6 files changed, 38 insertions, 13 deletions

diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c
index 562e835..f02aab4 100644
--- a/sys/kern/kern_prot.c
+++ b/sys/kern/kern_prot.c
@@ -59,6 +59,8 @@
 #include <sys/jail.h>
 #include <sys/pioctl.h>
 #include <sys/resourcevar.h>
+#include <sys/socket.h>
+#include <sys/socketvar.h>
 #include <sys/sysctl.h>
 
 static MALLOC_DEFINE(M_CRED, "cred", "credentials");
@@ -1676,6 +1678,27 @@ p_candebug(struct proc *p1, struct proc *p2)
 	return (0);
 }
 
+/*-
+ * Determine whether the subject represented by cred can "see" a socket.
+ * Returns: 0 for permitted, ENOENT otherwise.
+ */
+int
+cr_canseesocket(struct ucred *cred, struct socket *so)
+{
+	int error;
+
+	error = prison_check(cred, so->so_cred);
+	if (error)
+		return (ENOENT);
+	if (cr_seeotheruids(cred, so->so_cred))
+		return (ENOENT);
+#ifdef MAC
+	/* XXX: error = mac_cred_check_seesocket() here. */
+#endif
+
+	return (0);
+}
+
 /*
  * Allocate a zeroed cred structure.
  */
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index 1f533e1..60d3988 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -629,8 +629,8 @@ rip_pcblist(SYSCTL_HANDLER_ARGS)
 	for (inp = LIST_FIRST(ripcbinfo.listhead), i = 0; inp && i < n;
 	     inp = LIST_NEXT(inp, inp_list)) {
 		if (inp->inp_gencnt <= gencnt) {
-			if (cr_cansee(req->td->td_ucred, 
-			    inp->inp_socket->so_cred))
+			if (cr_canseesocket(req->td->td_ucred,
+			    inp->inp_socket))
 				continue;
 			inp_list[i++] = inp;
 		}
diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c
index fb71ac7..db910e0 100644
--- a/sys/netinet/tcp_subr.c
+++ b/sys/netinet/tcp_subr.c
@@ -849,8 +849,8 @@ tcp_pcblist(SYSCTL_HANDLER_ARGS)
 	for (inp = LIST_FIRST(tcbinfo.listhead), i = 0; inp && i < n;
 	     inp = LIST_NEXT(inp, inp_list)) {
 		if (inp->inp_gencnt <= gencnt) {
-			if (cr_cansee(req->td->td_ucred,
-			    inp->inp_socket->so_cred))
+			if (cr_canseesocket(req->td->td_ucred,
+			    inp->inp_socket))
 				continue;
 			inp_list[i++] = inp;
 		}
@@ -920,7 +920,7 @@ tcp_getcred(SYSCTL_HANDLER_ARGS)
 		error = ENOENT;
 		goto out;
 	}
-	error = cr_cansee(req->td->td_ucred, inp->inp_socket->so_cred);
+	error = cr_canseesocket(req->td->td_ucred, inp->inp_socket);
 	if (error)
 		goto out;
 	cru2x(inp->inp_socket->so_cred, &xuc);
@@ -972,7 +972,7 @@ tcp6_getcred(SYSCTL_HANDLER_ARGS)
 		error = ENOENT;
 		goto out;
 	}
-	error = cr_cansee(req->td->td_ucred, inp->inp_socket->so_cred);
+	error = cr_canseesocket(req->td->td_ucred, inp->inp_socket);
 	if (error)
 		goto out;
 	cru2x(inp->inp_socket->so_cred, &xuc);
diff --git a/sys/netinet/tcp_timewait.c b/sys/netinet/tcp_timewait.c
index fb71ac7..db910e0 100644
--- a/sys/netinet/tcp_timewait.c
+++ b/sys/netinet/tcp_timewait.c
@@ -849,8 +849,8 @@ tcp_pcblist(SYSCTL_HANDLER_ARGS)
 	for (inp = LIST_FIRST(tcbinfo.listhead), i = 0; inp && i < n;
 	     inp = LIST_NEXT(inp, inp_list)) {
 		if (inp->inp_gencnt <= gencnt) {
-			if (cr_cansee(req->td->td_ucred,
-			    inp->inp_socket->so_cred))
+			if (cr_canseesocket(req->td->td_ucred,
+			    inp->inp_socket))
 				continue;
 			inp_list[i++] = inp;
 		}
@@ -920,7 +920,7 @@ tcp_getcred(SYSCTL_HANDLER_ARGS)
 		error = ENOENT;
 		goto out;
 	}
-	error = cr_cansee(req->td->td_ucred, inp->inp_socket->so_cred);
+	error = cr_canseesocket(req->td->td_ucred, inp->inp_socket);
 	if (error)
 		goto out;
 	cru2x(inp->inp_socket->so_cred, &xuc);
@@ -972,7 +972,7 @@ tcp6_getcred(SYSCTL_HANDLER_ARGS)
 		error = ENOENT;
 		goto out;
 	}
-	error = cr_cansee(req->td->td_ucred, inp->inp_socket->so_cred);
+	error = cr_canseesocket(req->td->td_ucred, inp->inp_socket);
 	if (error)
 		goto out;
 	cru2x(inp->inp_socket->so_cred, &xuc);
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 4426aa9..6a09dcd 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -584,8 +584,8 @@ udp_pcblist(SYSCTL_HANDLER_ARGS)
 	for (inp = LIST_FIRST(udbinfo.listhead), i = 0; inp && i < n;
 	     inp = LIST_NEXT(inp, inp_list)) {
 		if (inp->inp_gencnt <= gencnt) {
-			if (cr_cansee(req->td->td_ucred,
-			    inp->inp_socket->so_cred))
+			if (cr_canseesocket(req->td->td_ucred,
+			    inp->inp_socket))
 				continue;
 			inp_list[i++] = inp;
 		}
@@ -649,7 +649,7 @@ udp_getcred(SYSCTL_HANDLER_ARGS)
 		error = ENOENT;
 		goto out;
 	}
-	error = cr_cansee(req->td->td_ucred, inp->inp_socket->so_cred);
+	error = cr_canseesocket(req->td->td_ucred, inp->inp_socket);
 	if (error)
 		goto out;
 	cru2x(inp->inp_socket->so_cred, &xuc);
diff --git a/sys/sys/systm.h b/sys/sys/systm.h
index cf03dba..76606af 100644
--- a/sys/sys/systm.h
+++ b/sys/sys/systm.h
@@ -103,6 +103,7 @@ struct malloc_type;
 struct mtx;
 struct proc;
 struct kse;
+struct socket;
 struct thread;
 struct tty;
 struct ucred;
@@ -199,6 +200,7 @@ int	suser_td(struct thread *);
 int	suser_xxx(struct ucred *cred, struct proc *proc, int flag);
 int	suser_xxx_td(struct ucred *cred, struct thread *thread, int flag);
 int	cr_cansee(struct ucred *u1, struct ucred *u2);
+int	cr_canseesocket(struct ucred *cred, struct socket *so);
 
 char	*getenv(const char *name);
 int	getenv_int(const char *name, int *data);