Eliminate now-unused SUSER_ALLOWJAIL arguments to priv_check_cred(); in

some cases, move to priv_check() if it was an operation on a thread and
no other flags were present.

Eliminate caller-side jail exception checking (also now-unused); jail
privilege exception code now goes solely in kern_jail.c.

We can't yet eliminate suser() due to some cases in the KAME code where
a privilege check is performed and then used in many different deferred
paths.  Do, however, move those prototypes to priv.h.

Reviewed by:	csjp
Obtained from:	TrustedBSD Project

1 files changed, 12 insertions, 0 deletions

diff --git a/sys/sys/priv.h b/sys/sys/priv.h
index 2b215c8..e79cc40 100644
--- a/sys/sys/priv.h
+++ b/sys/sys/priv.h
@@ -466,6 +466,18 @@ struct thread;
 struct ucred;
 int	priv_check(struct thread *td, int priv);
 int	priv_check_cred(struct ucred *cred, int priv, int flags);
+
+/*
+ * Continue to support external modules that rely on suser(9) -- for now.
+ */
+int	suser(struct thread *td);
+int	suser_cred(struct ucred *cred, int flags);
+
+/*
+ * For historical reasons, flags to priv_check_cred() retain the SUSER_
+ * prefix.
+ */
+#define	SUSER_RUID	2
 #endif
 
 #endif /* !_SYS_PRIV_H_ */