
-		error = VOP_IOCTL(vp, com, data, fp->f_flag, td->td_ucred, td);
+		error = VOP_IOCTL(vp, com, data, fp->f_flag, active_cred, td);
 		if (error == 0 && com == TIOCSCTTY) {
 
 			/* Do nothing if reassigning same control tty */
diff --git a/sys/sys/file.h b/sys/sys/file.h
index 9b1ad41..525fb4e 100644
--- a/sys/sys/file.h
+++ b/sys/sys/file.h
@@ -88,7 +88,7 @@ struct file {
 			    struct thread *td);
 #define	FOF_OFFSET	1
 		int	(*fo_ioctl)(struct file *fp, u_long com, void *data,
-			    struct thread *td);
+			    struct ucred *active_cred, struct thread *td);
 		int	(*fo_poll)(struct file *fp, int events,
 			    struct ucred *active_cred, struct thread *td);
 		int	(*fo_kqfilter)(struct file *fp, struct knote *kn);
@@ -180,7 +180,7 @@ static __inline int fo_read(struct file *fp, struct uio *uio,
 static __inline int fo_write(struct file *fp, struct uio *uio,
     struct ucred *active_cred, int flags, struct thread *td);
 static __inline int fo_ioctl(struct file *fp, u_long com, void *data,
-    struct thread *td);
+    struct ucred *active_cred, struct thread *td);
 static __inline int fo_poll(struct file *fp, int events,
     struct ucred *active_cred, struct thread *td);
 static __inline int fo_stat(struct file *fp, struct stat *sb,
@@ -214,14 +214,15 @@ fo_write(fp, uio, active_cred, flags, td)
 }
 
 static __inline int
-fo_ioctl(fp, com, data, td)
+fo_ioctl(fp, com, data, active_cred, td)
 	struct file *fp;
 	u_long com;
 	void *data;
+	struct ucred *active_cred;
 	struct thread *td;
 {
 
-	return ((*fp->f_ops->fo_ioctl)(fp, com, data, td));
+	return ((*fp->f_ops->fo_ioctl)(fp, com, data, active_cred, td));
 }
 
 static __inline int
diff --git a/sys/sys/socketvar.h b/sys/sys/socketvar.h
index e352b4f..15a7a00 100644
--- a/sys/sys/socketvar.h
+++ b/sys/sys/socketvar.h
@@ -351,7 +351,7 @@ int	soo_write(struct file *fp, struct uio *uio,
 	    struct ucred *active_cred, int flags, struct thread *td);
 int	soo_close(struct file *fp, struct thread *td);
 int	soo_ioctl(struct file *fp, u_long cmd, void *data,
-	    struct thread *td);
+	    struct ucred *active_cred, struct thread *td);
 int	soo_poll(struct file *fp, int events, struct ucred *active_cred,
 	    struct thread *td);
 int	soo_stat(struct file *fp, struct stat *ub, struct ucred *active_cred,