From 4a5216a6dc0c3ce4cf5f2d3ee8af0c3ff3402c4f Mon Sep 17 00:00:00 2001
From: "Bjoern A. Zeeb" <bz@FreeBSD.org>
Date: Fri, 17 Oct 2008 08:58:33 +0000
Subject: [PATCH] Use the label from the socket credential rather than the
 solabel which was not set by the mac_partition policy.

Spotted by:	rwatson
Reviewed by:	rwatson
MFC after:	3 days
---
 sys/security/mac_partition/mac_partition.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sys/security/mac_partition/mac_partition.c b/sys/security/mac_partition/mac_partition.c
index 255e776f6a9..6a455a80b3d 100644
--- a/sys/security/mac_partition/mac_partition.c
+++ b/sys/security/mac_partition/mac_partition.c
@@ -51,6 +51,7 @@
 #include <sys/priv.h>
 #include <sys/proc.h>
 #include <sys/sbuf.h>
+#include <sys/socketvar.h>
 #include <sys/systm.h>
 #include <sys/sysctl.h>
 
@@ -248,7 +249,7 @@ partition_socket_check_visible(struct ucred *cred, struct socket *so,
 {
 	int error;
 
-	error = label_on_label(cred->cr_label, solabel);
+	error = label_on_label(cred->cr_label, so->so_cred->cr_label);
 
 	return (error ? ENOENT : 0);
 }