 @@ -1,14 +1,14 @@
-/*	$NetBSD: uipc_socket.c,v 1.191 2009/10/02 23:50:16 elad Exp $	*/
+/*	$NetBSD: uipc_socket.c,v 1.192 2009/10/03 01:41:39 elad Exp $	*/
 /*-
  * Copyright (c) 2002, 2007, 2008, 2009 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Jason R. Thorpe of Wasabi Systems, Inc, and by Andrew Doran.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -53,27 +53,27 @@
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
+ *
  *	@(#)uipc_socket.c	8.6 (Berkeley) 5/2/95
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_socket.c,v 1.191 2009/10/02 23:50:16 elad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_socket.c,v 1.192 2009/10/03 01:41:39 elad Exp $");
 #include "opt_compat_netbsd.h"
 #include "opt_sock_counters.h"
 #include "opt_sosend_loan.h"
 #include "opt_mbuftrace.h"
 #include "opt_somaxkva.h"
 #include "opt_multiprocessor.h"	/* XXX */
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/proc.h>
 #include <sys/file.h>
 #include <sys/filedesc.h>
 @@ -460,26 +460,31 @@ socket_listener_cb(kauth_cred_t cred, ka
 		/* We allow "raw" routing/bluetooth sockets to anyone. */
 		if ((u_long)arg1 == PF_ROUTE || (u_long)arg1 == PF_BLUETOOTH)
 			result = KAUTH_RESULT_ALLOW;
 		else {
 			/* Privileged, let secmodel handle this. */
 			if ((u_long)arg2 == SOCK_RAW)
 				break;
+		}
 		result = KAUTH_RESULT_ALLOW;
 		break;
 	case KAUTH_REQ_NETWORK_SOCKET_CANSEE:
 		result = KAUTH_RESULT_ALLOW;
 		break;
 	default:
 		break;
+	}
 	return result;
+}
 void
 soinit(void)
+{
 	sysctl_kern_somaxkva_setup();

 @@ -1,14 +1,14 @@
-/* $NetBSD: secmodel_suser.c,v 1.18 2009/10/03 01:30:25 elad Exp $ */
+/* $NetBSD: secmodel_suser.c,v 1.19 2009/10/03 01:41:39 elad Exp $ */
 /*-
  * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 3. The name of the author may not be used to endorse or promote products
 @@ -28,27 +28,27 @@
 /*
  * This file contains kauth(9) listeners needed to implement the traditional
  * NetBSD superuser access restrictions.
+ *
  * There are two main resources a request can be issued to: user-owned and
  * system owned. For the first, traditional Unix access checks are done, as
  * well as superuser checks. If needed, the request context is examined before
  * a decision is made. For the latter, usually only superuser checks are done
  * as normal users are not allowed to access system resources.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.18 2009/10/03 01:30:25 elad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.19 2009/10/03 01:41:39 elad Exp $");
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/kauth.h>
 #include <sys/mutex.h>
 #include <sys/mount.h>
 #include <sys/socketvar.h>
 #include <sys/sysctl.h>
 #include <sys/vnode.h>
 #include <sys/proc.h>
 #include <sys/uidinfo.h>
 #include <sys/module.h>
 @@ -812,34 +812,34 @@ secmodel_suser_network_cb(kauth_cred_t c
 		case KAUTH_REQ_NETWORK_SOCKET_RAWSOCK:
 		case KAUTH_REQ_NETWORK_SOCKET_SETPRIV:
 			if (isroot)
 				result = KAUTH_RESULT_ALLOW;
 			break;
 		case KAUTH_REQ_NETWORK_SOCKET_CANSEE:
 			if (isroot) {
 				result = KAUTH_RESULT_ALLOW;
 				break;
+			}
 			if (secmodel_bsd44_curtain) {
 				struct socket *so;
 				uid_t so_uid;
-				so_uid =
+				so = (struct socket *)arg1;
-				    ((struct socket *)arg1)->so_uidinfo->ui_uid;
+				so_uid = so->so_uidinfo->ui_uid;
-				if (kauth_cred_geteuid(cred) == so_uid)
+				if (kauth_cred_geteuid(cred) != so_uid)
-					result = KAUTH_RESULT_ALLOW;
+					result = KAUTH_RESULT_DENY;
 			} else
 				result = KAUTH_RESULT_ALLOW;
 			break;
 		default:
 			break;
+		}
 		break;
 	default:
 		break;
+	}