change arguments to suser. suser now takes the process, and a flags

argument.  old cred only calls user suser_ucred.  this will allow future
work to more flexibly implement the idea of a root process.  looks like
something i saw in freebsd, but a little different.
use of suser_ucred vs suser in file system code should be looked at again,
for the moment semantics remain unchanged.
review and input from art@  testing and further review miod@

100 files changed, 344 insertions, 325 deletions

diff --git a/sys/arch/alpha/alpha/mem.c b/sys/arch/alpha/alpha/mem.c
index 09f4ff09984..d6976678229 100644
--- a/sys/arch/alpha/alpha/mem.c
+++ b/sys/arch/alpha/alpha/mem.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mem.c,v 1.18 2003/06/02 23:27:43 millert Exp $ */
+/* $OpenBSD: mem.c,v 1.19 2003/08/15 20:32:12 tedu Exp $ */
 /* $NetBSD: mem.c,v 1.26 2000/03/29 03:48:20 simonb Exp $ */
 
 /*
@@ -82,7 +82,7 @@ mmopen(dev, flag, mode, p)
 		return (0);
 #ifdef APERTURE
 	case 4:
-	        if (suser(p->p_ucred, &p->p_acflag) != 0 || !allowaperture)
+	        if (suser(p, 0) != 0 || !allowaperture)
 			return (EPERM);
 
 		/* authorize only one simultaneous open() from the same pid */
diff --git a/sys/arch/hp300/dev/apci.c b/sys/arch/hp300/dev/apci.c
index 3d76088ae8f..312e589d1ab 100644
--- a/sys/arch/hp300/dev/apci.c
+++ b/sys/arch/hp300/dev/apci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: apci.c,v 1.13 2003/06/04 22:08:12 deraadt Exp $	*/
+/*	$OpenBSD: apci.c,v 1.14 2003/08/15 20:32:12 tedu Exp $	*/
 /*	$NetBSD: apci.c,v 1.9 2000/11/02 00:35:05 eeh Exp $	*/
 
 /*-
@@ -674,7 +674,7 @@ apciioctl(dev, cmd, data, flag, p)
 	case TIOCSFLAGS: {
 		int userbits;
 
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error)
 			return (EPERM);
 
diff --git a/sys/arch/hp300/dev/dca.c b/sys/arch/hp300/dev/dca.c
index 97c037d3fa3..922e427ecb1 100644
--- a/sys/arch/hp300/dev/dca.c
+++ b/sys/arch/hp300/dev/dca.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dca.c,v 1.16 2003/06/02 23:27:44 millert Exp $	*/
+/*	$OpenBSD: dca.c,v 1.17 2003/08/15 20:32:12 tedu Exp $	*/
 /*	$NetBSD: dca.c,v 1.35 1997/05/05 20:58:18 thorpej Exp $	*/
 
 /*
@@ -733,7 +733,7 @@ dcaioctl(dev, cmd, data, flag, p)
 	case TIOCSFLAGS: {
 		int userbits;
 
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error)
 			return (EPERM);
 
diff --git a/sys/arch/hp300/dev/dcm.c b/sys/arch/hp300/dev/dcm.c
index a313ccbe432..5fe84ec323e 100644
--- a/sys/arch/hp300/dev/dcm.c
+++ b/sys/arch/hp300/dev/dcm.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dcm.c,v 1.14 2003/06/02 23:27:44 millert Exp $	*/
+/*	$OpenBSD: dcm.c,v 1.15 2003/08/15 20:32:13 tedu Exp $	*/
 /*	$NetBSD: dcm.c,v 1.41 1997/05/05 20:59:16 thorpej Exp $	*/
 
 /*
@@ -1031,7 +1031,7 @@ dcmioctl(dev, cmd, data, flag, p)
 	case TIOCSFLAGS: {
 		int userbits;
 
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error)
 			return (EPERM);
 
diff --git a/sys/arch/hp300/dev/sd.c b/sys/arch/hp300/dev/sd.c
index 5a02b64aac5..c83ffda1e90 100644
--- a/sys/arch/hp300/dev/sd.c
+++ b/sys/arch/hp300/dev/sd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sd.c,v 1.30 2003/06/02 23:27:45 millert Exp $	*/
+/*	$OpenBSD: sd.c,v 1.31 2003/08/15 20:32:13 tedu Exp $	*/
 /*	$NetBSD: sd.c,v 1.34 1997/07/10 18:14:10 kleink Exp $	*/
 
 /*
@@ -1109,7 +1109,7 @@ sdioctl(dev, cmd, data, flag, p)
 
 	case SDIOCSFORMAT:
 		/* take this device into or out of "format" mode */
-		if (suser(p->p_ucred, &p->p_acflag))
+		if (suser(p, 0))
 			return(EPERM);
 
 		if (*(int *)data) {
diff --git a/sys/arch/i386/i386/linux_machdep.c b/sys/arch/i386/i386/linux_machdep.c
index 865767cec23..5e4abf72251 100644
--- a/sys/arch/i386/i386/linux_machdep.c
+++ b/sys/arch/i386/i386/linux_machdep.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: linux_machdep.c,v 1.28 2003/05/13 03:49:04 art Exp $	*/
+/*	$OpenBSD: linux_machdep.c,v 1.29 2003/08/15 20:32:13 tedu Exp $	*/
 /*	$NetBSD: linux_machdep.c,v 1.29 1996/05/03 19:42:11 christos Exp $	*/
 
 /*
@@ -635,7 +635,7 @@ linux_sys_iopl(p, v, retval)
 #endif
 	struct trapframe *fp = p->p_md.md_regs;
 
-	if (suser(p->p_ucred, &p->p_acflag) != 0)
+	if (suser(p, 0) != 0)
 		return EPERM;
 	if (securelevel > 0)
 		return EPERM;
@@ -661,7 +661,7 @@ linux_sys_ioperm(p, v, retval)
 	} */ *uap = v;
 	struct trapframe *fp = p->p_md.md_regs;
 
-	if (suser(p->p_ucred, &p->p_acflag) != 0)
+	if (suser(p, 0) != 0)
 		return EPERM;
 	if (securelevel > 0)
 		return EPERM;
diff --git a/sys/arch/i386/i386/mem.c b/sys/arch/i386/i386/mem.c
index f24eac1c19b..fe2edbf4b56 100644
--- a/sys/arch/i386/i386/mem.c
+++ b/sys/arch/i386/i386/mem.c
@@ -1,5 +1,5 @@
 /*	$NetBSD: mem.c,v 1.31 1996/05/03 19:42:19 christos Exp $	*/
-/*	$OpenBSD: mem.c,v 1.26 2003/06/02 23:27:47 millert Exp $ */
+/*	$OpenBSD: mem.c,v 1.27 2003/08/15 20:32:13 tedu Exp $ */
 /*
  * Copyright (c) 1988 University of Utah.
  * Copyright (c) 1982, 1986, 1990, 1993
@@ -90,7 +90,7 @@ mmopen(dev, flag, mode, p)
 		break;
 #ifdef APERTURE
 	case 4:
-	        if (suser(p->p_ucred, &p->p_acflag) != 0 || !allowaperture)
+	        if (suser(p, 0) != 0 || !allowaperture)
 			return (EPERM);
 
 		/* authorize only one simultaneous open() */
@@ -225,7 +225,7 @@ mmmmap(dev, off, prot)
 /* minor device 0 is physical memory */
 	case 0:
 		if ((u_int)off > ctob(physmem) &&
-		    suser(p->p_ucred, &p->p_acflag) != 0)
+		    suser(p, 0) != 0)
 			return -1;
 		return i386_btop((u_int)off);
 
diff --git a/sys/arch/i386/i386/sys_machdep.c b/sys/arch/i386/i386/sys_machdep.c
index e4afb9e9068..fa12399a187 100644
--- a/sys/arch/i386/i386/sys_machdep.c
+++ b/sys/arch/i386/i386/sys_machdep.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sys_machdep.c,v 1.21 2003/06/02 23:27:47 millert Exp $	*/
+/*	$OpenBSD: sys_machdep.c,v 1.22 2003/08/15 20:32:13 tedu Exp $	*/
 /*	$NetBSD: sys_machdep.c,v 1.28 1996/05/03 19:42:29 christos Exp $	*/
 
 /*-
@@ -317,7 +317,7 @@ i386_iopl(p, args, retval)
 	struct trapframe *tf = p->p_md.md_regs;
 	struct i386_iopl_args ua;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return error;
 #ifdef APERTURE
 	if (!allowaperture && securelevel > 0)
@@ -364,7 +364,7 @@ i386_set_ioperm(p, args, retval)
 	struct pcb *pcb = &p->p_addr->u_pcb;
 	struct i386_set_ioperm_args ua;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return error;
 
 	if ((error = copyin(args, &ua, sizeof(ua))) != 0)
diff --git a/sys/arch/i386/isa/pccom.c b/sys/arch/i386/isa/pccom.c
index 88c1e849872..44ab6d562aa 100644
--- a/sys/arch/i386/isa/pccom.c
+++ b/sys/arch/i386/isa/pccom.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pccom.c,v 1.43 2003/06/02 23:27:47 millert Exp $	*/
+/*	$OpenBSD: pccom.c,v 1.44 2003/08/15 20:32:13 tedu Exp $	*/
 /*	$NetBSD: com.c,v 1.82.4.1 1996/06/02 09:08:00 mrg Exp $	*/
 
 /*
@@ -1256,7 +1256,7 @@ comioctl(dev, cmd, data, flag, p)
 	case TIOCSFLAGS: {
 		int userbits, driverbits = 0;
 
-		error = suser(p->p_ucred, &p->p_acflag); 
+		error = suser(p, 0); 
 		if (error != 0)
 			return(EPERM); 
 
diff --git a/sys/arch/mac68k/dev/z8530tty.c b/sys/arch/mac68k/dev/z8530tty.c
index 707216f5bd0..bf4aac4db19 100644
--- a/sys/arch/mac68k/dev/z8530tty.c
+++ b/sys/arch/mac68k/dev/z8530tty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: z8530tty.c,v 1.12 2003/06/02 23:27:49 millert Exp $	*/
+/*	$OpenBSD: z8530tty.c,v 1.13 2003/08/15 20:32:13 tedu Exp $	*/
 /*	$NetBSD: z8530tty.c,v 1.10 1996/12/18 05:17:44 scottr Exp $	*/
 
 /*
@@ -515,7 +515,7 @@ zsioctl(dev, cmd, data, flag, p)
 		break;
 
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error != 0)
 			return (EPERM);
 		tmp = *(int *)data;
@@ -539,21 +539,21 @@ zsioctl(dev, cmd, data, flag, p)
 
 #if 0
 	case SetSafeOpen:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error != 0)
 			return (EPERM);
 		zst->zst_resetdef = 1;
 		break;
 
 	case ClearSafeOpen:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error != 0)
 			return (EPERM);
 		zst->zst_resetdef = 0;
 		break;
 
 	case SetOpenDefaults:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error != 0)
 			return (EPERM);
 		bcopy(&tp->t_termios, &zst->zst_termios, \
diff --git a/sys/arch/macppc/dev/z8530tty.c b/sys/arch/macppc/dev/z8530tty.c
index 7387cd3145f..d7698c953f7 100644
--- a/sys/arch/macppc/dev/z8530tty.c
+++ b/sys/arch/macppc/dev/z8530tty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: z8530tty.c,v 1.2 2003/06/02 23:27:49 millert Exp $ */
+/*	$OpenBSD: z8530tty.c,v 1.3 2003/08/15 20:32:13 tedu Exp $ */
 /*	$NetBSD: z8530tty.c,v 1.13 1996/10/16 20:42:14 gwr Exp $	*/
 
 /*-
@@ -754,7 +754,7 @@ zsioctl(dev, cmd, data, flag, p)
 		break;
 
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error != 0)
 			break;
 		zst->zst_swflags = *(int *)data;
diff --git a/sys/arch/macppc/macppc/mem.c b/sys/arch/macppc/macppc/mem.c
index 34706077a28..4b02cfcae85 100644
--- a/sys/arch/macppc/macppc/mem.c
+++ b/sys/arch/macppc/macppc/mem.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mem.c,v 1.9 2003/06/02 23:27:50 millert Exp $	*/
+/*	$OpenBSD: mem.c,v 1.10 2003/08/15 20:32:13 tedu Exp $	*/
 /*	$NetBSD: mem.c,v 1.1 1996/09/30 16:34:50 ws Exp $ */
 
 /*
@@ -77,7 +77,7 @@ mmopen(dev, flag, mode, p)
 			break;
 #ifdef APERTURE
 	case 4:
-	        if (suser(p->p_ucred, &p->p_acflag) != 0 || !allowaperture)
+	        if (suser(p, 0) != 0 || !allowaperture)
 			return (EPERM);
 
 		/* authorize only one simultaneous open() */
diff --git a/sys/arch/mvme68k/dev/bugtty.c b/sys/arch/mvme68k/dev/bugtty.c
index 60d83bce682..5f9e6450009 100644
--- a/sys/arch/mvme68k/dev/bugtty.c
+++ b/sys/arch/mvme68k/dev/bugtty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bugtty.c,v 1.9 2003/06/03 01:35:30 drahn Exp $ */
+/*	$OpenBSD: bugtty.c,v 1.10 2003/08/15 20:32:14 tedu Exp $ */
 
 /*
  * Copyright (c) 1995 Dale Rahn.
@@ -407,7 +407,7 @@ bugttyioctl(dev, cmd, data, flag, p)
 		*(int *)data = SWFLAGS(dev);
 		break;
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag); 
+		error = suser(p, 0); 
 		if (error != 0)
 			return (EPERM); 
 
diff --git a/sys/arch/mvme68k/dev/cl.c b/sys/arch/mvme68k/dev/cl.c
index ec914e82213..85693b3dff8 100644
--- a/sys/arch/mvme68k/dev/cl.c
+++ b/sys/arch/mvme68k/dev/cl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cl.c,v 1.30 2003/06/03 21:09:01 deraadt Exp $ */
+/*	$OpenBSD: cl.c,v 1.31 2003/08/15 20:32:14 tedu Exp $ */
 
 /*
  * Copyright (c) 1995 Dale Rahn. All rights reserved.
@@ -896,7 +896,7 @@ clioctl(dev, cmd, data, flag, p)
 		*(int *)data = cl->cl_swflags;
 		break;
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag); 
+		error = suser(p, 0); 
 		if (error != 0)
 			return(EPERM); 
 
diff --git a/sys/arch/mvme68k/dev/wl.c b/sys/arch/mvme68k/dev/wl.c
index 054af37a9f8..051cfc23d79 100644
--- a/sys/arch/mvme68k/dev/wl.c
+++ b/sys/arch/mvme68k/dev/wl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: wl.c,v 1.11 2003/06/03 21:09:01 deraadt Exp $ */
+/*	$OpenBSD: wl.c,v 1.12 2003/08/15 20:32:14 tedu Exp $ */
 
 /*
  * Copyright (c) 1995 Dale Rahn. All rights reserved.
@@ -789,7 +789,7 @@ wlioctl(dev, cmd, data, flag, p)
 		*(int *)data = cl->cl_swflags;
 		break;
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag); 
+		error = suser(p, 0); 
 		if (error != 0)
 			return(EPERM); 
 
diff --git a/sys/arch/mvme88k/dev/bugtty.c b/sys/arch/mvme88k/dev/bugtty.c
index fe3cb501bee..18753ce6401 100644
--- a/sys/arch/mvme88k/dev/bugtty.c
+++ b/sys/arch/mvme88k/dev/bugtty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bugtty.c,v 1.14 2003/06/03 21:09:01 deraadt Exp $ */
+/*	$OpenBSD: bugtty.c,v 1.15 2003/08/15 20:32:14 tedu Exp $ */
 
 /* Copyright (c) 1998 Steve Murphree, Jr. 
  * Copyright (c) 1995 Dale Rahn.
@@ -421,7 +421,7 @@ bugttyioctl(dev, cmd, data, flag, p)
 		*(int *)data = SWFLAGS(dev);
 		break;
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag); 
+		error = suser(p, 0); 
 		if (error != 0)
 			return (EPERM); 
 
diff --git a/sys/arch/mvme88k/dev/cl.c b/sys/arch/mvme88k/dev/cl.c
index c18fa08d089..718a12da8e0 100644
--- a/sys/arch/mvme88k/dev/cl.c
+++ b/sys/arch/mvme88k/dev/cl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cl.c,v 1.28 2003/06/03 21:09:01 deraadt Exp $ */
+/*	$OpenBSD: cl.c,v 1.29 2003/08/15 20:32:14 tedu Exp $ */
 
 /*
  * Copyright (c) 1995 Dale Rahn. All rights reserved.
@@ -875,7 +875,7 @@ clioctl(dev, cmd, data, flag, p)
 		*(int *)data = cl->cl_swflags;
 		break;
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag); 
+		error = suser(p, 0); 
 		if (error != 0)
 			return(EPERM); 
 
diff --git a/sys/arch/mvme88k/dev/dart.c b/sys/arch/mvme88k/dev/dart.c
index 643e50c6a5e..8d2c9f370e2 100644
--- a/sys/arch/mvme88k/dev/dart.c
+++ b/sys/arch/mvme88k/dev/dart.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dart.c,v 1.19 2003/08/12 19:32:45 miod Exp $	*/
+/*	$OpenBSD: dart.c,v 1.20 2003/08/15 20:32:14 tedu Exp $	*/
 
 /*
  * Mach Operating System
@@ -598,7 +598,7 @@ dartioctl(dev, cmd, data, flag, p)
 		*(int *)data = dart->dart_swflags;
 		break;
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag); 
+		error = suser(p, 0); 
 		if (error != 0)
 			return(EPERM); 
 
diff --git a/sys/arch/mvme88k/dev/vx.c b/sys/arch/mvme88k/dev/vx.c
index e4cef972926..2362ddc4fc1 100644
--- a/sys/arch/mvme88k/dev/vx.c
+++ b/sys/arch/mvme88k/dev/vx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vx.c,v 1.21 2003/06/03 21:09:01 deraadt Exp $ */
+/*	$OpenBSD: vx.c,v 1.22 2003/08/15 20:32:14 tedu Exp $ */
 /*
  * Copyright (c) 1999 Steve Murphree, Jr. 
  * All rights reserved.
@@ -778,7 +778,7 @@ vxioctl (dev, cmd, data, flag, p)
 		break;
 
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag); 
+		error = suser(p, 0); 
 		if (error != 0)
 			return (EPERM);
 
diff --git a/sys/arch/mvmeppc/dev/bugtty.c b/sys/arch/mvmeppc/dev/bugtty.c
index 8a66c2d3b83..be48c69e3be 100644
--- a/sys/arch/mvmeppc/dev/bugtty.c
+++ b/sys/arch/mvmeppc/dev/bugtty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bugtty.c,v 1.7 2003/06/03 21:09:01 deraadt Exp $ */
+/*	$OpenBSD: bugtty.c,v 1.8 2003/08/15 20:32:14 tedu Exp $ */
 
 /* Copyright (c) 1998 Steve Murphree, Jr. 
  * Copyright (c) 1995 Dale Rahn.
@@ -383,7 +383,7 @@ bugttyioctl(dev, cmd, data, flag, p)
 		*(int *)data = SWFLAGS(dev);
 		break;
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag); 
+		error = suser(p, 0); 
 		if (error != 0)
 			return (EPERM); 
 
diff --git a/sys/arch/sparc/dev/magma.c b/sys/arch/sparc/dev/magma.c
index e5f91cf9f06..60c457aa1bd 100644
--- a/sys/arch/sparc/dev/magma.c
+++ b/sys/arch/sparc/dev/magma.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: magma.c,v 1.14 2003/02/11 19:20:26 mickey Exp $	*/
+/*	$OpenBSD: magma.c,v 1.15 2003/08/15 20:32:14 tedu Exp $	*/
 /*
  * magma.c
  *
@@ -1110,7 +1110,7 @@ int error;
 		break;
 
 	case TIOCSFLAGS:
-		if( suser(p->p_ucred, &p->p_acflag) )
+		if( suser(p, 0) )
 			error = EPERM;
 		else
 			mp->mp_openflags = *((int *)data) &
diff --git a/sys/arch/sparc/dev/spif.c b/sys/arch/sparc/dev/spif.c
index 46a92ca70af..c56255e8a49 100644
--- a/sys/arch/sparc/dev/spif.c
+++ b/sys/arch/sparc/dev/spif.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: spif.c,v 1.15 2003/06/02 18:40:59 jason Exp $	*/
+/*	$OpenBSD: spif.c,v 1.16 2003/08/15 20:32:14 tedu Exp $	*/
 
 /*
  * Copyright (c) 1999 Jason L. Wright (jason@thought.net)
@@ -451,7 +451,7 @@ sttyioctl(dev, cmd, data, flags, p)
 		*((int *)data) = sp->sp_openflags;
 		break;
 	case TIOCSFLAGS:
-		if (suser(p->p_ucred, &p->p_acflag))
+		if (suser(p, 0))
 			error = EPERM;
 		else
 			sp->sp_openflags = *((int *)data) &
diff --git a/sys/arch/sparc/dev/xd.c b/sys/arch/sparc/dev/xd.c
index 68b8e1b19bc..553bd22de3c 100644
--- a/sys/arch/sparc/dev/xd.c
+++ b/sys/arch/sparc/dev/xd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: xd.c,v 1.24 2002/06/08 18:52:45 art Exp $	*/
+/*	$OpenBSD: xd.c,v 1.25 2003/08/15 20:32:14 tedu Exp $	*/
 /*	$NetBSD: xd.c,v 1.37 1997/07/29 09:58:16 fair Exp $	*/
 
 /*
@@ -899,7 +899,7 @@ xdioctl(dev, command, addr, flag, p)
 
 	case DIOSXDCMD:
 		xio = (struct xd_iocmd *) addr;
-		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		if ((error = suser(p, 0)) != 0)
 			return (error);
 		return (xdc_ioctlcmd(xd, dev, xio));
 
diff --git a/sys/arch/sparc/dev/xy.c b/sys/arch/sparc/dev/xy.c
index 1d943ebcb7a..fd38dc371d3 100644
--- a/sys/arch/sparc/dev/xy.c
+++ b/sys/arch/sparc/dev/xy.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: xy.c,v 1.21 2002/06/08 18:52:45 art Exp $	*/
+/*	$OpenBSD: xy.c,v 1.22 2003/08/15 20:32:14 tedu Exp $	*/
 /*	$NetBSD: xy.c,v 1.26 1997/07/19 21:43:56 pk Exp $	*/
 
 /*
@@ -860,7 +860,7 @@ xyioctl(dev, command, addr, flag, p)
 
 	case DIOSXDCMD:
 		xio = (struct xd_iocmd *) addr;
-		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		if ((error = suser(p, 0)) != 0)
 			return (error);
 		return (xyc_ioctlcmd(xy, dev, xio));
 
diff --git a/sys/arch/sparc/dev/z8530tty.c b/sys/arch/sparc/dev/z8530tty.c
index 038d8b42ad2..d9e0f119b63 100644
--- a/sys/arch/sparc/dev/z8530tty.c
+++ b/sys/arch/sparc/dev/z8530tty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: z8530tty.c,v 1.2 2003/06/02 23:27:54 millert Exp $ */
+/*	$OpenBSD: z8530tty.c,v 1.3 2003/08/15 20:32:14 tedu Exp $ */
 /*	$NetBSD: z8530tty.c,v 1.13 1996/10/16 20:42:14 gwr Exp $	*/
 
 /*-
@@ -749,7 +749,7 @@ zsioctl(dev, cmd, data, flag, p)
 		break;
 
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error != 0)
 			break;
 		zst->zst_swflags = *(int *)data;
diff --git a/sys/arch/sparc64/dev/pcons.c b/sys/arch/sparc64/dev/pcons.c
index 7a7e1020851..d2a503d0484 100644
--- a/sys/arch/sparc64/dev/pcons.c
+++ b/sys/arch/sparc64/dev/pcons.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pcons.c,v 1.5 2002/03/14 03:16:00 millert Exp $	*/
+/*	$OpenBSD: pcons.c,v 1.6 2003/08/15 20:32:15 tedu Exp $	*/
 /*	$NetBSD: pcons.c,v 1.7 2001/05/02 10:32:20 scw Exp $	*/
 
 /*-
@@ -191,7 +191,7 @@ pconsopen(dev, flag, mode, p)
 		tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
 		pconsparam(tp, &tp->t_termios);
 		ttsetwater(tp);
-	} else if ((tp->t_state&TS_XCLUDE) && suser(p->p_ucred, &p->p_acflag))
+	} else if ((tp->t_state&TS_XCLUDE) && suser(p, 0))
 		return EBUSY;
 	tp->t_state |= TS_CARR_ON;
 	
diff --git a/sys/arch/sparc64/dev/sab.c b/sys/arch/sparc64/dev/sab.c
index fc22a641db7..14250d7f600 100644
--- a/sys/arch/sparc64/dev/sab.c
+++ b/sys/arch/sparc64/dev/sab.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sab.c,v 1.13 2003/06/24 21:54:39 henric Exp $	*/
+/*	$OpenBSD: sab.c,v 1.14 2003/08/15 20:32:15 tedu Exp $	*/
 
 /*
  * Copyright (c) 2001 Jason L. Wright (jason@thought.net)
@@ -696,7 +696,7 @@ sabttyopen(dev, flags, mode, p)
 		else
 			tp->t_state &= ~TS_CARR_ON;
 	} else if ((tp->t_state & TS_XCLUDE) &&
-	    (!suser(p->p_ucred, &p->p_acflag))) {
+	    (!suser(p, 0))) {
 		return (EBUSY);
 	} else {
 		s = spltty();
@@ -862,7 +862,7 @@ sabttyioctl(dev, cmd, data, flags, p)
 		*((int *)data) = sc->sc_openflags;
 		break;
 	case TIOCSFLAGS:
-		if (suser(p->p_ucred, &p->p_acflag))
+		if (suser(p, 0))
 			error = EPERM;
 		else
 			sc->sc_openflags = *((int *)data) &
diff --git a/sys/arch/sparc64/dev/z8530tty.c b/sys/arch/sparc64/dev/z8530tty.c
index f9cb77836c8..a7c597e22bd 100644
--- a/sys/arch/sparc64/dev/z8530tty.c
+++ b/sys/arch/sparc64/dev/z8530tty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: z8530tty.c,v 1.7 2003/06/02 23:27:55 millert Exp $	*/
+/*	$OpenBSD: z8530tty.c,v 1.8 2003/08/15 20:32:15 tedu Exp $	*/
 /*	$NetBSD: z8530tty.c,v 1.77 2001/05/30 15:24:24 lukem Exp $	*/
 
 /*-
@@ -720,7 +720,7 @@ zsioctl(dev, cmd, data, flag, p)
 		break;
 
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error)
 			break;
 		zst->zst_swflags = *(int *)data;
diff --git a/sys/compat/common/kern_info_09.c b/sys/compat/common/kern_info_09.c
index 4579dfc5c7e..38889b8757a 100644
--- a/sys/compat/common/kern_info_09.c
+++ b/sys/compat/common/kern_info_09.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_info_09.c,v 1.10 2003/06/02 23:27:59 millert Exp $	*/
+/*	$OpenBSD: kern_info_09.c,v 1.11 2003/08/15 20:32:15 tedu Exp $	*/
 /*	$NetBSD: kern_info_09.c,v 1.5 1996/02/21 00:10:59 cgd Exp $	*/
 
 /*
@@ -84,7 +84,7 @@ compat_09_sys_setdomainname(p, v, retval)
 	int name;
 	int error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 	name = KERN_DOMAINNAME;
 	return (kern_sysctl(&name, 1, 0, 0, SCARG(uap, domainname),
diff --git a/sys/compat/common/kern_info_43.c b/sys/compat/common/kern_info_43.c
index 1fb199f999a..d8441601c09 100644
--- a/sys/compat/common/kern_info_43.c
+++ b/sys/compat/common/kern_info_43.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_info_43.c,v 1.14 2003/06/02 23:27:59 millert Exp $	*/
+/*	$OpenBSD: kern_info_43.c,v 1.15 2003/08/15 20:32:15 tedu Exp $	*/
 /*	$NetBSD: kern_info_43.c,v 1.5 1996/02/04 02:02:22 christos Exp $	*/
 
 /*
@@ -344,7 +344,7 @@ compat_43_sys_sethostid(p, v, retval)
 	} */ *uap = v;
 	int error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 	hostid = SCARG(uap, hostid);
 	return (0);
@@ -362,7 +362,7 @@ compat_43_sys_sethostname(p, v, retval)
 	int name;
 	int error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 	name = KERN_HOSTNAME;
 	return (kern_sysctl(&name, 1, 0, 0, SCARG(uap, hostname),
diff --git a/sys/compat/common/vfs_syscalls_25.c b/sys/compat/common/vfs_syscalls_25.c
index 52583aae22c..7d129b040ee 100644
--- a/sys/compat/common/vfs_syscalls_25.c
+++ b/sys/compat/common/vfs_syscalls_25.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vfs_syscalls_25.c,v 1.5 2003/06/02 23:27:59 millert Exp $	*/
+/*	$OpenBSD: vfs_syscalls_25.c,v 1.6 2003/08/15 20:32:15 tedu Exp $	*/
 
 /*
  * Copyright (c) 1989, 1993
@@ -76,7 +76,7 @@ statfs_to_ostatfs(p, mp, sp, osp)
 	osp->f_files = sp->f_files;
 	osp->f_ffree = sp->f_ffree;
 	/* Don't let non-root see filesystem id (for NFS security) */
-	if (suser(p->p_ucred, &p->p_acflag))
+	if (suser(p, 0))
 		osp->f_fsid.val[0] = osp->f_fsid.val[1] = 0;
 	else
 		bcopy(&sp->f_fsid, &osp->f_fsid, sizeof(osp->f_fsid));
diff --git a/sys/compat/freebsd/freebsd_file.c b/sys/compat/freebsd/freebsd_file.c
index 50284f65de6..b4388177509 100644
--- a/sys/compat/freebsd/freebsd_file.c
+++ b/sys/compat/freebsd/freebsd_file.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: freebsd_file.c,v 1.16 2002/08/23 15:39:31 art Exp $	*/
+/*	$OpenBSD: freebsd_file.c,v 1.17 2003/08/15 20:32:15 tedu Exp $	*/
 /*	$NetBSD: freebsd_file.c,v 1.3 1996/05/03 17:03:09 christos Exp $	*/
 
 /*
@@ -549,7 +549,7 @@ statfs_to_freebsd_statfs(p, mp, sp, fsp)
 	fsp->f_files = sp->f_files;
 	fsp->f_ffree = sp->f_ffree;
 	/* Don't let non-root see filesystem id (for NFS security) */
-	if (suser(p->p_ucred, &p->p_acflag))
+	if (suser(p, 0))
 		fsp->f_fsid.val[0] = fsp->f_fsid.val[1] = 0;
 	else
 		bcopy(&sp->f_fsid, &fsp->f_fsid, sizeof(fsp->f_fsid));
diff --git a/sys/compat/hpux/hpux_compat.c b/sys/compat/hpux/hpux_compat.c
index 330e5b0401f..df082077441 100644
--- a/sys/compat/hpux/hpux_compat.c
+++ b/sys/compat/hpux/hpux_compat.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hpux_compat.c,v 1.23 2003/06/02 23:28:00 millert Exp $	*/
+/*	$OpenBSD: hpux_compat.c,v 1.24 2003/08/15 20:32:15 tedu Exp $	*/
 /*	$NetBSD: hpux_compat.c,v 1.35 1997/05/08 16:19:48 mycroft Exp $	*/
 
 /*
@@ -484,7 +484,7 @@ hpux_sys_ulimit(p, v, retval)
 	case 2:
 		SCARG(uap, newlimit) *= 512;
 		if (SCARG(uap, newlimit) > limp->rlim_max &&
-		    (error = suser(p->p_ucred, &p->p_acflag)))
+		    (error = suser(p, 0)))
 			break;
 		limp->rlim_cur = limp->rlim_max = SCARG(uap, newlimit);
 		/* else fall into... */
@@ -1209,7 +1209,7 @@ hpux_sys_stime_6x(p, v, retval)
 
 	tv.tv_sec = SCARG(uap, time);
 	tv.tv_usec = 0;
-	if ((error = suser(p->p_ucred, &p->p_acflag)))
+	if ((error = suser(p, 0)))
 		return (error);
 
 	/* WHAT DO WE DO ABOUT PENDING REAL-TIME TIMEOUTS??? */
diff --git a/sys/compat/ibcs2/ibcs2_misc.c b/sys/compat/ibcs2/ibcs2_misc.c
index 453eee141e1..681bf21baad 100644
--- a/sys/compat/ibcs2/ibcs2_misc.c
+++ b/sys/compat/ibcs2/ibcs2_misc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ibcs2_misc.c,v 1.26 2003/06/02 23:28:00 millert Exp $	*/
+/*	$OpenBSD: ibcs2_misc.c,v 1.27 2003/08/15 20:32:15 tedu Exp $	*/
 /*	$NetBSD: ibcs2_misc.c,v 1.23 1997/01/15 01:37:49 perry Exp $	*/
 
 /*
@@ -1032,7 +1032,7 @@ ibcs2_sys_plock(p, v, retval)
 #define IBCS2_DATALOCK	4
 
 	
-        if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+        if ((error = suser(p, 0)) != 0)
                 return EPERM;
 	switch(SCARG(uap, cmd)) {
 	case IBCS2_UNLOCK:
@@ -1076,7 +1076,7 @@ ibcs2_sys_uadmin(p, v, retval)
 #define SCO_AD_GETCMAJ      1
 
 	/* XXX: is this the right place for this call? */
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 
 	switch(SCARG(uap, cmd)) {
diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c
index 44de020d36c..432513b682c 100644
--- a/sys/compat/linux/linux_misc.c
+++ b/sys/compat/linux/linux_misc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: linux_misc.c,v 1.53 2003/08/15 14:02:22 fgsch Exp $	*/
+/*	$OpenBSD: linux_misc.c,v 1.54 2003/08/15 20:32:16 tedu Exp $	*/
 /*	$NetBSD: linux_misc.c,v 1.27 1996/05/20 01:59:21 fvdl Exp $	*/
 
 /*-
@@ -1452,7 +1452,7 @@ linux_sys_stime(p, v, retval)
 	linux_time_t tt;
 	int error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 
 	if ((error = copyin(SCARG(uap, t), &tt, sizeof(tt))) != 0)
diff --git a/sys/compat/netbsd/netbsd_file.c b/sys/compat/netbsd/netbsd_file.c
index fc1268bbc87..5b35d37d8ce 100644
--- a/sys/compat/netbsd/netbsd_file.c
+++ b/sys/compat/netbsd/netbsd_file.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: netbsd_file.c,v 1.4 2002/08/23 15:39:31 art Exp $	*/
+/*	$OpenBSD: netbsd_file.c,v 1.5 2003/08/15 20:32:16 tedu Exp $	*/
 /*	$NetBSD: freebsd_file.c,v 1.3 1996/05/03 17:03:09 christos Exp $	*/
 
 /*
@@ -523,7 +523,7 @@ statfs_to_netbsd_statfs(p, mp, sp, fsp)
 	fsp->f_files = sp->f_files;
 	fsp->f_ffree = sp->f_ffree;
 	/* Don't let non-root see filesystem id (for NFS security) */
-	if (suser(p->p_ucred, &p->p_acflag))
+	if (suser(p, 0))
 		fsp->f_fsid.val[0] = fsp->f_fsid.val[1] = 0;
 	else
 		bcopy(&sp->f_fsid, &fsp->f_fsid, sizeof(fsp->f_fsid));
diff --git a/sys/compat/netbsd/netbsd_stat.c b/sys/compat/netbsd/netbsd_stat.c
index ba730321f2e..e9b8aaa63e5 100644
--- a/sys/compat/netbsd/netbsd_stat.c
+++ b/sys/compat/netbsd/netbsd_stat.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: netbsd_stat.c,v 1.15 2003/06/02 23:28:00 millert Exp $	*/
+/*	$OpenBSD: netbsd_stat.c,v 1.16 2003/08/15 20:32:16 tedu Exp $	*/
 /*
  * Copyright (c) 1989, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -123,7 +123,7 @@ netbsd_sys___stat13(p, v, retval)
 	if (error)
 		return (error);
 	/* Don't let non-root see generation numbers (for NFS security) */
-	if (suser(p->p_ucred, &p->p_acflag))
+	if (suser(p, 0))
 		sb.st_gen = 0;
 	openbsd_to_netbsd_stat(&sb, &nsb);
 	error = copyout(&nsb, SCARG(uap, ub), sizeof(nsb));
@@ -160,7 +160,7 @@ netbsd_sys___lstat13(p, v, retval)
 	if (error)
 		return (error);
 	/* Don't let non-root see generation numbers (for NFS security) */
-	if (suser(p->p_ucred, &p->p_acflag))
+	if (suser(p, 0))
 		sb.st_gen = 0;
 	openbsd_to_netbsd_stat(&sb, &nsb);
 	error = copyout(&nsb, SCARG(uap, ub), sizeof(nsb));
diff --git a/sys/compat/sunos/sunos_misc.c b/sys/compat/sunos/sunos_misc.c
index 3bb6125b9b3..6fc8a842a15 100644
--- a/sys/compat/sunos/sunos_misc.c
+++ b/sys/compat/sunos/sunos_misc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sunos_misc.c,v 1.42 2003/06/02 23:28:00 millert Exp $	*/
+/*	$OpenBSD: sunos_misc.c,v 1.43 2003/08/15 20:32:16 tedu Exp $	*/
 /*	$NetBSD: sunos_misc.c,v 1.65 1996/04/22 01:44:31 christos Exp $	*/
 
 /*
@@ -588,7 +588,7 @@ sunos_sys_fchroot(p, v, retval)
 	struct file *fp;
 	int error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 	if ((error = getvnode(fdp, SCARG(uap, fd), &fp)) != 0)
 		return (error);
@@ -1055,7 +1055,7 @@ sunos_sys_reboot(p, v, retval)
 	struct sunos_howto_conv *convp;
 	int error, bsd_howto, sun_howto;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 
 	/*
@@ -1169,7 +1169,7 @@ sunos_sys_ostime(p, v, retval)
 	struct timeval tv;
 	int error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 
 	tv.tv_sec = SCARG(uap, time);
diff --git a/sys/compat/svr4/svr4_misc.c b/sys/compat/svr4/svr4_misc.c
index ece88dfe61a..6fce7a7d203 100644
--- a/sys/compat/svr4/svr4_misc.c
+++ b/sys/compat/svr4/svr4_misc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: svr4_misc.c,v 1.42 2002/08/23 15:39:31 art Exp $	 */
+/*	$OpenBSD: svr4_misc.c,v 1.43 2003/08/15 20:32:16 tedu Exp $	 */
 /*	$NetBSD: svr4_misc.c,v 1.42 1996/12/06 03:22:34 christos Exp $	 */
 
 /*
@@ -424,7 +424,7 @@ svr4_sys_fchroot(p, v, retval)
 	struct file	*fp;
 	int		 error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return error;
 	if ((error = getvnode(fdp, SCARG(uap, fd), &fp)) != 0)
 		return error;
diff --git a/sys/compat/svr4/svr4_stat.c b/sys/compat/svr4/svr4_stat.c
index cad97e3dcdf..077f86817a6 100644
--- a/sys/compat/svr4/svr4_stat.c
+++ b/sys/compat/svr4/svr4_stat.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: svr4_stat.c,v 1.24 2003/05/07 22:16:26 deraadt Exp $	 */
+/*	$OpenBSD: svr4_stat.c,v 1.25 2003/08/15 20:32:16 tedu Exp $	 */
 /*	$NetBSD: svr4_stat.c,v 1.21 1996/04/22 01:16:07 christos Exp $	 */
 
 /*
@@ -625,13 +625,13 @@ svr4_sys_systeminfo(p, v, retval)
 		break;
 
 	case SVR4_SI_SET_HOSTNAME:
-		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		if ((error = suser(p, 0)) != 0)
 			return error;
 		name = KERN_HOSTNAME;
 		return kern_sysctl(&name, 1, 0, 0, SCARG(uap, buf), rlen, p);
 
 	case SVR4_SI_SET_SRPC_DOMAIN:
-		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		if ((error = suser(p, 0)) != 0)
 			return error;
 		name = KERN_DOMAINNAME;
 		return kern_sysctl(&name, 1, 0, 0, SCARG(uap, buf), rlen, p);
diff --git a/sys/dev/cons.c b/sys/dev/cons.c
index bfeec64913b..7d4f72dffea 100644
--- a/sys/dev/cons.c
+++ b/sys/dev/cons.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cons.c,v 1.12 2003/06/16 18:44:11 millert Exp $	*/
+/*	$OpenBSD: cons.c,v 1.13 2003/08/15 20:32:16 tedu Exp $	*/
 /*	$NetBSD: cons.c,v 1.30 1996/04/08 19:57:30 jonathan Exp $	*/
 
 /*
@@ -179,7 +179,7 @@ cnioctl(dev, cmd, data, flag, p)
 	 * output from the "virtual" console.
 	 */
 	if (cmd == TIOCCONS && constty != NULL) {
-		error = suser(p->p_ucred, (u_short *) NULL);
+		error = suser(p, SUSER_NOACCT);
 		if (error)
 			return (error);
 		constty = NULL;
diff --git a/sys/dev/ic/an.c b/sys/dev/ic/an.c
index ee6adcbae24..80c20a42765 100644
--- a/sys/dev/ic/an.c
+++ b/sys/dev/ic/an.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: an.c,v 1.27 2003/06/25 22:28:14 mickey Exp $	*/
+/*	$OpenBSD: an.c,v 1.28 2003/08/15 20:32:16 tedu Exp $	*/
 
 /*
  * Copyright (c) 1997, 1998, 1999
@@ -1062,7 +1062,7 @@ an_ioctl(ifp, command, data)
 			break;
 #ifdef ANCACHE
 		if (areq.an_type == AN_RID_ZERO_CACHE) {
-			error = suser(p->p_ucred, &p->p_acflag);
+			error = suser(p, 0);
 			if (error)
 				break;
 			sc->an_sigitems = sc->an_nextitem = 0;
@@ -1086,7 +1086,7 @@ an_ioctl(ifp, command, data)
 		error = copyout(&areq, ifr->ifr_data, sizeof(areq));
 		break;
 	case SIOCSAIRONET:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error)
 			break;
 		error = copyin(ifr->ifr_data, &areq, sizeof(areq));
diff --git a/sys/dev/ic/awi_wep.c b/sys/dev/ic/awi_wep.c
index 14daa17b8ee..c0b611f99c3 100644
--- a/sys/dev/ic/awi_wep.c
+++ b/sys/dev/ic/awi_wep.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: awi_wep.c,v 1.8 2002/03/14 01:26:54 millert Exp $	*/
+/*	$OpenBSD: awi_wep.c,v 1.9 2003/08/15 20:32:16 tedu Exp $	*/
 /*	$NetBSD: awi_wep.c,v 1.2 2000/07/04 14:47:58 onoe Exp $	*/
 
 /*
@@ -207,6 +207,9 @@ awi_wep_getnwkey(sc, nwkey)
 #ifdef __FreeBSD__
 	suerr = suser(curproc);
 #else
+#ifdef __OpenBSD__
+	suerr = suser(curproc, 0);
+#else
 	suerr = suser(curproc->p_ucred, &curproc->p_acflag);
 #endif
 	error = 0;
diff --git a/sys/dev/ic/com.c b/sys/dev/ic/com.c
index f34f3d7f95d..c451bb6db23 100644
--- a/sys/dev/ic/com.c
+++ b/sys/dev/ic/com.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: com.c,v 1.91 2003/07/15 03:15:58 jason Exp $	*/
+/*	$OpenBSD: com.c,v 1.92 2003/08/15 20:32:16 tedu Exp $	*/
 /*	$NetBSD: com.c,v 1.82.4.1 1996/06/02 09:08:00 mrg Exp $	*/
 
 /*
@@ -884,7 +884,7 @@ comioctl(dev, cmd, data, flag, p)
 	case TIOCSFLAGS: {
 		int userbits, driverbits = 0;
 
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error != 0)
 			return(EPERM);
 
diff --git a/sys/dev/ic/cy.c b/sys/dev/ic/cy.c
index c1c4908476a..04fb4d49c20 100644
--- a/sys/dev/ic/cy.c
+++ b/sys/dev/ic/cy.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cy.c,v 1.22 2003/08/05 16:14:47 markus Exp $	*/
+/*	$OpenBSD: cy.c,v 1.23 2003/08/15 20:32:17 tedu Exp $	*/
 /*
  * Copyright (c) 1996 Timo Rossi.
  * All rights reserved.
@@ -589,7 +589,7 @@ cyioctl(dev, cmd, data, flag, p)
 		break;
 
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error != 0)
 			return (EPERM);
 
diff --git a/sys/dev/ic/if_wi.c b/sys/dev/ic/if_wi.c
index a14bf871442..5b195d646cc 100644
--- a/sys/dev/ic/if_wi.c
+++ b/sys/dev/ic/if_wi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_wi.c,v 1.96 2003/06/07 21:14:42 mickey Exp $	*/
+/*	$OpenBSD: if_wi.c,v 1.97 2003/08/15 20:32:17 tedu Exp $	*/
 
 /*
  * Copyright (c) 1997, 1998, 1999
@@ -124,7 +124,7 @@ u_int32_t	widebug = WIDEBUG;
 
 #if !defined(lint) && !defined(__OpenBSD__)
 static const char rcsid[] =
-	"$OpenBSD: if_wi.c,v 1.96 2003/06/07 21:14:42 mickey Exp $";
+	"$OpenBSD: if_wi.c,v 1.97 2003/08/15 20:32:17 tedu Exp $";
 #endif	/* lint */
 
 #ifdef foo
@@ -1515,7 +1515,7 @@ wi_ioctl(ifp, command, data)
 	case SIOCS80211NWID:
 	case SIOCS80211NWKEY:
 	case SIOCS80211POWER:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error) {
 			splx(s);
 			return (error);
@@ -1603,7 +1603,7 @@ wi_ioctl(ifp, command, data)
 			break;
 		case WI_RID_DEFLT_CRYPT_KEYS:
 			/* For non-root user, return all-zeroes keys */
-			if (suser(p->p_ucred, &p->p_acflag))
+			if (suser(p, 0))
 				bzero((char *)&wreq,
 					sizeof(struct wi_ltv_keys));
 			else
@@ -2755,7 +2755,7 @@ wi_get_nwkey(sc, nwkey)
 	nwkey->i_defkid = sc->wi_tx_key + 1;
 
 	/* do not show any keys to non-root user */
-	error = suser(curproc->p_ucred, &curproc->p_acflag);
+	error = suser(curproc, 0);
 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
 		if (nwkey->i_key[i].i_keydat == NULL)
 			continue;
diff --git a/sys/dev/ic/if_wi_hostap.c b/sys/dev/ic/if_wi_hostap.c
index 0d6f069c2b1..6be36bd6e73 100644
--- a/sys/dev/ic/if_wi_hostap.c
+++ b/sys/dev/ic/if_wi_hostap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_wi_hostap.c,v 1.25 2003/05/16 02:30:40 millert Exp $	*/
+/*	$OpenBSD: if_wi_hostap.c,v 1.26 2003/08/15 20:32:17 tedu Exp $	*/
 
 /*
  * Copyright (c) 2002
@@ -1203,7 +1203,7 @@ wihap_ioctl(struct wi_softc *sc, u_long command, caddr_t data)
 
 	switch (command) {
 	case SIOCHOSTAP_DEL:
-		if ((error = suser(p->p_ucred, &p->p_acflag)))
+		if ((error = suser(p, 0)))
 			break;
 		if ((error = copyin(ifr->ifr_data, &reqsta, sizeof(reqsta))))
 			break;
@@ -1247,7 +1247,7 @@ wihap_ioctl(struct wi_softc *sc, u_long command, caddr_t data)
 		break;
 
 	case SIOCHOSTAP_ADD:
-		if ((error = suser(p->p_ucred, &p->p_acflag)))
+		if ((error = suser(p, 0)))
 			break;
 		if ((error = copyin(ifr->ifr_data, &reqsta, sizeof(reqsta))))
 			break;
@@ -1270,7 +1270,7 @@ wihap_ioctl(struct wi_softc *sc, u_long command, caddr_t data)
 		break;
 
 	case SIOCHOSTAP_SFLAGS:
-		if ((error = suser(p->p_ucred, &p->p_acflag)))
+		if ((error = suser(p, 0)))
 			break;
 		if ((error = copyin(ifr->ifr_data, &flag, sizeof(int))))
 			break;
diff --git a/sys/dev/ic/z8530tty.c b/sys/dev/ic/z8530tty.c
index 98d6d66f874..c414f09358f 100644
--- a/sys/dev/ic/z8530tty.c
+++ b/sys/dev/ic/z8530tty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: z8530tty.c,v 1.12 2003/06/02 23:28:02 millert Exp $ */
+/*	$OpenBSD: z8530tty.c,v 1.13 2003/08/15 20:32:17 tedu Exp $ */
 /*	$NetBSD: z8530tty.c,v 1.13 1996/10/16 20:42:14 gwr Exp $	*/
 
 /*
@@ -536,7 +536,7 @@ zsioctl(dev, cmd, data, flag, p)
 		break;
 
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error != 0)
 			return (EPERM);
 		tmp = *(int *)data;
diff --git a/sys/dev/ofw/ofcons.c b/sys/dev/ofw/ofcons.c
index ee04c8dd04f..65e7a49c00b 100644
--- a/sys/dev/ofw/ofcons.c
+++ b/sys/dev/ofw/ofcons.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ofcons.c,v 1.10 2003/04/27 11:22:53 ho Exp $	*/
+/*	$OpenBSD: ofcons.c,v 1.11 2003/08/15 20:32:17 tedu Exp $	*/
 /*	$NetBSD: ofcons.c,v 1.3 1996/10/13 01:38:11 christos Exp $	*/
 
 /*
@@ -150,7 +150,7 @@ ofcopen(dev, flag, mode, p)
 		tp->t_ispeed = tp->t_ospeed = TTYDEF_SPEED;
 		ofcparam(tp, &tp->t_termios);
 		ttsetwater(tp);
-	} else if ((tp->t_state&TS_XCLUDE) && suser(p->p_ucred, &p->p_acflag))
+	} else if ((tp->t_state&TS_XCLUDE) && suser(p, 0))
 		return EBUSY;
 	tp->t_state |= TS_CARR_ON;
 	
diff --git a/sys/dev/pci/cz.c b/sys/dev/pci/cz.c
index 0b7178c2ca7..dfd8bc4bce5 100644
--- a/sys/dev/pci/cz.c
+++ b/sys/dev/pci/cz.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cz.c,v 1.7 2003/08/11 05:03:10 mickey Exp $ */
+/*	$OpenBSD: cz.c,v 1.8 2003/08/15 20:32:17 tedu Exp $ */
 /*	$NetBSD: cz.c,v 1.15 2001/01/20 19:10:36 thorpej Exp $	*/
 
 /*-
@@ -1174,7 +1174,7 @@ czttyioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
 		break;
 
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error)
 			break;
 		sc->sc_swflags = *(int *)data;
diff --git a/sys/dev/pci/if_lmc.c b/sys/dev/pci/if_lmc.c
index e6df0b65203..2b2d581e870 100644
--- a/sys/dev/pci/if_lmc.c
+++ b/sys/dev/pci/if_lmc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_lmc.c,v 1.15 2002/06/30 13:04:36 itojun Exp $ */
+/*	$OpenBSD: if_lmc.c,v 1.16 2003/08/15 20:32:17 tedu Exp $ */
 /*	$NetBSD: if_lmc.c,v 1.1 1999/03/25 03:32:43 explorer Exp $	*/
 
 /*-
@@ -1216,7 +1216,7 @@ lmc_ifioctl(struct ifnet * ifp, ioctl_cmd_t cmd, caddr_t data)
 		break;
 
 	case LMCIOCSINFO:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error)
 			goto out;
 
diff --git a/sys/dev/pci/wdt.c b/sys/dev/pci/wdt.c
index 9d1a8f33afa..0f93ddeb3bf 100644
--- a/sys/dev/pci/wdt.c
+++ b/sys/dev/pci/wdt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: wdt.c,v 1.4 2002/03/14 01:27:00 millert Exp $	*/
+/*	$OpenBSD: wdt.c,v 1.5 2003/08/15 20:32:17 tedu Exp $	*/
 
 /*-
  * Copyright (c) 1998,1999 Alex Nash
@@ -579,7 +579,7 @@ wdt_sched (struct wdt_softc *wdt, struct proc *p)
 	 * if the counters aren't reloaded within wdt->timeout_secs
 	 * seconds.
 	 */
-	if ((error = suser(p->p_ucred, &p->p_acflag)))
+	if ((error = suser(p, 0)))
 		return(error);
 
 	/* block out the timeout handler */
diff --git a/sys/dev/rnd.c b/sys/dev/rnd.c
index 391baa805ce..a90b8ebfde3 100644
--- a/sys/dev/rnd.c
+++ b/sys/dev/rnd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rnd.c,v 1.62 2002/11/25 10:09:24 mickey Exp $	*/
+/*	$OpenBSD: rnd.c,v 1.63 2003/08/15 20:32:16 tedu Exp $	*/
 
 /*
  * rnd.c -- A strong random number generator
@@ -1163,7 +1163,7 @@ randomioctl(dev, cmd, data, flag, p)
 		splx(s);
 		break;
 	case RNDADDTOENTCNT:
-		if (suser(p->p_ucred, &p->p_acflag) != 0)
+		if (suser(p, 0) != 0)
 			ret = EPERM;
 		else {
 			cnt = *(u_int *)data;
@@ -1175,7 +1175,7 @@ randomioctl(dev, cmd, data, flag, p)
 		}
 		break;
 	case RNDZAPENTCNT:
-		if (suser(p->p_ucred, &p->p_acflag) != 0)
+		if (suser(p, 0) != 0)
 			ret = EPERM;
 		else {
 			s = splhigh();
@@ -1184,7 +1184,7 @@ randomioctl(dev, cmd, data, flag, p)
 		}
 		break;
 	case RNDSTIRARC4:
-		if (suser(p->p_ucred, &p->p_acflag) != 0)
+		if (suser(p, 0) != 0)
 			ret = EPERM;
 		else if (random_state.entropy_count < 64)
 			ret = EAGAIN;
@@ -1195,7 +1195,7 @@ randomioctl(dev, cmd, data, flag, p)
 		}
 		break;
 	case RNDCLRSTATS:
-		if (suser(p->p_ucred, &p->p_acflag) != 0)
+		if (suser(p, 0) != 0)
 			ret = EPERM;
 		else {
 			s = splhigh();
diff --git a/sys/dev/sbus/magma.c b/sys/dev/sbus/magma.c
index bfce5aa56d7..1faaf4f937c 100644
--- a/sys/dev/sbus/magma.c
+++ b/sys/dev/sbus/magma.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: magma.c,v 1.10 2003/07/15 03:47:43 jason Exp $	*/
+/*	$OpenBSD: magma.c,v 1.11 2003/08/15 20:32:17 tedu Exp $	*/
 /*
  * magma.c
  *
@@ -1065,7 +1065,7 @@ mttyioctl(dev_t dev, u_long cmd, caddr_t data, int flags, struct proc *p)
 		break;
 
 	case TIOCSFLAGS:
-		if (suser(p->p_ucred, &p->p_acflag))
+		if (suser(p, 0))
 			error = EPERM;
 		else
 			mp->mp_openflags = *((int *)data) &
diff --git a/sys/dev/sbus/spif.c b/sys/dev/sbus/spif.c
index 8175fd26cb7..c559c31517d 100644
--- a/sys/dev/sbus/spif.c
+++ b/sys/dev/sbus/spif.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: spif.c,v 1.9 2003/06/27 00:27:17 jason Exp $	*/
+/*	$OpenBSD: spif.c,v 1.10 2003/08/15 20:32:17 tedu Exp $	*/
 
 /*
  * Copyright (c) 1999-2002 Jason L. Wright (jason@thought.net)
@@ -515,7 +515,7 @@ sttyioctl(dev, cmd, data, flags, p)
 		*((int *)data) = sp->sp_openflags;
 		break;
 	case TIOCSFLAGS:
-		if (suser(p->p_ucred, &p->p_acflag))
+		if (suser(p, 0))
 			error = EPERM;
 		else
 			sp->sp_openflags = *((int *)data) &
diff --git a/sys/dev/systrace.c b/sys/dev/systrace.c
index d31b6914da3..d7c8972207d 100644
--- a/sys/dev/systrace.c
+++ b/sys/dev/systrace.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: systrace.c,v 1.30 2003/06/16 06:36:40 itojun Exp $	*/
+/*	$OpenBSD: systrace.c,v 1.31 2003/08/15 20:32:16 tedu Exp $	*/
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
@@ -533,7 +533,7 @@ systraceioctl(dev, cmd, data, flag, p)
 		TAILQ_INIT(&fst->messages);
 		TAILQ_INIT(&fst->policies);
 
-		if (suser(p->p_ucred, &p->p_acflag) == 0)
+		if (suser(p, 0) == 0)
 			fst->issuser = 1;
 		fst->p_ruid = p->p_cred->p_ruid;
 		fst->p_rgid = p->p_cred->p_rgid;
@@ -1155,7 +1155,7 @@ systrace_attach(struct fsystrace *fst, pid_t pid)
 	 */
 	if ((proc->p_cred->p_ruid != p->p_cred->p_ruid ||
 		ISSET(proc->p_flag, P_SUGID)) &&
-	    (error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	    (error = suser(p, 0)) != 0)
 		goto out;
 
 	/*
diff --git a/sys/dev/usb/ucom.c b/sys/dev/usb/ucom.c
index 74869e2cffc..5bfb473a61d 100644
--- a/sys/dev/usb/ucom.c
+++ b/sys/dev/usb/ucom.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ucom.c,v 1.18 2003/05/19 00:33:00 nate Exp $ */
+/*	$OpenBSD: ucom.c,v 1.19 2003/08/15 20:32:18 tedu Exp $ */
 /*	$NetBSD: ucom.c,v 1.49 2003/01/01 00:10:25 thorpej Exp $	*/
 
 /*
@@ -692,7 +692,7 @@ ucom_do_ioctl(struct ucom_softc *sc, u_long cmd, caddr_t data,
 		break;
 
 	case TIOCSFLAGS:
-		error = suser(p->p_ucred, &p->p_acflag);
+		error = suser(p, 0);
 		if (error)
 			break;
 		sc->sc_swflags = *(int *)data;
diff --git a/sys/dev/vnd.c b/sys/dev/vnd.c
index 1cdb2aac31f..77104c0b898 100644
--- a/sys/dev/vnd.c
+++ b/sys/dev/vnd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vnd.c,v 1.38 2003/06/02 23:28:01 millert Exp $	*/
+/*	$OpenBSD: vnd.c,v 1.39 2003/08/15 20:32:16 tedu Exp $	*/
 /*	$NetBSD: vnd.c,v 1.26 1996/03/30 23:06:11 christos Exp $	*/
 
 /*
@@ -757,7 +757,7 @@ vndioctl(dev, cmd, addr, flag, p)
 		printf("vndioctl(%x, %lx, %p, %x, %p): unit %d\n",
 		    dev, cmd, addr, flag, p, unit);
 #endif
-	error = suser(p->p_ucred, &p->p_acflag);
+	error = suser(p, 0);
 	if (error)
 		return (error);
 	if (unit >= numvnd)
diff --git a/sys/dev/wscons/wsdisplay_compat_usl.c b/sys/dev/wscons/wsdisplay_compat_usl.c
index 2c4b76ee8d0..9afc8297581 100644
--- a/sys/dev/wscons/wsdisplay_compat_usl.c
+++ b/sys/dev/wscons/wsdisplay_compat_usl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: wsdisplay_compat_usl.c,v 1.13 2003/08/11 17:43:05 millert Exp $ */
+/* $OpenBSD: wsdisplay_compat_usl.c,v 1.14 2003/08/15 20:32:18 tedu Exp $ */
 /* $NetBSD: wsdisplay_compat_usl.c,v 1.12 2000/03/23 07:01:47 thorpej Exp $ */
 
 /*
@@ -432,7 +432,7 @@ wsdisplay_usl_ioctl2(sc, scr, cmd, data, flag, p)
 		return (0);
 
 	    case KDENABIO:
-		if (suser(p->p_ucred, &p->p_acflag) || securelevel > 1)
+		if (suser(p, 0) || securelevel > 1)
 			return (EPERM);
 		/* FALLTHRU */
 	    case KDDISABIO:
diff --git a/sys/dev/wscons/wskbd.c b/sys/dev/wscons/wskbd.c
index 1fcc522e611..c163ff838c7 100644
--- a/sys/dev/wscons/wskbd.c
+++ b/sys/dev/wscons/wskbd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: wskbd.c,v 1.35 2003/06/02 23:28:04 millert Exp $ */
+/* $OpenBSD: wskbd.c,v 1.36 2003/08/15 20:32:18 tedu Exp $ */
 /* $NetBSD: wskbd.c,v 1.38 2000/03/23 07:01:47 thorpej Exp $ */
 
 /*
@@ -934,7 +934,7 @@ getbell:
 		return (0);
 
 	case WSKBDIO_SETDEFAULTBELL:
-		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		if ((error = suser(p, 0)) != 0)
 			return (error);
 		kbdp = &wskbd_default_bell_data;
 		goto setbell;
@@ -977,7 +977,7 @@ getkeyrepeat:
 		return (0);
 
 	case WSKBDIO_SETDEFAULTKEYREPEAT:
-		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		if ((error = suser(p, 0)) != 0)
 			return (error);
 		kkdp = &wskbd_default_keyrepeat_data;
 		goto setkeyrepeat;
diff --git a/sys/kern/kern_acct.c b/sys/kern/kern_acct.c
index 9d807c881af..36d1aba3f65 100644
--- a/sys/kern/kern_acct.c
+++ b/sys/kern/kern_acct.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_acct.c,v 1.11 2003/06/02 23:28:05 millert Exp $	*/
+/*	$OpenBSD: kern_acct.c,v 1.12 2003/08/15 20:32:18 tedu Exp $	*/
 /*	$NetBSD: kern_acct.c,v 1.42 1996/02/04 02:15:12 christos Exp $	*/
 
 /*-
@@ -106,7 +106,7 @@ sys_acct(p, v, retval)
 	int error;
 
 	/* Make sure that the caller is root. */
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 
 	/*
diff --git a/sys/kern/kern_descrip.c b/sys/kern/kern_descrip.c
index 2a663bedd39..83c1a8b03fe 100644
--- a/sys/kern/kern_descrip.c
+++ b/sys/kern/kern_descrip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_descrip.c,v 1.64 2003/08/06 20:37:38 millert Exp $	*/
+/*	$OpenBSD: kern_descrip.c,v 1.65 2003/08/15 20:32:18 tedu Exp $	*/
 /*	$NetBSD: kern_descrip.c,v 1.42 1996/03/30 22:24:38 christos Exp $	*/
 
 /*
@@ -613,7 +613,7 @@ sys_fstat(p, v, retval)
 	if (error == 0) {
 		/* Don't let non-root see generation numbers
 		   (for NFS security) */
-		if (suser(p->p_ucred, &p->p_acflag))
+		if (suser(p, 0))
 			ub.st_gen = 0;
 		error = copyout((caddr_t)&ub, (caddr_t)SCARG(uap, sb),
 		    sizeof (ub));
diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c
index 91cb9d260a5..b5d265159d7 100644
--- a/sys/kern/kern_event.c
+++ b/sys/kern/kern_event.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_event.c,v 1.19 2003/06/27 16:20:58 nate Exp $	*/
+/*	$OpenBSD: kern_event.c,v 1.20 2003/08/15 20:32:18 tedu Exp $	*/
 
 /*-
  * Copyright (c) 1999,2000,2001 Jonathan Lemon <jlemon@FreeBSD.org>
@@ -195,8 +195,7 @@ filt_procattach(struct knote *kn)
 	 * setuid/setgid privs (unless you're root).
 	 */
 	if ((p->p_cred->p_ruid != curproc->p_cred->p_ruid ||
-	        (p->p_flag & P_SUGID)) &&
-	    suser(curproc->p_ucred, &curproc->p_acflag) != 0)
+	    (p->p_flag & P_SUGID)) && suser(curproc, 0) != 0)
 		return (EACCES);
 
 	kn->kn_ptr.p_proc = p;
diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c
index 0bb0244cd6e..08d997605bd 100644
--- a/sys/kern/kern_prot.c
+++ b/sys/kern/kern_prot.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_prot.c,v 1.24 2003/06/02 23:28:05 millert Exp $	*/
+/*	$OpenBSD: kern_prot.c,v 1.25 2003/08/15 20:32:18 tedu Exp $	*/
 /*	$NetBSD: kern_prot.c,v 1.33 1996/02/09 18:59:42 christos Exp $	*/
 
 /*
@@ -383,21 +383,21 @@ sys_setresuid(p, v, retval)
 	    ruid != pc->p_ruid &&
 	    ruid != pc->pc_ucred->cr_uid &&
 	    ruid != pc->p_svuid &&
-	    (error = suser(pc->pc_ucred, &p->p_acflag)))
+	    (error = suser(p, 0)))
 		return (error);
 
 	if (euid != (uid_t)-1 &&
 	    euid != pc->p_ruid &&
 	    euid != pc->pc_ucred->cr_uid &&
 	    euid != pc->p_svuid &&
-	    (error = suser(pc->pc_ucred, &p->p_acflag)))
+	    (error = suser(p, 0)))
 		return (error);
 
 	if (suid != (uid_t)-1 &&
 	    suid != pc->p_ruid &&
 	    suid != pc->pc_ucred->cr_uid &&
 	    suid != pc->p_svuid &&
-	    (error = suser(pc->pc_ucred, &p->p_acflag)))
+	    (error = suser(p, 0)))
 		return (error);
 
 	/*
@@ -489,21 +489,21 @@ sys_setresgid(p, v, retval)
 	    rgid != pc->p_rgid &&
 	    rgid != pc->pc_ucred->cr_gid &&
 	    rgid != pc->p_svgid &&
-	    (error = suser(pc->pc_ucred, &p->p_acflag)))
+	    (error = suser(p, 0)))
 		return (error);
 
 	if (egid != (gid_t)-1 &&
 	    egid != pc->p_rgid &&
 	    egid != pc->pc_ucred->cr_gid &&
 	    egid != pc->p_svgid &&
-	    (error = suser(pc->pc_ucred, &p->p_acflag)))
+	    (error = suser(p, 0)))
 		return (error);
 
 	if (sgid != (gid_t)-1 &&
 	    sgid != pc->p_rgid &&
 	    sgid != pc->pc_ucred->cr_gid &&
 	    sgid != pc->p_svgid &&
-	    (error = suser(pc->pc_ucred, &p->p_acflag)))
+	    (error = suser(p, 0)))
 		return (error);
 
 	/*
@@ -616,14 +616,14 @@ sys_setuid(p, v, retval)
 	if (uid != pc->p_ruid &&
 	    uid != pc->p_svuid &&
 	    uid != pc->pc_ucred->cr_uid &&
-	    (error = suser(pc->pc_ucred, &p->p_acflag)))
+	    (error = suser(p, 0)))
 		return (error);
 
 	/*
 	 * Everything's okay, do it.
 	 */
 	if (uid == pc->pc_ucred->cr_uid ||
-	    suser(pc->pc_ucred, &p->p_acflag) == 0) {
+	    suser(p, 0) == 0) {
 		/*
 		 * Transfer proc count to new user.
 		 */
@@ -664,7 +664,7 @@ sys_seteuid(p, v, retval)
 		return (0);
 
 	if (euid != pc->p_ruid && euid != pc->p_svuid &&
-	    (error = suser(pc->pc_ucred, &p->p_acflag)))
+	    (error = suser(p, 0)))
 		return (error);
 
 	/*
@@ -700,11 +700,11 @@ sys_setgid(p, v, retval)
 	if (gid != pc->p_rgid &&
 	    gid != pc->p_svgid &&
 	    gid != pc->pc_ucred->cr_gid &&
-	    (error = suser(pc->pc_ucred, &p->p_acflag)))
+	    (error = suser(p, 0)))
 		return (error);
 
 	if (gid == pc->pc_ucred->cr_gid ||
-	    suser(pc->pc_ucred, &p->p_acflag) == 0) {
+	    suser(p, 0) == 0) {
 		pc->p_rgid = gid;
 		pc->p_svgid = gid;
 	}
@@ -738,7 +738,7 @@ sys_setegid(p, v, retval)
 		return (0);
 
 	if (egid != pc->p_rgid && egid != pc->p_svgid &&
-	    (error = suser(pc->pc_ucred, &p->p_acflag)))
+	    (error = suser(p, 0)))
 		return (error);
 
 	/*
@@ -765,7 +765,7 @@ sys_setgroups(p, v, retval)
 	u_int ngrp;
 	int error;
 
-	if ((error = suser(pc->pc_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 	ngrp = SCARG(uap, gidsetsize);
 	if (ngrp > NGROUPS)
@@ -799,25 +799,34 @@ groupmember(gid, cred)
 }
 
 /*
- * Test whether the specified credentials imply "super-user"
- * privilege; if so, and we have accounting info, set the flag
- * indicating use of super-powers.
+ * Test whether this process has special user powers.
  * Returns 0 or error.
  */
 int
-suser(cred, acflag)
-	struct ucred *cred;
-	u_short *acflag;
+suser(struct proc *p, u_int flags)
 {
+	struct ucred *cred = p->p_ucred;
+
 	if (cred->cr_uid == 0) {
-		if (acflag)
-			*acflag |= ASU;
+		if (!(flags & SUSER_NOACCT))
+			p->p_acflag |= ASU;
 		return (0);
 	}
 	return (EPERM);
 }
 
 /*
+ * replacement for old suser, for callers who don't have a process
+ */
+int
+suser_ucred(struct ucred *cred)
+{
+	if (cred->cr_uid == 0)
+		return (0);
+	return (EPERM);
+}
+
+/*
  * Allocate a zeroed cred structure.
  */
 struct ucred *
@@ -913,7 +922,7 @@ sys_setlogin(p, v, retval)
 	} */ *uap = v;
 	int error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 	error = copyinstr((caddr_t) SCARG(uap, namebuf),
 	    (caddr_t) p->p_pgrp->pg_session->s_login,
diff --git a/sys/kern/kern_resource.c b/sys/kern/kern_resource.c
index 980c4057e0d..272cab6aad3 100644
--- a/sys/kern/kern_resource.c
+++ b/sys/kern/kern_resource.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_resource.c,v 1.22 2003/06/02 23:28:05 millert Exp $	*/
+/*	$OpenBSD: kern_resource.c,v 1.23 2003/08/15 20:32:18 tedu Exp $	*/
 /*	$NetBSD: kern_resource.c,v 1.38 1996/10/23 07:19:38 matthias Exp $	*/
 
 /*-
@@ -194,7 +194,7 @@ donice(curp, chgp, n)
 	if (n < PRIO_MIN)
 		n = PRIO_MIN;
 	n += NZERO;
-	if (n < chgp->p_nice && suser(pcred->pc_ucred, &curp->p_acflag))
+	if (n < chgp->p_nice && suser(curp, 0))
 		return (EACCES);
 	chgp->p_nice = n;
 	(void)resetpriority(chgp);
@@ -241,7 +241,7 @@ dosetrlimit(p, which, limp)
 	alimp = &p->p_rlimit[which];
 	if (limp->rlim_cur > alimp->rlim_max ||
 	    limp->rlim_max > alimp->rlim_max)
-		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		if ((error = suser(p, 0)) != 0)
 			return (error);
 	if (p->p_limit->p_refcnt > 1 &&
 	    (p->p_limit->p_lflags & PL_SHAREMOD) == 0) {
diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c
index 2fbd6b040cb..3a34b4d953f 100644
--- a/sys/kern/kern_sig.c
+++ b/sys/kern/kern_sig.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sig.c,v 1.66 2003/08/04 16:27:01 millert Exp $	*/
+/*	$OpenBSD: kern_sig.c,v 1.67 2003/08/15 20:32:18 tedu Exp $	*/
 /*	$NetBSD: kern_sig.c,v 1.54 1996/04/22 01:38:32 christos Exp $	*/
 
 /*
@@ -1290,7 +1290,7 @@ coredump(p)
 	 * group privileges.
 	 */
 	if ((p->p_flag & P_SUGID) &&
-	    (error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	    (error = suser(p, 0)) != 0)
 		return (error);
 	if ((p->p_flag & P_SUGID) && nosuidcoredump)
 		return (EPERM);
diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c
index 030f5ba1157..a15d511470b 100644
--- a/sys/kern/kern_sysctl.c
+++ b/sys/kern/kern_sysctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sysctl.c,v 1.84 2003/08/06 21:08:07 millert Exp $	*/
+/*	$OpenBSD: kern_sysctl.c,v 1.85 2003/08/15 20:32:18 tedu Exp $	*/
 /*	$NetBSD: kern_sysctl.c,v 1.17 1996/05/20 17:49:05 mrg Exp $	*/
 
 /*-
@@ -134,7 +134,7 @@ sys___sysctl(p, v, retval)
 	int name[CTL_MAXNAME];
 
 	if (SCARG(uap, new) != NULL &&
-	    (error = suser(p->p_ucred, &p->p_acflag)))
+	    (error = suser(p, 0)))
 		return (error);
 	/*
 	 * all top-level sysctl names are non-terminal
diff --git a/sys/kern/kern_time.c b/sys/kern/kern_time.c
index 02ab73c593a..8dc5399a4e6 100644
--- a/sys/kern/kern_time.c
+++ b/sys/kern/kern_time.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_time.c,v 1.35 2003/08/11 05:38:05 kevlo Exp $	*/
+/*	$OpenBSD: kern_time.c,v 1.36 2003/08/15 20:32:18 tedu Exp $	*/
 /*	$NetBSD: kern_time.c,v 1.20 1996/02/18 11:57:06 fvdl Exp $	*/
 
 /*
@@ -158,7 +158,7 @@ sys_clock_settime(p, v, retval)
 	struct timespec ats;
 	int error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 
 	clock_id = SCARG(uap, clock_id);
@@ -177,6 +177,8 @@ sys_clock_settime(p, v, retval)
 	if ((error = copyin(SCARG(uap, tp), &ats, sizeof(ats))) != 0)
 		return (error);
 
+	TIMESPEC_TO_TIMEVAL(&atv,&ats);
+
 	return (0);
 }
 
@@ -319,7 +321,7 @@ sys_settimeofday(p, v, retval)
 	struct timezone atz;
 	int error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)))
+	if ((error = suser(p, 0)))
 		return (error);
 	/* Verify all parameters before changing time. */
 	if (SCARG(uap, tv) && (error = copyin((void *)SCARG(uap, tv),
@@ -356,7 +358,7 @@ sys_adjtime(p, v, retval)
 	register long ndelta, ntickdelta, odelta;
 	int s, error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)))
+	if ((error = suser(p, 0)))
 		return (error);
 	if ((error = copyin((void *)SCARG(uap, delta), (void *)&atv,
 	    sizeof(struct timeval))))
diff --git a/sys/kern/kern_xxx.c b/sys/kern/kern_xxx.c
index 7c5fc527ad6..978fd141bf3 100644
--- a/sys/kern/kern_xxx.c
+++ b/sys/kern/kern_xxx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_xxx.c,v 1.8 2003/06/02 23:28:06 millert Exp $	*/
+/*	$OpenBSD: kern_xxx.c,v 1.9 2003/08/15 20:32:18 tedu Exp $	*/
 /*	$NetBSD: kern_xxx.c,v 1.32 1996/04/22 01:38:41 christos Exp $	*/
 
 /*
@@ -54,7 +54,7 @@ sys_reboot(p, v, retval)
 	} */ *uap = v;
 	int error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 	boot(SCARG(uap, opt));
 	return (0);
diff --git a/sys/kern/sys_process.c b/sys/kern/sys_process.c
index 51111f3dd7a..7646bea1a26 100644
--- a/sys/kern/sys_process.c
+++ b/sys/kern/sys_process.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sys_process.c,v 1.25 2003/06/02 23:28:06 millert Exp $	*/
+/*	$OpenBSD: sys_process.c,v 1.26 2003/08/15 20:32:18 tedu Exp $	*/
 /*	$NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $	*/
 
 /*-
@@ -142,7 +142,7 @@ sys_ptrace(p, v, retval)
 		if ((t->p_cred->p_ruid != p->p_cred->p_ruid ||
 		    ISSET(t->p_flag, P_SUGIDEXEC) ||
 		    ISSET(t->p_flag, P_SUGID)) &&
-		    (error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		    (error = suser(p, 0)) != 0)
 			return (error);
 
 		/*
diff --git a/sys/kern/tty.c b/sys/kern/tty.c
index ae7a047000d..bc808a570e5 100644
--- a/sys/kern/tty.c
+++ b/sys/kern/tty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tty.c,v 1.58 2003/06/02 23:28:06 millert Exp $	*/
+/*	$OpenBSD: tty.c,v 1.59 2003/08/15 20:32:18 tedu Exp $	*/
 /*	$NetBSD: tty.c,v 1.68.4.2 1996/06/06 16:04:52 thorpej Exp $	*/
 
 /*-
@@ -845,7 +845,7 @@ ttioctl(tp, cmd, data, flag, p)
 		*(struct winsize *)data = tp->t_winsize;
 		break;
 	case TIOCGPGRP:			/* get pgrp of tty */
-		if (!isctty(p, tp) && suser(p->p_ucred, &p->p_acflag))
+		if (!isctty(p, tp) && suser(p, 0))
 			return (ENOTTY);
 		*(int *)data = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
 		break;
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 4b2129ede8d..a99d658045d 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vfs_syscalls.c,v 1.105 2003/07/18 16:43:32 tedu Exp $	*/
+/*	$OpenBSD: vfs_syscalls.c,v 1.106 2003/08/15 20:32:18 tedu Exp $	*/
 /*	$NetBSD: vfs_syscalls.c,v 1.71 1996/04/23 10:29:02 mycroft Exp $	*/
 
 /*
@@ -108,7 +108,7 @@ sys_mount(p, v, retval)
 	struct vfsconf *vfsp;
 	struct timeval tv;
 
-	if (usermount == 0 && (error = suser(p->p_ucred, &p->p_acflag)))
+	if (usermount == 0 && (error = suser(p, 0)))
 		return (error);
 
 	/*
@@ -148,7 +148,7 @@ sys_mount(p, v, retval)
 		 * permitted to update it.
 		 */
 		if (mp->mnt_stat.f_owner != p->p_ucred->cr_uid &&
-		    (error = suser(p->p_ucred, &p->p_acflag))) {
+		    (error = suser(p, 0))) {
 			vput(vp);
 			return (error);
 		}
@@ -176,7 +176,7 @@ sys_mount(p, v, retval)
 	 */
 	if ((error = VOP_GETATTR(vp, &va, p->p_ucred, p)) ||
 	    (va.va_uid != p->p_ucred->cr_uid &&
-	    (error = suser(p->p_ucred, &p->p_acflag)))) {
+	    (error = suser(p, 0)))) {
 		vput(vp);
 		return (error);
 	}
@@ -397,7 +397,7 @@ sys_unmount(p, v, retval)
 	 * permitted to unmount this filesystem.
 	 */
 	if ((mp->mnt_stat.f_owner != p->p_ucred->cr_uid) &&
-	    (error = suser(p->p_ucred, &p->p_acflag))) {
+	    (error = suser(p, 0))) {
 		vput(vp);
 		return (error);
 	}
@@ -600,7 +600,7 @@ sys_statfs(p, v, retval)
 		sp->f_eflags = STATFS_SOFTUPD;
 #endif
 	/* Don't let non-root see filesystem id (for NFS security) */
-	if (suser(p->p_ucred, &p->p_acflag)) {
+	if (suser(p, 0)) {
 		bcopy((caddr_t)sp, (caddr_t)&sb, sizeof(sb));
 		sb.f_fsid.val[0] = sb.f_fsid.val[1] = 0;
 		sp = &sb;
@@ -646,7 +646,7 @@ sys_fstatfs(p, v, retval)
 		sp->f_eflags = STATFS_SOFTUPD;
 #endif
 	/* Don't let non-root see filesystem id (for NFS security) */
-	if (suser(p->p_ucred, &p->p_acflag)) {
+	if (suser(p, 0)) {
 		bcopy((caddr_t)sp, (caddr_t)&sb, sizeof(sb));
 		sb.f_fsid.val[0] = sb.f_fsid.val[1] = 0;
 		sp = &sb;
@@ -705,7 +705,7 @@ sys_getfsstat(p, v, retval)
 			if (mp->mnt_flag & MNT_SOFTDEP)
 				sp->f_eflags = STATFS_SOFTUPD;
 #endif
-			if (suser(p->p_ucred, &p->p_acflag)) {
+			if (suser(p, 0)) {
 				bcopy((caddr_t)sp, (caddr_t)&sb, sizeof(sb));
 				sb.f_fsid.val[0] = sb.f_fsid.val[1] = 0;
 				sp = &sb;
@@ -823,7 +823,7 @@ sys_chroot(p, v, retval)
 	int error;
 	struct nameidata nd;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE,
 	    SCARG(uap, path), p);
@@ -994,7 +994,7 @@ sys_getfh(p, v, retval)
 	/*
 	 * Must be super user
 	 */
-	error = suser(p->p_ucred, &p->p_acflag);
+	error = suser(p, 0);
 	if (error)
 		return (error);
 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE,
@@ -1043,7 +1043,7 @@ sys_fhopen(p, v, retval)
 	/*
 	 * Must be super user
 	 */
-	if ((error = suser(p->p_ucred, &p->p_acflag)))
+	if ((error = suser(p, 0)))
 		return (error);
 
 	flags = FFLAGS(SCARG(uap, flags));
@@ -1162,7 +1162,7 @@ sys_fhstat(p, v, retval)
 	/*
 	 * Must be super user
 	 */
-	if ((error = suser(p->p_ucred, &p->p_acflag)))
+	if ((error = suser(p, 0)))
 		return (error);
 
 	if ((error = copyin(SCARG(uap, fhp), &fh, sizeof(fhandle_t))) != 0)
@@ -1200,7 +1200,7 @@ sys_fhstatfs(p, v, retval)
 	/*
 	 * Must be super user
 	 */
-	if ((error = suser(p->p_ucred, &p->p_acflag)))
+	if ((error = suser(p, 0)))
 		return (error);
 
 	if ((error = copyin(SCARG(uap, fhp), &fh, sizeof(fhandle_t))) != 0)
@@ -1239,7 +1239,7 @@ sys_mknod(p, v, retval)
 	int whiteout = 0;
 	struct nameidata nd;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 	if (p->p_fd->fd_rdir)
 		return (EINVAL);
@@ -1654,7 +1654,7 @@ sys_stat(p, v, retval)
 	if (error)
 		return (error);
 	/* Don't let non-root see generation numbers (for NFS security) */
-	if (suser(p->p_ucred, &p->p_acflag))
+	if (suser(p, 0))
 		sb.st_gen = 0;
 	error = copyout((caddr_t)&sb, (caddr_t)SCARG(uap, ub), sizeof (sb));
 	return (error);
@@ -1687,7 +1687,7 @@ sys_lstat(p, v, retval)
 	if (error)
 		return (error);
 	/* Don't let non-root see generation numbers (for NFS security) */
-	if (suser(p->p_ucred, &p->p_acflag))
+	if (suser(p, 0))
 		sb.st_gen = 0;
 	error = copyout((caddr_t)&sb, (caddr_t)SCARG(uap, ub), sizeof (sb));
 	return (error);
@@ -1794,7 +1794,7 @@ sys_chflags(p, v, retval)
 	else if (SCARG(uap, flags) == VNOVAL)
 		error = EINVAL;
 	else {
-		if (suser(p->p_ucred, &p->p_acflag)) {
+		if (suser(p, 0)) {
 			if ((error = VOP_GETATTR(vp, &vattr, p->p_ucred, p)) != 0)
 				goto out;
 			if (vattr.va_type == VCHR || vattr.va_type == VBLK) {
@@ -1840,7 +1840,7 @@ sys_fchflags(p, v, retval)
 	else if (SCARG(uap, flags) == VNOVAL)
 		error = EINVAL;
 	else {
-		if (suser(p->p_ucred, &p->p_acflag)) {
+		if (suser(p, 0)) {
 			if ((error = VOP_GETATTR(vp, &vattr, p->p_ucred, p))
 			    != 0)
 				goto out;
@@ -1968,7 +1968,7 @@ sys_chown(p, v, retval)
 		error = EROFS;
 	else {
 		if ((SCARG(uap, uid) != -1 || SCARG(uap, gid) != -1) &&
-		    (suser(p->p_ucred, &p->p_acflag) || suid_clear)) {
+		    (suser(p, 0) || suid_clear)) {
 			error = VOP_GETATTR(vp, &vattr, p->p_ucred, p);
 			if (error)
 				goto out;
@@ -2020,7 +2020,7 @@ sys_lchown(p, v, retval)
 		error = EROFS;
 	else {
 		if ((SCARG(uap, uid) != -1 || SCARG(uap, gid) != -1) &&
-		    (suser(p->p_ucred, &p->p_acflag) || suid_clear)) {
+		    (suser(p, 0) || suid_clear)) {
 			error = VOP_GETATTR(vp, &vattr, p->p_ucred, p);
 			if (error)
 				goto out;
@@ -2071,7 +2071,7 @@ sys_fchown(p, v, retval)
 		error = EROFS;
 	else {
 		if ((SCARG(uap, uid) != -1 || SCARG(uap, gid) != -1) &&
-		    (suser(p->p_ucred, &p->p_acflag) || suid_clear)) {
+		    (suser(p, 0) || suid_clear)) {
 			error = VOP_GETATTR(vp, &vattr, p->p_ucred, p);
 			if (error)
 				goto out;
@@ -2629,7 +2629,7 @@ sys_revoke(p, v, retval)
 	if ((error = VOP_GETATTR(vp, &vattr, p->p_ucred, p)) != 0)
 		goto out;
 	if (p->p_ucred->cr_uid != vattr.va_uid &&
-	    (error = suser(p->p_ucred, &p->p_acflag)))
+	    (error = suser(p, 0)))
 		goto out;
 	if (vp->v_usecount > 1 || (vp->v_flag & (VALIASED | VLAYER)))
 		VOP_REVOKE(vp, REVOKEALL);
diff --git a/sys/miscfs/procfs/procfs_mem.c b/sys/miscfs/procfs/procfs_mem.c
index f1ee0c6d6c0..b4a1f798fbb 100644
--- a/sys/miscfs/procfs/procfs_mem.c
+++ b/sys/miscfs/procfs/procfs_mem.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: procfs_mem.c,v 1.19 2003/06/02 23:28:11 millert Exp $	*/
+/*	$OpenBSD: procfs_mem.c,v 1.20 2003/08/15 20:32:19 tedu Exp $	*/
 /*	$NetBSD: procfs_mem.c,v 1.8 1996/02/09 22:40:50 christos Exp $	*/
 
 /*
@@ -110,7 +110,7 @@ procfs_checkioperm(p, t)
 	if ((t->p_cred->p_ruid != p->p_cred->p_ruid ||
 	    ISSET(t->p_flag, P_SUGIDEXEC) ||
 	    ISSET(t->p_flag, P_SUGID)) &&
-	    (error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	    (error = suser(p, 0)) != 0)
 		return (error);
 
 	if ((t->p_pid == 1) && (securelevel > -1))
diff --git a/sys/miscfs/umapfs/umap_vfsops.c b/sys/miscfs/umapfs/umap_vfsops.c
index 0209a6e92c6..b62b4073970 100644
--- a/sys/miscfs/umapfs/umap_vfsops.c
+++ b/sys/miscfs/umapfs/umap_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: umap_vfsops.c,v 1.23 2003/08/14 07:46:40 mickey Exp $	*/
+/*	$OpenBSD: umap_vfsops.c,v 1.24 2003/08/15 20:32:19 tedu Exp $	*/
 /*	$NetBSD: umap_vfsops.c,v 1.35 2002/09/21 18:09:31 christos Exp $	*/
 
 /*
@@ -90,7 +90,7 @@ umapfs_mount(mp, path, data, ndp, p)
 #endif
 
 	/* only for root */
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return error;
 
 #ifdef UMAPFS_DIAGNOSTIC
diff --git a/sys/msdosfs/msdosfs_vnops.c b/sys/msdosfs/msdosfs_vnops.c
index 08b83f9725e..f1408bec51b 100644
--- a/sys/msdosfs/msdosfs_vnops.c
+++ b/sys/msdosfs/msdosfs_vnops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: msdosfs_vnops.c,v 1.40 2003/05/07 22:16:26 deraadt Exp $	*/
+/*	$OpenBSD: msdosfs_vnops.c,v 1.41 2003/08/15 20:32:19 tedu Exp $	*/
 /*	$NetBSD: msdosfs_vnops.c,v 1.63 1997/10/17 11:24:19 ws Exp $	*/
 
 /*-
@@ -368,7 +368,7 @@ msdosfs_setattr(v)
 	}
 	if (vap->va_atime.tv_sec != VNOVAL || vap->va_mtime.tv_sec != VNOVAL) {
 		if (cred->cr_uid != dep->de_pmp->pm_uid &&
-		    (error = suser(cred, &ap->a_p->p_acflag)) &&
+		    (error = suser_ucred(cred)) &&
 		    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
 		    (error = VOP_ACCESS(ap->a_vp, VWRITE, cred, ap->a_p))))
 			return (error);
@@ -387,7 +387,7 @@ msdosfs_setattr(v)
 	 */
 	if (vap->va_mode != (mode_t)VNOVAL) {
 		if (cred->cr_uid != dep->de_pmp->pm_uid &&
-		    (error = suser(cred, &ap->a_p->p_acflag)))
+		    (error = suser_ucred(cred)))
 			return (error);
 		/* We ignore the read and execute bits. */
 		if (vap->va_mode & VWRITE)
@@ -401,7 +401,7 @@ msdosfs_setattr(v)
 	 */
 	if (vap->va_flags != VNOVAL) {
 		if (cred->cr_uid != dep->de_pmp->pm_uid &&
-		    (error = suser(cred, &ap->a_p->p_acflag)))
+		    (error = suser_ucred(cred)))
 			return (error);
 		if (vap->va_flags & SF_ARCHIVED)
 			dep->de_Attributes &= ~ATTR_ARCHIVE;
diff --git a/sys/net/if.c b/sys/net/if.c
index f7f059e748e..458e8af9bdd 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if.c,v 1.67 2003/07/23 22:48:00 itojun Exp $	*/
+/*	$OpenBSD: if.c,v 1.68 2003/08/15 20:32:19 tedu Exp $	*/
 /*	$NetBSD: if.c,v 1.35 1996/05/07 05:26:04 thorpej Exp $	*/
 
 /*
@@ -932,7 +932,7 @@ ifioctl(so, cmd, data, p)
 		break;
 
 	case SIOCSIFFLAGS:
-		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		if ((error = suser(p, 0)) != 0)
 			return (error);
 		if (ifp->if_flags & IFF_UP && (ifr->ifr_flags & IFF_UP) == 0) {
 			int s = splimp();
@@ -951,7 +951,7 @@ ifioctl(so, cmd, data, p)
 		break;
 
 	case SIOCSIFMETRIC:
-		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		if ((error = suser(p, 0)) != 0)
 			return (error);
 		ifp->if_metric = ifr->ifr_metric;
 		break;
@@ -962,7 +962,7 @@ ifioctl(so, cmd, data, p)
 		int oldmtu = ifp->if_mtu;
 #endif
 
-		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		if ((error = suser(p, 0)) != 0)
 			return (error);
 		if (ifp->if_ioctl == NULL)
 			return (EOPNOTSUPP);
@@ -987,7 +987,7 @@ ifioctl(so, cmd, data, p)
 	case SIOCADDMULTI:
 	case SIOCDELMULTI:
 	case SIOCSIFMEDIA:
-		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		if ((error = suser(p, 0)) != 0)
 			return (error);
 		/* FALLTHROUGH */
 	case SIOCGIFPSRCADDR:
diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c
index 72b39ca21f0..2925882af27 100644
--- a/sys/net/if_bridge.c
+++ b/sys/net/if_bridge.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_bridge.c,v 1.123 2003/07/28 00:58:08 itojun Exp $	*/
+/*	$OpenBSD: if_bridge.c,v 1.124 2003/08/15 20:32:19 tedu Exp $	*/
 
 /*
  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
@@ -239,7 +239,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 	s = splnet();
 	switch (cmd) {
 	case SIOCBRDGADD:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 
 		ifs = ifunit(req->ifbr_ifsname);
@@ -331,7 +331,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		ifs->if_bridge = (caddr_t)sc;
 		break;
 	case SIOCBRDGDEL:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 
 		LIST_FOREACH(p, &sc->sc_iflist, next) {
@@ -357,7 +357,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		error = bridge_bifconf(sc, bifconf);
 		break;
 	case SIOCBRDGADDS:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 		ifs = ifunit(req->ifbr_ifsname);
 		if (ifs == NULL) {			/* no such interface */
@@ -393,7 +393,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		LIST_INSERT_HEAD(&sc->sc_spanlist, p, next);
 		break;
 	case SIOCBRDGDELS:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 		LIST_FOREACH(p, &sc->sc_spanlist, next) {
 			if (strncmp(p->ifp->if_xname, req->ifbr_ifsname,
@@ -433,7 +433,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		req->ifbr_portno = p->ifp->if_index & 0xff;
 		break;
 	case SIOCBRDGSIFFLGS:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 		ifs = ifunit(req->ifbr_ifsname);
 		if (ifs == NULL) {
@@ -465,7 +465,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		break;
 	case SIOCBRDGSIFPRIO:
 	case SIOCBRDGSIFCOST:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 		ifs = ifunit(req->ifbr_ifsname);
 		if (ifs == NULL) {
@@ -497,13 +497,13 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		error = bridge_rtfind(sc, baconf);
 		break;
 	case SIOCBRDGFLUSH:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 
 		error = bridge_rtflush(sc, req->ifbr_ifsflags);
 		break;
 	case SIOCBRDGSADDR:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 
 		ifs = ifunit(bareq->ifba_ifsname);
@@ -524,7 +524,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 			error = ENOMEM;
 		break;
 	case SIOCBRDGDADDR:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 		error = bridge_rtdaddr(sc, &bareq->ifba_dst);
 		break;
@@ -532,13 +532,13 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		bparam->ifbrp_csize = sc->sc_brtmax;
 		break;
 	case SIOCBRDGSCACHE:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 		sc->sc_brtmax = bparam->ifbrp_csize;
 		bridge_rttrim(sc);
 		break;
 	case SIOCBRDGSTO:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 		if (bparam->ifbrp_ctime < 0 ||
 		    bparam->ifbrp_ctime > INT_MAX / hz) {
@@ -562,7 +562,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 
 		break;
 	case SIOCBRDGARL:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 		ifs = ifunit(brlreq->ifbr_ifsname);
 		if (ifs == NULL) {
@@ -600,7 +600,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		}
 		break;
 	case SIOCBRDGFRL:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 		ifs = ifunit(brlreq->ifbr_ifsname);
 		if (ifs == NULL) {
@@ -634,7 +634,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 	case SIOCBRDGSFD:
 	case SIOCBRDGSMA:
 	case SIOCBRDGSHT:
-		error = suser(prc->p_ucred, &prc->p_acflag);
+		error = suser(prc, 0);
 		break;
 	default:
 		error = EINVAL;
diff --git a/sys/net/if_gre.c b/sys/net/if_gre.c
index 9e76a114461..103b89e5262 100644
--- a/sys/net/if_gre.c
+++ b/sys/net/if_gre.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: if_gre.c,v 1.27 2003/07/09 22:03:15 itojun Exp $ */
+/*      $OpenBSD: if_gre.c,v 1.28 2003/08/15 20:32:19 tedu Exp $ */
 /*	$NetBSD: if_gre.c,v 1.9 1999/10/25 19:18:11 drochner Exp $ */
 
 /*
@@ -435,7 +435,7 @@ gre_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		break;
 	case GRESPROTO:
 		/* Check for superuser */
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 
 		sc->g_proto = ifr->ifr_flags;
@@ -457,7 +457,7 @@ gre_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 	case GRESADDRS:
 	case GRESADDRD:
 		/* Check for superuser */
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 
 		/*
@@ -506,7 +506,7 @@ gre_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		ifr->ifr_addr = *sa;
 		break;
 	case SIOCSLIFPHYADDR:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 		if (lifr->addr.ss_family != AF_INET ||
 		    lifr->dstaddr.ss_family != AF_INET) {
@@ -523,7 +523,7 @@ gre_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		    (satosin((struct sockadrr *)&lifr->dstaddr))->sin_addr;
 		goto recompute;
 	case SIOCDIFPHYADDR:
-		if ((error = suser(prc->p_ucred, &prc->p_acflag)) != 0)
+		if ((error = suser(prc, 0)) != 0)
 			break;
 		sc->g_src.s_addr = INADDR_ANY;
 		sc->g_dst.s_addr = INADDR_ANY;
diff --git a/sys/net/if_ppp.c b/sys/net/if_ppp.c
index ec8404608c0..f165b1c41fc 100644
--- a/sys/net/if_ppp.c
+++ b/sys/net/if_ppp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ppp.c,v 1.35 2003/06/02 23:28:12 millert Exp $	*/
+/*	$OpenBSD: if_ppp.c,v 1.36 2003/08/15 20:32:19 tedu Exp $	*/
 /*	$NetBSD: if_ppp.c,v 1.39 1997/05/17 21:11:59 christos Exp $	*/
 
 /*
@@ -395,7 +395,7 @@ pppioctl(sc, cmd, data, flag, p)
 	break;
 
     case PPPIOCSFLAGS:
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 	    return (error);
 	flags = *(int *)data & SC_MASK;
 	s = splsoftnet();
@@ -409,7 +409,7 @@ pppioctl(sc, cmd, data, flag, p)
 	break;
 
     case PPPIOCSMRU:
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 	    return (error);
 	mru = *(int *)data;
 	if (mru >= PPP_MRU && mru <= PPP_MAXMRU)
@@ -422,7 +422,7 @@ pppioctl(sc, cmd, data, flag, p)
 
 #ifdef VJC
     case PPPIOCSMAXCID:
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 	    return (error);
 	if (sc->sc_comp) {
 	    s = splsoftnet();
@@ -433,14 +433,14 @@ pppioctl(sc, cmd, data, flag, p)
 #endif
 
     case PPPIOCXFERUNIT:
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 	    return (error);
 	sc->sc_xfer = p->p_pid;
 	break;
 
 #ifdef PPP_COMPRESS
     case PPPIOCSCOMPRESS:
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 	    return (error);
 	odp = (struct ppp_option_data *) data;
 	nb = odp->length;
@@ -510,7 +510,7 @@ pppioctl(sc, cmd, data, flag, p)
 	if (cmd == PPPIOCGNPMODE) {
 	    npi->mode = sc->sc_npmode[npx];
 	} else {
-	    if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	    if ((error = suser(p, 0)) != 0)
 		return (error);
 	    if (npi->mode != sc->sc_npmode[npx]) {
 		s = splsoftnet();
diff --git a/sys/net/if_sl.c b/sys/net/if_sl.c
index 554e6be272a..52841b2cc2e 100644
--- a/sys/net/if_sl.c
+++ b/sys/net/if_sl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_sl.c,v 1.20 2003/06/02 23:28:12 millert Exp $	*/
+/*	$OpenBSD: if_sl.c,v 1.21 2003/08/15 20:32:19 tedu Exp $	*/
 /*	$NetBSD: if_sl.c,v 1.39.4.1 1996/06/02 16:26:31 thorpej Exp $	*/
 
 /*
@@ -260,7 +260,7 @@ slopen(dev, tp)
 	register struct sl_softc *sc;
 	int i, error, s;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 
 	if (tp->t_line == SLIPDISC)
diff --git a/sys/net/if_strip.c b/sys/net/if_strip.c
index 5ab0e1510c2..87d37fc47f1 100644
--- a/sys/net/if_strip.c
+++ b/sys/net/if_strip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_strip.c,v 1.25 2003/06/02 23:28:12 millert Exp $	*/
+/*	$OpenBSD: if_strip.c,v 1.26 2003/08/15 20:32:19 tedu Exp $	*/
 /*	$NetBSD: if_strip.c,v 1.2.4.3 1996/08/03 00:58:32 jtc Exp $	*/
 /*	from: NetBSD: if_sl.c,v 1.38 1996/02/13 22:00:23 christos Exp $	*/
 
@@ -447,7 +447,7 @@ stripopen(dev, tp)
 	int s;
 #endif
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 
 	if (tp->t_line == STRIPDISC)
diff --git a/sys/net/if_tun.c b/sys/net/if_tun.c
index bc79e9037c5..8bfe75e4182 100644
--- a/sys/net/if_tun.c
+++ b/sys/net/if_tun.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_tun.c,v 1.48 2003/06/12 10:49:17 henning Exp $	*/
+/*	$OpenBSD: if_tun.c,v 1.49 2003/08/15 20:32:19 tedu Exp $	*/
 /*	$NetBSD: if_tun.c,v 1.24 1996/05/07 02:40:48 thorpej Exp $	*/
 
 /*
@@ -193,7 +193,7 @@ tunopen(dev, flag, mode, p)
 	struct ifnet	*ifp;
 	register int	unit, error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 
 	if ((unit = minor(dev)) >= ntun)
diff --git a/sys/net/if_vlan.c b/sys/net/if_vlan.c
index 9a6ec88a038..990128f85bd 100644
--- a/sys/net/if_vlan.c
+++ b/sys/net/if_vlan.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_vlan.c,v 1.40 2003/08/14 19:00:12 jason Exp $ */
+/*	$OpenBSD: if_vlan.c,v 1.41 2003/08/15 20:32:19 tedu Exp $ */
 /*
  * Copyright 1998 Massachusetts Institute of Technology
  *
@@ -563,7 +563,7 @@ vlan_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		break;
 
 	case SIOCSETVLAN:
-		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		if ((error = suser(p, 0)) != 0)
 			break;
 		if ((error = copyin(ifr->ifr_data, &vlr, sizeof vlr)))
 			break;
diff --git a/sys/net/ppp_tty.c b/sys/net/ppp_tty.c
index 12ada39de73..398089f5a3d 100644
--- a/sys/net/ppp_tty.c
+++ b/sys/net/ppp_tty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ppp_tty.c,v 1.16 2003/03/09 12:03:22 kjc Exp $	*/
+/*	$OpenBSD: ppp_tty.c,v 1.17 2003/08/15 20:32:19 tedu Exp $	*/
 /*	$NetBSD: ppp_tty.c,v 1.12 1997/03/24 21:23:10 christos Exp $	*/
 
 /*
@@ -187,7 +187,7 @@ pppopen(dev, tp)
     register struct ppp_softc *sc;
     int error, s;
 
-    if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+    if ((error = suser(p, 0)) != 0)
 	return (error);
 
     s = spltty();
@@ -416,7 +416,7 @@ ppptioctl(tp, cmd, data, flag, p)
     error = 0;
     switch (cmd) {
     case PPPIOCSASYNCMAP:
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 	    break;
 	sc->sc_asyncmap[0] = *(u_int *)data;
 	break;
@@ -426,7 +426,7 @@ ppptioctl(tp, cmd, data, flag, p)
 	break;
 
     case PPPIOCSRASYNCMAP:
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 	    break;
 	sc->sc_rasyncmap = *(u_int *)data;
 	break;
@@ -436,7 +436,7 @@ ppptioctl(tp, cmd, data, flag, p)
 	break;
 
     case PPPIOCSXASYNCMAP:
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 	    break;
 	s = spltty();
 	bcopy(data, sc->sc_asyncmap, sizeof(sc->sc_asyncmap));
diff --git a/sys/net/rtsock.c b/sys/net/rtsock.c
index c17a79a0374..4a40d2b2030 100644
--- a/sys/net/rtsock.c
+++ b/sys/net/rtsock.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtsock.c,v 1.31 2003/08/14 19:00:12 jason Exp $	*/
+/*	$OpenBSD: rtsock.c,v 1.32 2003/08/15 20:32:19 tedu Exp $	*/
 /*	$NetBSD: rtsock.c,v 1.18 1996/03/29 00:32:10 cgd Exp $	*/
 
 /*
@@ -236,8 +236,7 @@ route_output(struct mbuf *m, ...)
 	 * Verify that the caller has the appropriate privilege; RTM_GET
 	 * is the only operation the non-superuser is allowed.
 	 */
-	if (rtm->rtm_type != RTM_GET &&
-	    suser(curproc->p_ucred, &curproc->p_acflag) != 0)
+	if (rtm->rtm_type != RTM_GET && suser(curproc, 0) != 0)
 		senderr(EACCES);
 	switch (rtm->rtm_type) {
 
diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c
index 4b1be967ce0..3136ac4366d 100644
--- a/sys/netinet/in_pcb.c
+++ b/sys/netinet/in_pcb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in_pcb.c,v 1.66 2003/06/02 23:28:13 millert Exp $	*/
+/*	$OpenBSD: in_pcb.c,v 1.67 2003/08/15 20:32:20 tedu Exp $	*/
 /*	$NetBSD: in_pcb.c,v 1.25 1996/02/13 23:41:53 christos Exp $	*/
 
 /*
@@ -255,7 +255,7 @@ in_pcbbind(v, nam)
 
 			/* GROSS */
 			if (ntohs(lport) < IPPORT_RESERVED &&
-			    (error = suser(p->p_ucred, &p->p_acflag)))
+			    (error = suser(p, 0)))
 				return (EACCES);
 			if (so->so_euid) {
 				t = in_pcblookup(table, &zeroin_addr, 0,
@@ -279,7 +279,7 @@ in_pcbbind(v, nam)
 			first = ipport_hifirstauto;	/* sysctl */
 			last = ipport_hilastauto;
 		} else if (inp->inp_flags & INP_LOWPORT) {
-			if ((error = suser(p->p_ucred, &p->p_acflag)))
+			if ((error = suser(p, 0)))
 				return (EACCES);
 			first = IPPORT_RESERVED-1; /* 1023 */
 			last = 600;		   /* not IPPORT_RESERVED/2 */
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index 5a8bd4bd53d..31c176d3379 100644
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_output.c,v 1.155 2003/08/14 19:00:12 jason Exp $	*/
+/*	$OpenBSD: ip_output.c,v 1.156 2003/08/15 20:32:20 tedu Exp $	*/
 /*	$NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $	*/
 
 /*
@@ -1088,7 +1088,7 @@ ip_ctloutput(op, so, level, optname, mp)
 			switch (optname) {
 			case IP_AUTH_LEVEL:
 				if (optval < ipsec_auth_default_level &&
-				    suser(p->p_ucred, &p->p_acflag)) {
+				    suser(p, 0)) {
 					error = EACCES;
 					break;
 				}
@@ -1097,7 +1097,7 @@ ip_ctloutput(op, so, level, optname, mp)
 
 			case IP_ESP_TRANS_LEVEL:
 				if (optval < ipsec_esp_trans_default_level &&
-				    suser(p->p_ucred, &p->p_acflag)) {
+				    suser(p, 0)) {
 					error = EACCES;
 					break;
 				}
@@ -1106,7 +1106,7 @@ ip_ctloutput(op, so, level, optname, mp)
 
 			case IP_ESP_NETWORK_LEVEL:
 				if (optval < ipsec_esp_network_default_level &&
-				    suser(p->p_ucred, &p->p_acflag)) {
+				    suser(p, 0)) {
 					error = EACCES;
 					break;
 				}
@@ -1114,7 +1114,7 @@ ip_ctloutput(op, so, level, optname, mp)
 				break;
 			case IP_IPCOMP_LEVEL:
 				if (optval < ipsec_ipcomp_default_level &&
-				    suser(p->p_ucred, &p->p_acflag)) {
+				    suser(p, 0)) {
 					error = EACCES;
 					break;
 				}
diff --git a/sys/netinet6/in6_pcb.c b/sys/netinet6/in6_pcb.c
index 42644c814ad..fe423a75fb9 100644
--- a/sys/netinet6/in6_pcb.c
+++ b/sys/netinet6/in6_pcb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in6_pcb.c,v 1.34 2003/06/02 23:28:15 millert Exp $	*/
+/*	$OpenBSD: in6_pcb.c,v 1.35 2003/08/15 20:32:20 tedu Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -273,7 +273,7 @@ in6_pcbbind(inp, nam)
 			 * curproc?  (Marked with BSD's {in,}famous XXX ?
 			 */
 			if (ntohs(lport) < IPPORT_RESERVED &&
-			    (error = suser(p->p_ucred, &p->p_acflag)))
+			    (error = suser(p, 0)))
 				return error;
 
 			t = in_pcblookup(head,
@@ -331,7 +331,7 @@ in6_pcbsetport(laddr, inp, p)
 		first = ipport_hifirstauto;	/* sysctl */
 		last = ipport_hilastauto;
 	} else if (inp->inp_flags & INP_LOWPORT) {
-		if ((error = suser(p->p_ucred, &p->p_acflag)))
+		if ((error = suser(p, 0)))
 			return (EACCES);
 		first = IPPORT_RESERVED-1; /* 1023 */
 		last = 600;		   /* not IPPORT_RESERVED/2 */
diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index 02c1609ee32..02700b3a372 100644
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip6_output.c,v 1.75 2003/06/11 02:54:02 itojun Exp $	*/
+/*	$OpenBSD: ip6_output.c,v 1.76 2003/08/15 20:32:20 tedu Exp $	*/
 /*	$KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $	*/
 
 /*
@@ -1373,7 +1373,7 @@ do { \
 				switch (optname) {
 				case IPV6_AUTH_LEVEL:
 				        if (optval < ipsec_auth_default_level &&
-					    suser(p->p_ucred, &p->p_acflag)) {
+					    suser(p, 0)) {
 						error = EACCES;
 						break;
 					}
@@ -1382,7 +1382,7 @@ do { \
 
 				case IPV6_ESP_TRANS_LEVEL:
 				        if (optval < ipsec_esp_trans_default_level &&
-					    suser(p->p_ucred, &p->p_acflag)) {
+					    suser(p, 0)) {
 						error = EACCES;
 						break;
 					}
@@ -1391,7 +1391,7 @@ do { \
 
 				case IPV6_ESP_NETWORK_LEVEL:
 				        if (optval < ipsec_esp_network_default_level &&
-					    suser(p->p_ucred, &p->p_acflag)) {
+					    suser(p, 0)) {
 						error = EACCES;
 						break;
 					}
@@ -1400,7 +1400,7 @@ do { \
 
 				case IPV6_IPCOMP_LEVEL:
 				        if (optval < ipsec_ipcomp_default_level &&
-					    suser(p->p_ucred, &p->p_acflag)) {
+					    suser(p, 0)) {
 						error = EACCES;
 						break;
 					}
@@ -1708,7 +1708,7 @@ ip6_pcbopts(pktopt, m, so)
 	}
 
 	/*  set options specified by user. */
-	if (p && !suser(p->p_ucred, &p->p_acflag))
+	if (p && !suser(p, 0))
 		priv = 1;
 	if ((error = ip6_setpktoptions(m, opt, priv)) != 0) {
 		(void)m_free(m);
@@ -1831,7 +1831,7 @@ ip6_setmoptions(optname, im6op, m)
 			 * all multicast addresses. Only super user is allowed
 			 * to do this.
 			 */
-			if (suser(p->p_ucred, &p->p_acflag))
+			if (suser(p, 0))
 			{
 				error = EACCES;
 				break;
@@ -1931,7 +1931,7 @@ ip6_setmoptions(optname, im6op, m)
 		}
 		mreq = mtod(m, struct ipv6_mreq *);
 		if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
-			if (suser(p->p_ucred, &p->p_acflag))
+			if (suser(p, 0))
 			{
 				error = EACCES;
 				break;
diff --git a/sys/nfs/nfs_serv.c b/sys/nfs/nfs_serv.c
index c98c3c5f84c..a0cdc8349f7 100644
--- a/sys/nfs/nfs_serv.c
+++ b/sys/nfs/nfs_serv.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nfs_serv.c,v 1.35 2003/06/02 23:28:19 millert Exp $	*/
+/*	$OpenBSD: nfs_serv.c,v 1.36 2003/08/15 20:32:20 tedu Exp $	*/
 /*     $NetBSD: nfs_serv.c,v 1.34 1997/05/12 23:37:12 fvdl Exp $       */
 
 /*
@@ -1343,7 +1343,7 @@ nfsrv_create(nfsd, slp, procp, mrq)
 			if (va.va_type == VCHR && rdev == 0xffffffff)
 				va.va_type = VFIFO;
 			if (va.va_type != VFIFO &&
-			    (error = suser(cred, (u_short *)0))) {
+			    (error = suser_ucred(cred))) {
 				vrele(nd.ni_startdir);
 				free(nd.ni_cnd.cn_pnbuf, M_NAMEI);
 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
@@ -1540,7 +1540,7 @@ nfsrv_mknod(nfsd, slp, procp, mrq)
 			FREE(nd.ni_cnd.cn_pnbuf, M_NAMEI);
 	} else {
 		if (va.va_type != VFIFO &&
-		    (error = suser(cred, (u_short *)0))) {
+		    (error = suser_ucred(cred))) {
 			vrele(nd.ni_startdir);
 			free((caddr_t)nd.ni_cnd.cn_pnbuf, M_NAMEI);
 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
@@ -1652,7 +1652,7 @@ nfsrv_remove(nfsd, slp, procp, mrq)
 	if (!error) {
 		vp = nd.ni_vp;
 		if (vp->v_type == VDIR &&
-		    (error = suser(cred, (u_short *)0)) != 0)
+		    (error = suser_ucred(cred)) != 0)
 			goto out;
 		/*
 		 * The root of a mounted filesystem cannot be deleted.
@@ -1908,7 +1908,7 @@ nfsrv_link(nfsd, slp, procp, mrq)
 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
 		return (0);
 	}
-	if (vp->v_type == VDIR && (error = suser(cred, (u_short *)0)) != 0)
+	if (vp->v_type == VDIR && (error = suser_ucred(cred)) != 0)
 		goto out1;
 	nd.ni_cnd.cn_cred = cred;
 	nd.ni_cnd.cn_nameiop = CREATE;
diff --git a/sys/nfs/nfs_syscalls.c b/sys/nfs/nfs_syscalls.c
index ad3e0cc0b07..6cc9edca2b2 100644
--- a/sys/nfs/nfs_syscalls.c
+++ b/sys/nfs/nfs_syscalls.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nfs_syscalls.c,v 1.37 2003/06/02 23:28:20 millert Exp $	*/
+/*	$OpenBSD: nfs_syscalls.c,v 1.38 2003/08/15 20:32:20 tedu Exp $	*/
 /*	$NetBSD: nfs_syscalls.c,v 1.19 1996/02/18 11:53:52 fvdl Exp $	*/
 
 /*
@@ -243,7 +243,7 @@ sys_nfssvc(p, v, retval)
 	/*
 	 * Must be super user
 	 */
-	error = suser(p->p_ucred, &p->p_acflag);
+	error = suser(p, 0);
 	if(error)
 		return (error);
 	while (nfssvc_sockhead_flag & SLP_INIT) {
diff --git a/sys/sys/ucred.h b/sys/sys/ucred.h
index 3502f3be8b6..a75c073d200 100644
--- a/sys/sys/ucred.h
+++ b/sys/sys/ucred.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ucred.h,v 1.5 2003/06/02 23:28:22 millert Exp $	*/
+/*	$OpenBSD: ucred.h,v 1.6 2003/08/15 20:32:20 tedu Exp $	*/
 /*	$NetBSD: ucred.h,v 1.12 1995/06/01 22:44:50 jtc Exp $	*/
 
 /*
@@ -51,11 +51,15 @@ struct ucred {
 #ifdef _KERNEL
 #define	crhold(cr)	(cr)->cr_ref++
 
+#define SUSER_NOACCT	0x1	/* don't mark accounting flags */
+
 struct ucred	*crcopy(struct ucred *cr);
 struct ucred	*crdup(struct ucred *cr);
 void		crfree(struct ucred *cr);
 struct ucred	*crget(void);
-int		suser(struct ucred *cred, u_short *acflag);
+int		suser(struct proc *p, u_int flags);
+int		suser_ucred(struct ucred *cred);
+
 #endif /* _KERNEL */
 
 #endif /* !_SYS_UCRED_H_ */
diff --git a/sys/ufs/ext2fs/ext2fs_vnops.c b/sys/ufs/ext2fs/ext2fs_vnops.c
index d66ce1b0aa7..b972e9908d9 100644
--- a/sys/ufs/ext2fs/ext2fs_vnops.c
+++ b/sys/ufs/ext2fs/ext2fs_vnops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ext2fs_vnops.c,v 1.28 2003/08/11 21:53:10 tedu Exp $	*/
+/*	$OpenBSD: ext2fs_vnops.c,v 1.29 2003/08/15 20:32:20 tedu Exp $	*/
 /*	$NetBSD: ext2fs_vnops.c,v 1.1 1997/06/11 09:34:09 bouyer Exp $	*/
 
 /*
@@ -289,7 +289,7 @@ ext2fs_setattr(v)
 		if (vp->v_mount->mnt_flag & MNT_RDONLY)
 			return (EROFS);
 		if (cred->cr_uid != ip->i_e2fs_uid &&
-			(error = suser(cred, &p->p_acflag)))
+			(error = suser_ucred(cred)))
 			return (error);
 #ifdef EXT2FS_SYSTEM_FLAGS
 		if (cred->cr_uid == 0) {
@@ -349,7 +349,7 @@ ext2fs_setattr(v)
 		if (vp->v_mount->mnt_flag & MNT_RDONLY)
 			return (EROFS);
 		if (cred->cr_uid != ip->i_e2fs_uid &&
-			(error = suser(cred, &p->p_acflag)) &&
+			(error = suser_ucred(cred)) &&
 			((vap->va_vaflags & VA_UTIMES_NULL) == 0 || 
 			(error = VOP_ACCESS(vp, VWRITE, cred, p))))
 			return (error);
@@ -385,8 +385,7 @@ ext2fs_chmod(vp, mode, cred, p)
 	register struct inode *ip = VTOI(vp);
 	int error;
 
-	if (cred->cr_uid != ip->i_e2fs_uid &&
-		(error = suser(cred, &p->p_acflag)))
+	if (cred->cr_uid != ip->i_e2fs_uid && (error = suser_ucred(cred)))
 		return (error);
 	if (cred->cr_uid) {
 		if (vp->v_type != VDIR && (mode & S_ISTXT))
@@ -430,7 +429,7 @@ ext2fs_chown(vp, uid, gid, cred, p)
 	 */
 	if ((cred->cr_uid != ip->i_e2fs_uid || uid != ip->i_e2fs_uid ||
 		(gid != ip->i_e2fs_gid && !groupmember((gid_t)gid, cred))) &&
-		(error = suser(cred, &p->p_acflag)))
+		(error = suser_ucred(cred)))
 		return (error);
 	ogid = ip->i_e2fs_gid;
 	ouid = ip->i_e2fs_uid;
@@ -1272,7 +1271,7 @@ ext2fs_makeinode(mode, dvp, vpp, cnp)
 	ip->i_e2fs_nlink = 1;
 	if ((ip->i_e2fs_mode & ISGID) &&
 		!groupmember(ip->i_e2fs_gid, cnp->cn_cred) &&
-	    suser(cnp->cn_cred, NULL))
+	    suser_ucred(cnp->cn_cred))
 		ip->i_e2fs_mode &= ~ISGID;
 
 	/*
diff --git a/sys/ufs/lfs/lfs_syscalls.c b/sys/ufs/lfs/lfs_syscalls.c
index f9ffda24706..72133b7c15a 100644
--- a/sys/ufs/lfs/lfs_syscalls.c
+++ b/sys/ufs/lfs/lfs_syscalls.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lfs_syscalls.c,v 1.8 2003/06/02 23:28:23 millert Exp $	*/
+/*	$OpenBSD: lfs_syscalls.c,v 1.9 2003/08/15 20:32:20 tedu Exp $	*/
 /*	$NetBSD: lfs_syscalls.c,v 1.10 1996/02/09 22:28:56 christos Exp $	*/
 
 /*-
@@ -110,7 +110,7 @@ lfs_markv(p, v, retval)
 	u_long bsize;
 	int cnt, error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 
 	if ((error = copyin(SCARG(uap, fsidp), &fsid, sizeof(fsid_t))) != 0)
@@ -285,7 +285,7 @@ lfs_bmapv(p, v, retval)
 	ufs_daddr_t daddr;
 	int cnt, error, step;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 
 	error = copyin(SCARG(uap, fsidp), &fsid, sizeof(fsid_t));
@@ -354,7 +354,7 @@ lfs_segclean(p, v, retval)
 	fsid_t fsid;
 	int error;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 
 	if ((error = copyin(SCARG(uap, fsidp), &fsid, sizeof(fsid_t))) != 0)
@@ -415,7 +415,7 @@ lfs_segwait(p, v, retval)
 	u_long timeout;
 	int error, s;
 
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0) {
+	if ((error = suser(p, 0)) != 0) {
 		return (error);
 	}
 #ifdef WHEN_QUADS_WORK
diff --git a/sys/ufs/ufs/ufs_extattr.c b/sys/ufs/ufs/ufs_extattr.c
index f48e6b5d179..c16615ef9ad 100644
--- a/sys/ufs/ufs/ufs_extattr.c
+++ b/sys/ufs/ufs/ufs_extattr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ufs_extattr.c,v 1.3 2002/05/01 13:36:18 drahn Exp $ */
+/*	$OpenBSD: ufs_extattr.c,v 1.4 2003/08/15 20:32:21 tedu Exp $ */
 /*-
  * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
  * Copyright (c) 2002 Networks Associates Technology, Inc.
@@ -845,7 +845,7 @@ ufs_extattr_credcheck(struct vnode *vp, struct ufs_extattr_list_entry *uele,
 	switch (uele->uele_attrnamespace) {
 	case EXTATTR_NAMESPACE_SYSTEM:
 		/* Potentially should be: return (EPERM); */
-		return (suser(cred, &p->p_acflag));
+		return (suser_ucred(cred));
 	case EXTATTR_NAMESPACE_USER:
 		return (VOP_ACCESS(vp, access, cred, p));
 	default:
diff --git a/sys/ufs/ufs/ufs_quota.c b/sys/ufs/ufs/ufs_quota.c
index 3630b2067dd..16c48e41361 100644
--- a/sys/ufs/ufs/ufs_quota.c
+++ b/sys/ufs/ufs/ufs_quota.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ufs_quota.c,v 1.14 2003/06/02 23:28:23 millert Exp $	*/
+/*	$OpenBSD: ufs_quota.c,v 1.15 2003/08/15 20:32:21 tedu Exp $	*/
 /*	$NetBSD: ufs_quota.c,v 1.8 1996/02/09 22:36:09 christos Exp $	*/
 
 /*
@@ -1060,7 +1060,7 @@ ufs_quotactl(mp, cmds, uid, arg, p)
 			break;
 		/* fall through */
 	default:
-		if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+		if ((error = suser(p, 0)) != 0)
 			return (error);
 	}
 
diff --git a/sys/ufs/ufs/ufs_vnops.c b/sys/ufs/ufs/ufs_vnops.c
index b8f19b895ac..47c70e76a7e 100644
--- a/sys/ufs/ufs/ufs_vnops.c
+++ b/sys/ufs/ufs/ufs_vnops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ufs_vnops.c,v 1.48 2003/08/11 21:53:10 tedu Exp $	*/
+/*	$OpenBSD: ufs_vnops.c,v 1.49 2003/08/15 20:32:21 tedu Exp $	*/
 /*	$NetBSD: ufs_vnops.c,v 1.18 1996/05/11 18:28:04 mycroft Exp $	*/
 
 /*
@@ -363,7 +363,7 @@ ufs_setattr(v)
 		if (vp->v_mount->mnt_flag & MNT_RDONLY)
 			return (EROFS);
 		if (cred->cr_uid != ip->i_ffs_uid &&
-		    (error = suser(cred, &p->p_acflag)))
+		    (error = suser_ucred(cred)))
 			return (error);
 		if (cred->cr_uid == 0) {
 			if ((ip->i_ffs_flags & (SF_IMMUTABLE | SF_APPEND)) &&
@@ -417,7 +417,7 @@ ufs_setattr(v)
 		if (vp->v_mount->mnt_flag & MNT_RDONLY)
 			return (EROFS);
 		if (cred->cr_uid != ip->i_ffs_uid &&
-		    (error = suser(cred, &p->p_acflag)) &&
+		    (error = suser_ucred(cred)) &&
 		    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 || 
 		    (error = VOP_ACCESS(vp, VWRITE, cred, p))))
 			return (error);
@@ -454,7 +454,7 @@ ufs_chmod(vp, mode, cred, p)
 	int error;
 
 	if (cred->cr_uid != ip->i_ffs_uid &&
-	    (error = suser(cred, &p->p_acflag)))
+	    (error = suser_ucred(cred)))
 		return (error);
 	if (cred->cr_uid) {
 		if (vp->v_type != VDIR && (mode & S_ISTXT))
@@ -500,7 +500,7 @@ ufs_chown(vp, uid, gid, cred, p)
 	 */
 	if ((cred->cr_uid != ip->i_ffs_uid || uid != ip->i_ffs_uid ||
 	    (gid != ip->i_ffs_gid && !groupmember((gid_t)gid, cred))) &&
-	    (error = suser(cred, &p->p_acflag)))
+	    (error = suser_ucred(cred)))
 		return (error);
 	ogid = ip->i_ffs_gid;
 	ouid = ip->i_ffs_uid;
@@ -2109,7 +2109,7 @@ ufs_makeinode(mode, dvp, vpp, cnp)
 		softdep_change_linkcnt(ip);
 	if ((ip->i_ffs_mode & ISGID) &&
 		!groupmember(ip->i_ffs_gid, cnp->cn_cred) &&
-	    suser(cnp->cn_cred, NULL))
+	    suser_ucred(cnp->cn_cred))
 		ip->i_ffs_mode &= ~ISGID;
 
 	if (cnp->cn_flags & ISWHITEOUT)
diff --git a/sys/uvm/uvm_mmap.c b/sys/uvm/uvm_mmap.c
index 7c682e25141..0e3e1fa2a42 100644
--- a/sys/uvm/uvm_mmap.c
+++ b/sys/uvm/uvm_mmap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_mmap.c,v 1.50 2003/08/06 21:08:07 millert Exp $	*/
+/*	$OpenBSD: uvm_mmap.c,v 1.51 2003/08/15 20:32:21 tedu Exp $	*/
 /*	$NetBSD: uvm_mmap.c,v 1.49 2001/02/18 21:19:08 chs Exp $	*/
 
 /*
@@ -1031,7 +1031,7 @@ sys_mlock(p, v, retval)
 			p->p_rlimit[RLIMIT_MEMLOCK].rlim_cur)
 		return (EAGAIN);
 #else
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 #endif
 
@@ -1078,7 +1078,7 @@ sys_munlock(p, v, retval)
 		return (EINVAL);
 
 #ifndef pmap_wired_count
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 #endif
 
@@ -1109,7 +1109,7 @@ sys_mlockall(p, v, retval)
 		return (EINVAL);
 
 #ifndef pmap_wired_count
-	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
+	if ((error = suser(p, 0)) != 0)
 		return (error);
 #endif
 
diff --git a/sys/uvm/uvm_swap.c b/sys/uvm/uvm_swap.c
index a85cd7ca0dc..afeb56a9c3f 100644
--- a/sys/uvm/uvm_swap.c
+++ b/sys/uvm/uvm_swap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_swap.c,v 1.55 2002/10/12 01:09:45 krw Exp $	*/
+/*	$OpenBSD: uvm_swap.c,v 1.56 2003/08/15 20:32:21 tedu Exp $	*/
 /*	$NetBSD: uvm_swap.c,v 1.40 2000/11/17 11:39:39 mrg Exp $	*/
 
 /*
@@ -715,7 +715,7 @@ sys_swapctl(p, v, retval)
 	/*
 	 * all other requests require superuser privs.   verify.
 	 */
-	if ((error = suser(p->p_ucred, &p->p_acflag)))
+	if ((error = suser(p, 0)))
 		goto out;
 
 	/*
diff --git a/sys/xfs/xfs_common-bsd.c b/sys/xfs/xfs_common-bsd.c
index eac6fca8dd1..454df61fbd7 100644
--- a/sys/xfs/xfs_common-bsd.c
+++ b/sys/xfs/xfs_common-bsd.c
@@ -74,7 +74,11 @@ int
 xfs_suser(d_thread_t *p)
 {
 #if defined(HAVE_TWO_ARGUMENT_SUSER)
+#ifdef __OpenBSD__
+    return suser (p, SUSER_NOACCT);
+#else
     return suser (xfs_proc_to_cred(p), NULL);
+#endif
 #else
     return suser (p);
 #endif