Add PRIV_VFS_STAT privilege, which will allow overriding policy limits on

the right to stat() a file, such as in mac_bsdextended.

Obtained from:	TrustedBSD Project
MFC after:	3 months

sys/kern/kern_jail.c

@@ -684,6 +684,7 @@ prison_priv_check(struct ucred *cred, int priv)
 	case PRIV_VFS_FCHROOT:
 	case PRIV_VFS_LINK:
 	case PRIV_VFS_SETGID:
+	case PRIV_VFS_STAT:
 	case PRIV_VFS_STICKYFILE:
 		return (0);
 

sys/sys/priv.h

@@ -277,6 +277,7 @@
 #define	PRIV_VFS_STICKYFILE	341	/* Can set sticky bit on file. */
 #define	PRIV_VFS_SYSFLAGS	342	/* Can modify system flags. */
 #define	PRIV_VFS_UNMOUNT	343	/* Can unmount(). */
+#define	PRIV_VFS_STAT		344	/* Override vnode MAC stat perm. */
 
 /*
  * Virtual memory privileges.