diff -ruN linux-2.2.25/Makefile linux-2.2.25-cher1/Makefile
--- linux-2.2.25/Makefile	Mon Mar 17 17:15:54 2003
+++ linux-2.2.25-cher1/Makefile	Sat Nov  8 11:06:29 2003
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 2
 SUBLEVEL = 25
-EXTRAVERSION = 
+EXTRAVERSION = -cher1
 
 ARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ -e s/arm.*/arm/ -e s/sa110/arm/)
 
@@ -244,7 +244,7 @@
 		$(DRIVERS) \
 		$(LIBS) \
 		--end-group \
-		-o vmlinux
+		-o vmlinux -Map vmlinux.map --cref
 	$(NM) vmlinux | grep -v '\(compiled\)\|\(\.o$$\)\|\( [aU] \)\|\(\.\.ng$$\)\|\(LASH[RL]DI\)' | sort > System.map
 
 symlinks:
@@ -322,6 +322,11 @@
 
 fs lib mm ipc kernel drivers net: dummy
 	$(MAKE) $(subst $@, _dir_$@, $@)
+
+inst:
+	cp arch/${ARCH}/boot/bzImage /boot/vmlinuz-${KERNELRELEASE}
+	cp System.map /boot/System.map-${KERNELRELEASE}
+	lilo
 
 MODFLAGS += -DMODULE
 ifdef CONFIG_MODULES
diff -ruN linux-2.2.25/arch/i386/kernel/ldt.c linux-2.2.25-cher1/arch/i386/kernel/ldt.c
--- linux-2.2.25/arch/i386/kernel/ldt.c	Sun Mar 25 20:31:45 2001
+++ linux-2.2.25-cher1/arch/i386/kernel/ldt.c	Sat Nov  8 11:06:10 2003
@@ -135,6 +135,9 @@
 {
 	int ret = -ENOSYS;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	switch (func) {
 	case 0:
@@ -150,3 +153,9 @@
 	unlock_kernel();
 	return ret;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/arch/i386/kernel/process.c linux-2.2.25-cher1/arch/i386/kernel/process.c
--- linux-2.2.25/arch/i386/kernel/process.c	Fri Nov  2 19:39:05 2001
+++ linux-2.2.25-cher1/arch/i386/kernel/process.c	Sat Nov  8 11:06:10 2003
@@ -802,16 +802,33 @@
 	int error;
 	char * filename;
 
+	if (!capable(CAP_SYS_OPERATIONS) && !capable(CAP_SYS_ONE_EXEC))
+		return -EPERM;
+
 	lock_kernel();
 	filename = getname((char *) regs.ebx);
 	error = PTR_ERR(filename);
 	if (IS_ERR(filename))
 		goto out;
 	error = do_execve(filename, (char **) regs.ecx, (char **) regs.edx, &regs);
-	if (error == 0)
+	if (error == 0) {
+		if (!capable(CAP_SYS_OPERATIONS)) {
+			// drop CAP_SYS_ONE_TIME_EXEC
+			cap_lower(current->cap_effective, CAP_SYS_ONE_EXEC);
+			cap_lower(current->cap_permitted, CAP_SYS_ONE_EXEC);
+			cap_lower(current->cap_inheritable, CAP_SYS_ONE_EXEC);
+		}
 		current->ptrace &= ~PT_DTRACE;
+	}
 	putname(filename);
 out:
 	unlock_kernel();
 	return error;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+*/
+
diff -ruN linux-2.2.25/arch/i386/kernel/ptrace.c linux-2.2.25-cher1/arch/i386/kernel/ptrace.c
--- linux-2.2.25/arch/i386/kernel/ptrace.c	Fri Nov  2 19:39:05 2001
+++ linux-2.2.25-cher1/arch/i386/kernel/ptrace.c	Sat Nov  8 11:06:10 2003
@@ -390,6 +390,9 @@
 	unsigned long flags;
 	int i, ret;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	ret = -EPERM;
 	if (request == PTRACE_TRACEME) {
@@ -727,3 +730,9 @@
 		current->exit_code = 0;
 	}
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/arch/i386/kernel/signal.c linux-2.2.25-cher1/arch/i386/kernel/signal.c
--- linux-2.2.25/arch/i386/kernel/signal.c	Sat Nov  8 11:05:40 2003
+++ linux-2.2.25-cher1/arch/i386/kernel/signal.c	Sat Nov  8 11:06:10 2003
@@ -61,6 +61,9 @@
 	struct pt_regs * regs = (struct pt_regs *) &unewset;
 	sigset_t saveset, newset;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		return -EINVAL;
@@ -120,6 +123,10 @@
 sys_sigaltstack(const stack_t *uss, stack_t *uoss)
 {
 	struct pt_regs *regs = (struct pt_regs *) &uss;
+
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	return do_sigaltstack(uss, uoss, regs->esp);
 }
 
@@ -736,3 +743,9 @@
 	}
 	return 0;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/arch/i386/kernel/sys_i386.c linux-2.2.25-cher1/arch/i386/kernel/sys_i386.c
--- linux-2.2.25/arch/i386/kernel/sys_i386.c	Sun Mar 25 20:31:45 2001
+++ linux-2.2.25-cher1/arch/i386/kernel/sys_i386.c	Sat Nov  8 11:06:11 2003
@@ -31,6 +31,9 @@
 	int fd[2];
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	error = do_pipe(fd);
 	unlock_kernel();
@@ -68,7 +71,11 @@
 
 	down(&current->mm->mmap_sem);
 	lock_kernel();
+
 	if (!(a.flags & MAP_ANONYMOUS)) {
+                error = -EPERM;
+                if (!capable(CAP_SYS_OPERATIONS)) goto out;
+
 		error = -EBADF;
 		file = fget(a.fd);
 		if (!file)
@@ -113,6 +120,9 @@
 {
 	int version, ret;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	version = call >> 16; /* hack for backward compatibility */
 	call &= 0xffff;
 
@@ -248,3 +258,8 @@
 	return -ERESTARTNOHAND;
 }
 
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/arch/i386/kernel/vm86.c linux-2.2.25-cher1/arch/i386/kernel/vm86.c
--- linux-2.2.25/arch/i386/kernel/vm86.c	Tue May 21 03:32:34 2002
+++ linux-2.2.25-cher1/arch/i386/kernel/vm86.c	Sat Nov  8 11:06:11 2003
@@ -136,6 +136,9 @@
 	struct task_struct *tsk;
 	int tmp, ret = -EPERM;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	tsk = current;
 	if (tsk->tss.saved_esp0)
@@ -167,6 +170,9 @@
 	struct task_struct *tsk;
 	int tmp, ret;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	tsk = current;
 	switch (subfunction) {
@@ -793,3 +799,8 @@
 	return -EINVAL;
 }
 
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/fs/buffer.c linux-2.2.25-cher1/fs/buffer.c
--- linux-2.2.25/fs/buffer.c	Sun Mar 25 20:37:38 2001
+++ linux-2.2.25-cher1/fs/buffer.c	Sat Nov  8 11:06:11 2003
@@ -304,6 +304,9 @@
 
 asmlinkage int sys_sync(void)
 {
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	fsync_dev(0);
 	unlock_kernel();
@@ -2010,3 +2013,9 @@
 		sync_old_buffers();
 	}
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/fs/dcache.c linux-2.2.25-cher1/fs/dcache.c
--- linux-2.2.25/fs/dcache.c	Mon Sep 16 20:26:29 2002
+++ linux-2.2.25-cher1/fs/dcache.c	Sat Nov  8 11:06:11 2003
@@ -840,6 +840,9 @@
 	int error;
 	struct dentry *pwd = current->fs->pwd; 
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	error = -ENOENT;
 	/* Has the current directory been unlinked? */
 	if (pwd->d_parent == pwd || !list_empty(&pwd->d_hash)) {
@@ -982,3 +985,9 @@
 		i--;
 	} while (i);
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/fs/exec.c linux-2.2.25-cher1/fs/exec.c
--- linux-2.2.25/fs/exec.c	Sat Nov  8 11:05:41 2003
+++ linux-2.2.25-cher1/fs/exec.c	Sat Nov  8 11:06:11 2003
@@ -179,6 +179,9 @@
 	struct linux_binfmt * fmt;
 	char * tmp = getname(library);
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	retval = PTR_ERR(tmp);
 	if (IS_ERR(tmp))
@@ -716,10 +719,17 @@
 			id_change = 1;
 	}
 
+	/* Copy capabilities from the current process */
+	cap_t(bprm->cap_inheritable) = cap_t(current->cap_inheritable);
+	cap_t(bprm->cap_permitted) = cap_t(current->cap_permitted);
+	cap_t(bprm->cap_effective) = cap_t(current->cap_effective);
+	
 	/* We don't have VFS support for capabilities yet */
-	cap_clear(bprm->cap_inheritable);
-	cap_clear(bprm->cap_permitted);
-	cap_clear(bprm->cap_effective);
+	/* cap_exec_clear does not clear CAP_SYS_OPERATIONS and CAP_SYS_ONE_EXEC capabilities */
+	/* so they are inherited from the current process */
+	cap_exec_clear(bprm->cap_inheritable);
+	cap_exec_clear(bprm->cap_permitted);
+	cap_exec_clear(bprm->cap_effective);
 
 	/*  To support inheritance of root-permissions and suid-root
          *  executables under compatibility mode, we raise all three
@@ -1096,3 +1106,9 @@
 	unlock_kernel();
 	return 0;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/fs/fcntl.c linux-2.2.25-cher1/fs/fcntl.c
--- linux-2.2.25/fs/fcntl.c	Sun Mar 25 20:30:58 2001
+++ linux-2.2.25-cher1/fs/fcntl.c	Sat Nov  8 11:06:11 2003
@@ -171,18 +171,41 @@
 			err = filp->f_flags;
 			break;
 		case F_SETFL:
-			err = setfl(fd, filp, arg);
+                        err = -EPERM;
+                        if (capable(CAP_SYS_OPERATIONS)) {
+                                err = setfl(fd, filp, arg);
+                        }
 			break;
 		case F_GETLK:
+                        if (!capable(CAP_SYS_OPERATIONS)) {
+                                err = -EPERM;
+                                break;
+                        }
+
 			err = fcntl_getlk(fd, (struct flock *) arg);
 			break;
 		case F_SETLK:
+                        if (!capable(CAP_SYS_OPERATIONS)) {
+                                err = -EPERM;
+                                break;
+                        }
+
 			err = fcntl_setlk(fd, cmd, (struct flock *) arg);
 			break;
 		case F_SETLKW:
+                        if (!capable(CAP_SYS_OPERATIONS)) {
+                                err = -EPERM;
+                                break;
+                        }
+
 			err = fcntl_setlk(fd, cmd, (struct flock *) arg);
 			break;
 		case F_GETOWN:
+                        if (!capable(CAP_SYS_OPERATIONS)) {
+                                err = -EPERM;
+                                break;
+                        }
+
 			/*
 			 * XXX If f_owner is a process group, the
 			 * negative return value will get converted
@@ -193,6 +216,11 @@
 			err = filp->f_owner.pid;
 			break;
 		case F_SETOWN:
+                        if (!capable(CAP_SYS_OPERATIONS)) {
+                                err = -EPERM;
+                                break;
+                        }                        
+
 			filp->f_owner.pid = arg;
 			filp->f_owner.uid = current->uid;
 			filp->f_owner.euid = current->euid;
@@ -200,9 +228,17 @@
 				err = sock_fcntl (filp, F_SETOWN, arg);
 			break;
 		case F_GETSIG:
+                        if (!capable(CAP_SYS_OPERATIONS)) {
+                                err = -EPERM;
+                                break;
+                        }
+
 			err = filp->f_owner.signum;
 			break;
 		case F_SETSIG:
+                        err = -EPERM;
+                        if (!capable(CAP_SYS_OPERATIONS)) break;
+
 			if (arg <= 0 || arg > _NSIG) {
 				err = -EINVAL;
 				break;
@@ -212,6 +248,9 @@
 			break;
 		default:
 			/* sockets need a few special fcntls. */
+                        err = -EPERM;
+                        if (!capable(CAP_SYS_OPERATIONS)) break;
+
 			err = -EINVAL;
 			if (S_ISSOCK (filp->f_dentry->d_inode->i_mode))
 				err = sock_fcntl (filp, cmd, arg);
@@ -281,3 +320,9 @@
 		fa = fa->fa_next;
 	}
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/fs/filesystems.c linux-2.2.25-cher1/fs/filesystems.c
--- linux-2.2.25/fs/filesystems.c	Sun Mar 25 20:30:58 2001
+++ linux-2.2.25-cher1/fs/filesystems.c	Sat Nov  8 11:06:11 2003
@@ -172,6 +172,9 @@
 asmlinkage sys_nfsservctl(int cmd, void *argp, void *resp)
 {
 	int ret = -ENOSYS;
+
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
 	
 	if (cmd >= NFSCTL_LOCKD) {
 #if defined(CONFIG_LOCKD) || defined(CONFIG_LOCKD_MODULE)
@@ -208,3 +211,9 @@
 	return ret;
 }
 #endif /* CONFIG_NFSD */
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/fs/ioctl.c linux-2.2.25-cher1/fs/ioctl.c
--- linux-2.2.25/fs/ioctl.c	Sun Mar 25 20:30:58 2001
+++ linux-2.2.25-cher1/fs/ioctl.c	Sat Nov  8 11:06:11 2003
@@ -47,6 +47,9 @@
 	unsigned int flag;
 	int on, error = -EBADF;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	filp = fget(fd);
 	if (!filp)
@@ -111,3 +114,9 @@
 	unlock_kernel();
 	return error;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/fs/locks.c linux-2.2.25-cher1/fs/locks.c
--- linux-2.2.25/fs/locks.c	Fri Nov  2 19:39:08 2001
+++ linux-2.2.25-cher1/fs/locks.c	Sat Nov  8 11:06:11 2003
@@ -298,6 +298,9 @@
 	struct file *filp;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	error = -EBADF;
 	filp = fget(fd);
@@ -1284,4 +1287,8 @@
 }
 
 
-
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/fs/namei.c linux-2.2.25-cher1/fs/namei.c
--- linux-2.2.25/fs/namei.c	Sat Nov  8 11:05:41 2003
+++ linux-2.2.25-cher1/fs/namei.c	Sat Nov  8 11:06:11 2003
@@ -910,6 +910,9 @@
 	int error;
 	char * tmp;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	error = -EPERM;
 	if (S_ISDIR(mode) || (!S_ISFIFO(mode) && !capable(CAP_SYS_ADMIN)))
@@ -992,6 +995,9 @@
 	int error;
 	char * tmp;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	tmp = getname(pathname);
 	error = PTR_ERR(tmp);
@@ -1087,6 +1093,9 @@
 	int error;
 	char * tmp;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	tmp = getname(pathname);
 	error = PTR_ERR(tmp);
@@ -1140,6 +1149,9 @@
 	int error;
 	char * tmp;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	tmp = getname(pathname);
 	error = PTR_ERR(tmp);
@@ -1191,6 +1203,9 @@
 	int error;
 	char * from;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	from = getname(oldname);
 	error = PTR_ERR(from);
@@ -1305,6 +1320,9 @@
 	int error;
 	char * from;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	from = getname(oldname);
 	error = PTR_ERR(from);
@@ -1476,6 +1494,9 @@
 	int error;
 	char * from;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	from = getname(oldname);
 	error = PTR_ERR(from);
@@ -1492,3 +1513,9 @@
 	unlock_kernel();
 	return error;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/fs/open.c linux-2.2.25-cher1/fs/open.c
--- linux-2.2.25/fs/open.c	Fri Nov  2 19:39:08 2001
+++ linux-2.2.25-cher1/fs/open.c	Sat Nov  8 11:06:11 2003
@@ -17,6 +17,9 @@
 	struct dentry * dentry;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	dentry = namei(path);
 	error = PTR_ERR(dentry);
@@ -42,6 +45,9 @@
 	struct super_block * sb;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	error = -EBADF;
 	file = fget(fd);
@@ -93,6 +99,9 @@
 	struct inode * inode;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	dentry = namei(path);
 
@@ -143,6 +152,9 @@
 	struct file * file;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	error = -EBADF;
 	file = fget(fd);
@@ -191,6 +203,9 @@
 	struct inode * inode;
 	struct iattr newattrs;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	dentry = namei(filename);
 
@@ -239,6 +254,9 @@
 	struct inode * inode;
 	struct iattr newattrs;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	dentry = namei(filename);
 
@@ -285,6 +303,9 @@
 	kernel_cap_t old_cap;
 	int res = -EINVAL;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	if (mode != (mode & S_IRWXO))	/* where's F_OK, X_OK, W_OK, R_OK? */
 		goto out;
@@ -331,6 +352,9 @@
 	struct inode *inode;
 	struct dentry *dentry, *tmp;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	
 	dentry = namei(filename);
@@ -367,6 +391,9 @@
 	struct inode *inode;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 
 	error = -EBADF;
@@ -445,6 +472,9 @@
 	int err = -EBADF;
 	struct iattr newattrs;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	file = fget(fd);
 	if (!file)
@@ -482,6 +512,9 @@
 	int error;
 	struct iattr newattrs;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	dentry = namei(filename);
 
@@ -576,6 +609,9 @@
 	struct dentry * dentry;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	dentry = namei(filename);
 
@@ -593,6 +629,9 @@
 	struct dentry * dentry;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	dentry = lnamei(filename);
 
@@ -612,6 +651,9 @@
 	struct file * file;
 	int error = -EBADF;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	file = fget(fd);
 	if (!file)
@@ -759,6 +801,9 @@
 	char * tmp;
 	int fd, error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	tmp = getname(filename);
 	fd = PTR_ERR(tmp);
 	if (!IS_ERR(tmp)) {
@@ -877,3 +922,9 @@
 	unlock_kernel();
 	return ret;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/fs/read_write.c linux-2.2.25-cher1/fs/read_write.c
--- linux-2.2.25/fs/read_write.c	Sun Mar 25 20:37:38 2001
+++ linux-2.2.25-cher1/fs/read_write.c	Sat Nov  8 11:06:11 2003
@@ -53,6 +53,9 @@
 	struct dentry * dentry;
 	struct inode * inode;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	retval = -EBADF;
 	file = fget(fd);
@@ -83,6 +86,9 @@
 	struct inode * inode;
 	loff_t offset;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	retval = -EBADF;
 	file = fget(fd);
@@ -336,6 +342,9 @@
 	struct file * file;
 	ssize_t (*read)(struct file *, char *, size_t, loff_t *);
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 
 	ret = -EBADF;
@@ -368,6 +377,9 @@
 	struct file * file;
 	ssize_t (*write)(struct file *, const char *, size_t, loff_t *);
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 
 	ret = -EBADF;
@@ -396,3 +408,9 @@
 	unlock_kernel();
 	return ret;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/fs/readdir.c linux-2.2.25-cher1/fs/readdir.c
--- linux-2.2.25/fs/readdir.c	Sun Mar 25 20:30:59 2001
+++ linux-2.2.25-cher1/fs/readdir.c	Sat Nov  8 11:06:11 2003
@@ -61,6 +61,9 @@
 	struct inode * inode;
 	struct readdir_callback buf;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	error = -EBADF;
 	file = fget(fd);
@@ -151,6 +154,9 @@
 	struct getdents_callback buf;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	error = -EBADF;
 	file = fget(fd);
@@ -196,3 +202,9 @@
 	unlock_kernel();
 	return error;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/fs/stat.c linux-2.2.25-cher1/fs/stat.c
--- linux-2.2.25/fs/stat.c	Sun Mar 25 20:30:58 2001
+++ linux-2.2.25-cher1/fs/stat.c	Sat Nov  8 11:06:11 2003
@@ -124,6 +124,9 @@
 	struct dentry * dentry;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	dentry = namei(filename);
 
@@ -145,6 +148,9 @@
 	struct dentry * dentry;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	dentry = namei(filename);
 
@@ -171,6 +177,9 @@
 	struct dentry * dentry;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	dentry = lnamei(filename);
 
@@ -193,6 +202,9 @@
 	struct dentry * dentry;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	dentry = lnamei(filename);
 
@@ -219,6 +231,9 @@
 	struct file * f;
 	int err = -EBADF;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	f = fget(fd);
 	if (f) {
@@ -240,6 +255,9 @@
 	struct file * f;
 	int err = -EBADF;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	f = fget(fd);
 	if (f) {
@@ -259,6 +277,9 @@
 	struct dentry * dentry;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	if (bufsiz <= 0)
 		return -EINVAL;
 
@@ -280,3 +301,9 @@
 	unlock_kernel();
 	return error;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/fs/super.c linux-2.2.25-cher1/fs/super.c
--- linux-2.2.25/fs/super.c	Fri Nov  2 19:39:08 2001
+++ linux-2.2.25-cher1/fs/super.c	Sat Nov  8 11:06:11 2003
@@ -262,6 +262,9 @@
 {
 	int retval = -EINVAL;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	switch (option) {
 		case 1:
@@ -488,6 +491,9 @@
         mm_segment_t old_fs;
 	int err = -EINVAL;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
         s = get_super(to_kdev_t(dev));
         if (s == NULL)
@@ -1315,3 +1321,9 @@
 }
 
 #endif
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/include/linux/capability.h linux-2.2.25-cher1/include/linux/capability.h
--- linux-2.2.25/include/linux/capability.h	Sun Mar 25 20:31:05 2001
+++ linux-2.2.25-cher1/include/linux/capability.h	Sat Nov  8 11:06:11 2003
@@ -266,6 +266,14 @@
 
 #define CAP_SYS_TTY_CONFIG   26
 
+/* Allow open/close and most of the file operations */
+
+#define CAP_SYS_OPERATIONS   27
+
+/* Allow one time exec (effective when CAP_SYS_OPERATIONS dropped) */
+
+#define CAP_SYS_ONE_EXEC     28
+
 #ifdef __KERNEL__
 /* 
  * Bounding set
@@ -326,10 +334,11 @@
      return dest;
 }
 
-#define cap_isclear(c)       (!cap_t(c))
+#define cap_isclear(c)       (!(cap_t(c) & (CAP_TO_MASK(CAP_SYS_OPERATIONS) | CAP_TO_MASK(CAP_SYS_ONE_EXEC))))
 #define cap_issubset(a,set)  (!(cap_t(a) & ~cap_t(set)))
 
-#define cap_clear(c)         do { cap_t(c) =  0; } while(0)
+#define cap_clear(c)         do { cap_t(c) = (CAP_TO_MASK(CAP_SYS_OPERATIONS) | CAP_TO_MASK(CAP_SYS_ONE_EXEC)); } while(0)
+#define cap_exec_clear(c)    do { cap_t(c) &= (CAP_TO_MASK(CAP_SYS_OPERATIONS) | CAP_TO_MASK(CAP_SYS_ONE_EXEC)); } while(0)
 #define cap_set_full(c)      do { cap_t(c) = ~0; } while(0)
 #define cap_mask(c,mask)     do { cap_t(c) &= cap_t(mask); } while(0)
 
diff -ruN linux-2.2.25/kernel/capability.c linux-2.2.25-cher1/kernel/capability.c
--- linux-2.2.25/kernel/capability.c	Sun Mar 25 20:31:02 2001
+++ linux-2.2.25-cher1/kernel/capability.c	Sat Nov  8 11:06:11 2003
@@ -133,6 +133,9 @@
      struct task_struct *target;
      int error, pid;
 
+     if (!capable(CAP_SYS_OPERATIONS))
+             return -EPERM;
+
      if (get_user(version, &header->version))
 	     return -EFAULT; 
 
@@ -214,3 +217,9 @@
      spin_unlock(&task_capability_lock);
      return error;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/kernel/exec_domain.c linux-2.2.25-cher1/kernel/exec_domain.c
--- linux-2.2.25/kernel/exec_domain.c	Sun Mar 25 20:31:02 2001
+++ linux-2.2.25-cher1/kernel/exec_domain.c	Sat Nov  8 11:06:11 2003
@@ -104,6 +104,9 @@
 	unsigned long old_personality;
 	int ret;
 
+        if (!capable(CAP_SYS_OPERATIONS) && personality != PER_LINUX)
+                return -EPERM;
+
 	lock_kernel();
 	ret = current->personality;
 	if (personality == 0xffffffff)
@@ -126,3 +129,9 @@
 	unlock_kernel();
 	return ret;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/kernel/exit.c linux-2.2.25-cher1/kernel/exit.c
--- linux-2.2.25/kernel/exit.c	Sat Nov  8 11:05:41 2003
+++ linux-2.2.25-cher1/kernel/exit.c	Sat Nov  8 11:06:11 2003
@@ -443,6 +443,9 @@
 	struct wait_queue wait = { current, NULL };
 	struct task_struct *p;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	if (options & ~(WNOHANG|WUNTRACED|__WCLONE|__WALL))
 		return -EINVAL;
 
@@ -549,3 +552,9 @@
 }
 
 #endif
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/kernel/fork.c linux-2.2.25-cher1/kernel/fork.c
--- linux-2.2.25/kernel/fork.c	Sat Nov  8 11:05:41 2003
+++ linux-2.2.25-cher1/kernel/fork.c	Sat Nov  8 11:06:11 2003
@@ -578,6 +578,8 @@
 			return -EPERM;
 	}
 	
+        if (!capable(CAP_SYS_OPERATIONS)) return -EPERM;
+
 	current->vfork_sem = &sem;
 
 	p = alloc_task_struct();
diff -ruN linux-2.2.25/kernel/info.c linux-2.2.25-cher1/kernel/info.c
--- linux-2.2.25/kernel/info.c	Sun Mar 25 20:31:02 2001
+++ linux-2.2.25-cher1/kernel/info.c	Sat Nov  8 11:06:11 2003
@@ -17,6 +17,9 @@
 {
 	struct sysinfo val;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	memset((char *)&val, 0, sizeof(struct sysinfo));
 
 	cli();
@@ -36,3 +39,9 @@
 		return -EFAULT;
 	return 0;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/kernel/module.c linux-2.2.25-cher1/kernel/module.c
--- linux-2.2.25/kernel/module.c	Mon Sep 16 20:26:33 2002
+++ linux-2.2.25-cher1/kernel/module.c	Sat Nov  8 11:06:11 2003
@@ -666,6 +666,9 @@
 	struct module *mod;
 	int err;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	if (name_user == NULL)
 		mod = &kernel_module;
@@ -731,6 +734,9 @@
 	int i;
 	struct kernel_sym ksym;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	for (mod = module_list, i = 0; mod; mod = mod->next) {
 		/* include the count for the module name! */
@@ -1055,3 +1061,9 @@
 }
 
 #endif	/* CONFIG_MODULES */
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/kernel/printk.c linux-2.2.25-cher1/kernel/printk.c
--- linux-2.2.25/kernel/printk.c	Sat Nov  8 11:05:41 2003
+++ linux-2.2.25-cher1/kernel/printk.c	Sat Nov  8 11:06:11 2003
@@ -245,6 +245,9 @@
 
 asmlinkage int sys_syslog(int type, char * buf, int len)
 {
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 #ifdef CONFIG_SECURE_PROC
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
@@ -491,3 +494,9 @@
 		tty->driver.write(tty, 0, msg, strlen(msg));
 	return;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/kernel/sched.c linux-2.2.25-cher1/kernel/sched.c
--- linux-2.2.25/kernel/sched.c	Sun Mar 25 20:37:40 2001
+++ linux-2.2.25-cher1/kernel/sched.c	Sat Nov  8 11:06:11 2003
@@ -1621,6 +1621,9 @@
 	struct task_struct * me = current;
 	struct task_struct * parent;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	parent = me->p_opptr;
 	for (;;) {
 		pid = parent->pid;
@@ -2118,3 +2121,9 @@
 	init_bh(TQUEUE_BH, tqueue_bh);
 	init_bh(IMMEDIATE_BH, immediate_bh);
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/kernel/signal.c linux-2.2.25-cher1/kernel/signal.c
--- linux-2.2.25/kernel/signal.c	Fri Nov  2 19:39:16 2001
+++ linux-2.2.25-cher1/kernel/signal.c	Sat Nov  8 11:06:11 2003
@@ -518,6 +518,9 @@
 int
 kill_something_info(int sig, struct siginfo *info, int pid)
 {
+        if (!capable(CAP_SYS_OPERATIONS) && pid != info->si_pid)
+                return -EPERM;
+
 	if (!pid) {
 		return kill_pg_info(sig, info, current->pgrp);
 	} else if (pid == -1) {
@@ -652,6 +655,9 @@
 	int error = -EINVAL;
 	sigset_t old_set, new_set;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		goto out;
@@ -709,6 +715,9 @@
 	int error = -EINVAL;
 	sigset_t pending;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		goto out;
@@ -734,6 +743,9 @@
 	siginfo_t info;
 	long timeout = 0;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		return -EINVAL;
@@ -815,6 +827,9 @@
 {
 	siginfo_t info;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	if (copy_from_user(&info, uinfo, sizeof(siginfo_t)))
 		return -EFAULT;
 
@@ -1030,6 +1045,9 @@
 	struct k_sigaction new_sa, old_sa;
 	int ret = -EINVAL;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		goto out;
@@ -1097,3 +1115,9 @@
 	return ret ? ret : (unsigned long)old_sa.sa.sa_handler;
 }
 #endif /* !defined(__alpha__) && !defined(__mips__) */
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/kernel/sys.c linux-2.2.25-cher1/kernel/sys.c
--- linux-2.2.25/kernel/sys.c	Mon Sep 16 20:26:33 2002
+++ linux-2.2.25-cher1/kernel/sys.c	Sat Nov  8 11:06:11 2003
@@ -667,6 +667,9 @@
 	struct task_struct * p;
 	int err = -EINVAL;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	if (!pid)
 		pid = current->pid;
 	if (!pgid)
@@ -764,6 +767,9 @@
 	struct task_struct * p;
 	int err = -EPERM;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	read_lock(&tasklist_lock);
 	for_each_task(p) {
 		if (p->pgrp == current->pid)
@@ -950,6 +956,9 @@
 {
 	struct rlimit new_rlim, *old_rlim;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	if (resource >= RLIM_NLIMITS)
 		return -EINVAL;
 	if(copy_from_user(&new_rlim, rlim, sizeof(*rlim)))
@@ -1030,6 +1039,9 @@
 
 asmlinkage int sys_umask(int mask)
 {
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	mask = xchg(&current->fs->umask, mask & S_IRWXUGO);
 	return mask;
 }
@@ -1040,6 +1052,9 @@
 	int error = 0;
 	int sig;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	switch (option) {
 		case PR_SET_PDEATHSIG:
 			sig = arg2;
@@ -1068,3 +1083,8 @@
 	return error;
 }
 
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/kernel/sysctl.c linux-2.2.25-cher1/kernel/sysctl.c
--- linux-2.2.25/kernel/sysctl.c	Mon Sep 16 20:26:33 2002
+++ linux-2.2.25-cher1/kernel/sysctl.c	Sat Nov  8 11:06:11 2003
@@ -363,6 +363,9 @@
 	struct __sysctl_args tmp;
 	int error;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	if(copy_from_user(&tmp, args, sizeof(tmp)))
 		return -EFAULT;
 		
@@ -1225,3 +1228,9 @@
 }
 
 #endif /* CONFIG_SYSCTL */
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/kernel/time.c linux-2.2.25-cher1/kernel/time.c
--- linux-2.2.25/kernel/time.c	Sun Mar 25 20:31:02 2001
+++ linux-2.2.25-cher1/kernel/time.c	Sat Nov  8 11:06:11 2003
@@ -421,3 +421,9 @@
 	ret = do_adjtimex(&txc);
 	return copy_to_user(txc_p, &txc, sizeof(struct timex)) ? -EFAULT : ret;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/mm/filemap.c linux-2.2.25-cher1/mm/filemap.c
--- linux-2.2.25/mm/filemap.c	Sun Mar 25 20:37:40 2001
+++ linux-2.2.25-cher1/mm/filemap.c	Sat Nov  8 11:06:11 2003
@@ -881,6 +881,9 @@
 	struct file * in_file, * out_file;
 	struct inode * in_inode, * out_inode;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 
 	/*
@@ -1400,6 +1403,9 @@
 	struct vm_area_struct * vma;
 	int unmapped_error, error = -EINVAL;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	down(&current->mm->mmap_sem);
 	lock_kernel();
 	if (start & ~PAGE_MASK)
@@ -1745,3 +1751,9 @@
 	memset(page_hash_table, 0,
 	       (PAGE_HASH_MASK + 1UL) * sizeof(struct page *));
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/mm/mprotect.c linux-2.2.25-cher1/mm/mprotect.c
--- linux-2.2.25/mm/mprotect.c	Sun Mar 25 20:31:02 2001
+++ linux-2.2.25-cher1/mm/mprotect.c	Sat Nov  8 11:06:11 2003
@@ -200,6 +200,9 @@
 	struct vm_area_struct * vma, * next;
 	int error = -EINVAL;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	if (start & ~PAGE_MASK)
 		return -EINVAL;
 	len = (len + ~PAGE_MASK) & PAGE_MASK;
@@ -253,3 +256,9 @@
 	up(&current->mm->mmap_sem);
 	return error;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/mm/mremap.c linux-2.2.25-cher1/mm/mremap.c
--- linux-2.2.25/mm/mremap.c	Sun Mar 25 20:31:03 2001
+++ linux-2.2.25-cher1/mm/mremap.c	Sat Nov  8 11:06:11 2003
@@ -165,6 +165,9 @@
 	struct vm_area_struct *vma;
 	unsigned long ret = -EINVAL;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	down(&current->mm->mmap_sem);
 	lock_kernel();
 	if (addr & ~PAGE_MASK)
@@ -245,3 +248,9 @@
 	up(&current->mm->mmap_sem);
 	return ret;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruN linux-2.2.25/net/socket.c linux-2.2.25-cher1/net/socket.c
--- linux-2.2.25/net/socket.c	Mon Sep 16 20:26:34 2002
+++ linux-2.2.25-cher1/net/socket.c	Sat Nov  8 11:06:11 2003
@@ -643,6 +643,9 @@
 	int retval;
 	struct socket *sock;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 
 	retval = sock_create(family, type, protocol, &sock);
@@ -672,6 +675,9 @@
 	struct socket *sock1, *sock2;
 	int fd1, fd2, err;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 
 	/*
@@ -743,6 +749,9 @@
 	char address[MAX_SOCK_ADDR];
 	int err;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	if((sock = sockfd_lookup(fd,&err))!=NULL)
 	{
@@ -766,6 +775,9 @@
 	struct socket *sock;
 	int err;
 	
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	if((sock = sockfd_lookup(fd, &err))!=NULL)
 	{
@@ -796,6 +808,9 @@
 	int err, len;
 	char address[MAX_SOCK_ADDR];
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	sock = sockfd_lookup(fd, &err);
 	if (!sock)
@@ -865,6 +880,9 @@
 	char address[MAX_SOCK_ADDR];
 	int err;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	sock = sockfd_lookup(fd, &err);
 	if (!sock)
@@ -892,6 +910,9 @@
 	char address[MAX_SOCK_ADDR];
 	int len, err;
 	
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	sock = sockfd_lookup(fd, &err);
 	if (!sock)
@@ -919,6 +940,9 @@
 	char address[MAX_SOCK_ADDR];
 	int len, err;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	if ((sock = sockfd_lookup(fd, &err))!=NULL)
 	{
@@ -946,6 +970,9 @@
 	struct msghdr msg;
 	struct iovec iov;
 	
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	sock = sockfd_lookup(fd, &err);
 	if (!sock)
@@ -1001,6 +1028,9 @@
 	char address[MAX_SOCK_ADDR];
 	int err,err2;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	sock = sockfd_lookup(fd, &err);
 	if (!sock)
@@ -1049,6 +1079,9 @@
 	int err;
 	struct socket *sock;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	if(optlen < 0)	
 		return -EINVAL;
 		
@@ -1076,6 +1109,9 @@
 	int len;
 	struct socket *sock;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	if ((sock = sockfd_lookup(fd, &err))!=NULL)
 	{
@@ -1106,6 +1142,9 @@
 	int err;
 	struct socket *sock;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	if ((sock = sockfd_lookup(fd, &err))!=NULL)
 	{
@@ -1130,6 +1169,9 @@
 	struct msghdr msg_sys;
 	int err, ctl_len, iov_size, total_len;
 	
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 
 	err = -EFAULT;
@@ -1224,6 +1266,9 @@
 	struct sockaddr *uaddr;
 	int *uaddr_len;
 	
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	lock_kernel();
 	err=-EFAULT;
 	if (copy_from_user(&msg_sys,msg,sizeof(struct msghdr)))
@@ -1331,6 +1376,9 @@
 	unsigned long a0,a1;
 	int err;
 
+        if (!capable(CAP_SYS_OPERATIONS))
+                return -EPERM;
+
 	if(call<1||call>SYS_RECVMSG)
 		return -EINVAL;
 
@@ -1530,3 +1578,9 @@
 		len = length;
 	return len;
 }
+
+/**
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
