diff -ruNp linux-2.6.26.1/arch/x86/ia32/ia32_aout.c linux-2.6.26.1-cher1/arch/x86/ia32/ia32_aout.c
--- linux-2.6.26.1/arch/x86/ia32/ia32_aout.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/arch/x86/ia32/ia32_aout.c	2008-08-05 13:44:37.000000000 +0400
@@ -298,8 +298,12 @@ static int load_aout_binary(struct linux
 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
 	if (rlim >= RLIM_INFINITY)
 		rlim = ~0;
-	if (ex.a_data + ex.a_bss > rlim)
+	if (ex.a_data + ex.a_bss > rlim) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
 	/* Flush all traces of the currently running executable */
 	retval = flush_old_exec(bprm);
@@ -545,3 +549,9 @@ static void __exit exit_aout_binfmt(void
 module_init(init_aout_binfmt);
 module_exit(exit_aout_binfmt);
 MODULE_LICENSE("GPL");
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/arch/x86/ia32/ia32_signal.c linux-2.6.26.1-cher1/arch/x86/ia32/ia32_signal.c
--- linux-2.6.26.1/arch/x86/ia32/ia32_signal.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/arch/x86/ia32/ia32_signal.c	2008-08-05 13:44:37.000000000 +0400
@@ -119,6 +119,9 @@ int copy_siginfo_from_user32(siginfo_t *
 
 asmlinkage long sys32_sigsuspend(int history0, int history1, old_sigset_t mask)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	mask &= _BLOCKABLE;
 	spin_lock_irq(&current->sighand->siglock);
 	current->saved_sigmask = current->blocked;
diff -ruNp linux-2.6.26.1/arch/x86/ia32/ipc32.c linux-2.6.26.1-cher1/arch/x86/ia32/ipc32.c
--- linux-2.6.26.1/arch/x86/ia32/ipc32.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/arch/x86/ia32/ipc32.c	2008-08-05 13:44:37.000000000 +0400
@@ -14,6 +14,11 @@ asmlinkage long sys32_ipc(u32 call, int 
 {
 	int version;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	version = call >> 16; /* hack for backward compatibility */
 	call &= 0xffff;
 
@@ -51,3 +56,9 @@ asmlinkage long sys32_ipc(u32 call, int 
 	}
 	return -ENOSYS;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/arch/x86/ia32/sys_ia32.c linux-2.6.26.1-cher1/arch/x86/ia32/sys_ia32.c
--- linux-2.6.26.1/arch/x86/ia32/sys_ia32.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/arch/x86/ia32/sys_ia32.c	2008-08-05 13:44:37.000000000 +0400
@@ -134,8 +134,12 @@ asmlinkage long sys32_stat64(char __user
 			     struct stat64 __user *statbuf)
 {
 	struct kstat stat;
-	int ret = vfs_stat(filename, &stat);
+	int ret;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 
+        ret = vfs_stat(filename, &stat);
 	if (!ret)
 		ret = cp_stat64(statbuf, &stat);
 	return ret;
@@ -145,7 +149,12 @@ asmlinkage long sys32_lstat64(char __use
 			      struct stat64 __user *statbuf)
 {
 	struct kstat stat;
-	int ret = vfs_lstat(filename, &stat);
+	int ret;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        ret = vfs_lstat(filename, &stat);
 	if (!ret)
 		ret = cp_stat64(statbuf, &stat);
 	return ret;
@@ -154,7 +163,12 @@ asmlinkage long sys32_lstat64(char __use
 asmlinkage long sys32_fstat64(unsigned int fd, struct stat64 __user *statbuf)
 {
 	struct kstat stat;
-	int ret = vfs_fstat(fd, &stat);
+	int ret;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        ret = vfs_fstat(fd, &stat);
 	if (!ret)
 		ret = cp_stat64(statbuf, &stat);
 	return ret;
@@ -166,6 +180,9 @@ asmlinkage long sys32_fstatat(unsigned i
 	struct kstat stat;
 	int error = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
 		goto out;
 
@@ -238,6 +255,9 @@ asmlinkage long sys32_pipe(int __user *f
 	int retval;
 	int fds[2];
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	retval = do_pipe(fds);
 	if (retval)
 		goto out;
@@ -371,6 +391,9 @@ asmlinkage long sys32_rt_sigprocmask(int
 	int ret;
 	mm_segment_t old_fs = get_fs();
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (set) {
 		if (copy_from_user(&s32, set, sizeof(compat_sigset_t)))
 			return -EFAULT;
@@ -457,6 +480,11 @@ asmlinkage long sys32_settimeofday(struc
 	struct timespec kts;
 	struct timezone ktz;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (tv) {
 		if (get_tv32(&ktv, tv))
 			return -EFAULT;
@@ -525,6 +553,9 @@ asmlinkage long sys32_rt_sigpending(comp
 	int ret;
 	mm_segment_t old_fs = get_fs();
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	set_fs(KERNEL_DS);
 	ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize);
 	set_fs(old_fs);
@@ -548,6 +579,9 @@ asmlinkage long sys32_rt_sigqueueinfo(in
 	int ret;
 	mm_segment_t old_fs = get_fs();
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (copy_siginfo_from_user32(&info, uinfo))
 		return -EFAULT;
 	set_fs(KERNEL_DS);
@@ -586,6 +620,11 @@ asmlinkage long sys32_sysctl(struct sysc
 	int __user *namep;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_from_user(&a32, args32, sizeof(a32)))
 		return -EFAULT;
 
@@ -657,6 +696,9 @@ asmlinkage long sys32_sendfile(int out_f
 	int ret;
 	off_t of;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (offset && get_user(of, offset))
 		return -EFAULT;
 
@@ -752,6 +794,9 @@ long sys32_ustat(unsigned dev, struct us
 	mm_segment_t seg;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	seg = get_fs();
 	set_fs(KERNEL_DS);
 	ret = sys_ustat(dev, (struct ustat __user *)&u);
@@ -774,11 +819,20 @@ asmlinkage long sys32_execve(char __user
 	long error;
 	char *filename;
 
+        if ((current->sbox_flags & SBOX_NO_EXEC)) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	filename = getname(name);
 	error = PTR_ERR(filename);
 	if (IS_ERR(filename))
 		return error;
 	error = compat_do_execve(filename, argv, envp, regs);
+        if (error == 0) {
+                if ((current->sbox_flags & SBOX_NO_SYSCALLS))
+                        current->sbox_flags |= SBOX_NO_EXEC;
+        }
 	putname(filename);
 	return error;
 }
@@ -822,6 +876,11 @@ long sys32_vm86_warning(void)
 	struct task_struct *me = current;
 	static char lastcomm[sizeof(me->comm)];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (strncmp(lastcomm, me->comm, sizeof(lastcomm))) {
 		compat_printk(KERN_INFO
 			      "%s: vm86 mode not supported on 64 bit kernel\n",
@@ -865,3 +924,9 @@ asmlinkage long sys32_fallocate(int fd, 
 	return sys_fallocate(fd, mode, ((u64)offset_hi << 32) | offset_lo,
 			     ((u64)len_hi << 32) | len_lo);
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/arch/x86/kernel/ioport.c linux-2.6.26.1-cher1/arch/x86/kernel/ioport.c
--- linux-2.6.26.1/arch/x86/kernel/ioport.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/arch/x86/kernel/ioport.c	2008-08-05 13:44:37.000000000 +0400
@@ -38,6 +38,11 @@ asmlinkage long sys_ioperm(unsigned long
 	struct tss_struct * tss;
 	unsigned int i, max_long, bytes, bytes_updated;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
 		return -EINVAL;
 	if (turn_on && !capable(CAP_SYS_RAWIO))
@@ -137,6 +142,11 @@ asmlinkage long sys_iopl(unsigned long r
 	struct thread_struct *t = &current->thread;
 	int rc;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	rc = do_iopl(level, regs);
 	if (rc < 0)
 		goto out;
@@ -149,6 +159,17 @@ out:
 #else
 asmlinkage long sys_iopl(unsigned int level, struct pt_regs *regs)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_iopl(level, regs);
 }
 #endif
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/arch/x86/kernel/ldt.c linux-2.6.26.1-cher1/arch/x86/kernel/ldt.c
--- linux-2.6.26.1/arch/x86/kernel/ldt.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/arch/x86/kernel/ldt.c	2008-08-05 13:44:37.000000000 +0400
@@ -243,6 +243,11 @@ asmlinkage int sys_modify_ldt(int func, 
 {
 	int ret = -ENOSYS;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	switch (func) {
 	case 0:
 		ret = read_ldt(ptr, bytecount);
@@ -259,3 +264,9 @@ asmlinkage int sys_modify_ldt(int func, 
 	}
 	return ret;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/arch/x86/kernel/process_32.c linux-2.6.26.1-cher1/arch/x86/kernel/process_32.c
--- linux-2.6.26.1/arch/x86/kernel/process_32.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/arch/x86/kernel/process_32.c	2008-08-05 13:44:37.000000000 +0400
@@ -711,6 +711,11 @@ asmlinkage int sys_execve(struct pt_regs
 	int error;
 	char * filename;
 
+        if ((current->sbox_flags & SBOX_NO_EXEC)) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	filename = getname((char __user *) regs.bx);
 	error = PTR_ERR(filename);
 	if (IS_ERR(filename))
@@ -720,6 +725,8 @@ asmlinkage int sys_execve(struct pt_regs
 			(char __user * __user *) regs.dx,
 			&regs);
 	if (error == 0) {
+                if ((current->sbox_flags & SBOX_NO_SYSCALLS))
+                        current->sbox_flags |= SBOX_NO_EXEC;
 		/* Make sure we don't return using sysenter.. */
 		set_thread_flag(TIF_IRET);
 	}
@@ -767,3 +774,9 @@ unsigned long arch_randomize_brk(struct 
 	unsigned long range_end = mm->brk + 0x02000000;
 	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/arch/x86/kernel/process_64.c linux-2.6.26.1-cher1/arch/x86/kernel/process_64.c
--- linux-2.6.26.1/arch/x86/kernel/process_64.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/arch/x86/kernel/process_64.c	2008-08-05 13:44:37.000000000 +0400
@@ -678,11 +678,20 @@ long sys_execve(char __user *name, char 
 	long error;
 	char * filename;
 
+        if ((current->sbox_flags & SBOX_NO_EXEC)) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	filename = getname(name);
 	error = PTR_ERR(filename);
 	if (IS_ERR(filename))
 		return error;
 	error = do_execve(filename, argv, envp, regs);
+        if (error == 0) {
+                if ((current->sbox_flags & SBOX_NO_SYSCALLS))
+                        current->sbox_flags |= SBOX_NO_EXEC;
+        }
 	putname(filename);
 	return error;
 }
@@ -868,3 +877,9 @@ unsigned long arch_randomize_brk(struct 
 	unsigned long range_end = mm->brk + 0x02000000;
 	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/arch/x86/kernel/signal_32.c linux-2.6.26.1-cher1/arch/x86/kernel/signal_32.c
--- linux-2.6.26.1/arch/x86/kernel/signal_32.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/arch/x86/kernel/signal_32.c	2008-08-05 13:44:37.000000000 +0400
@@ -48,6 +48,9 @@
 asmlinkage int
 sys_sigsuspend(int history0, int history1, old_sigset_t mask)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	mask &= _BLOCKABLE;
 	spin_lock_irq(&current->sighand->siglock);
 	current->saved_sigmask = current->blocked;
@@ -672,3 +675,9 @@ do_notify_resume(struct pt_regs *regs, v
 
 	clear_thread_flag(TIF_IRET);
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/arch/x86/kernel/sys_i386_32.c linux-2.6.26.1-cher1/arch/x86/kernel/sys_i386_32.c
--- linux-2.6.26.1/arch/x86/kernel/sys_i386_32.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/arch/x86/kernel/sys_i386_32.c	2008-08-05 13:44:37.000000000 +0400
@@ -108,6 +108,11 @@ asmlinkage int sys_ipc (uint call, int f
 {
 	int version, ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	version = call >> 16; /* hack for backward compatibility */
 	call &= 0xffff;
 
@@ -244,3 +249,9 @@ int kernel_execve(const char *filename, 
 	: "0" (__NR_execve),"ri" (filename),"c" (argv), "d" (envp) : "memory");
 	return __res;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/arch/x86/kernel/vm86_32.c linux-2.6.26.1-cher1/arch/x86/kernel/vm86_32.c
--- linux-2.6.26.1/arch/x86/kernel/vm86_32.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/arch/x86/kernel/vm86_32.c	2008-08-05 13:44:37.000000000 +0400
@@ -207,6 +207,11 @@ asmlinkage int sys_vm86old(struct pt_reg
 	struct task_struct *tsk;
 	int tmp, ret = -EPERM;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	tsk = current;
 	if (tsk->thread.saved_sp0)
 		goto out;
@@ -237,6 +242,11 @@ asmlinkage int sys_vm86(struct pt_regs r
 	int tmp, ret;
 	struct vm86plus_struct __user *v86;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	tsk = current;
 	switch (regs.bx) {
 	case VM86_REQUEST_IRQ:
@@ -835,3 +845,8 @@ static int do_vm86_irq_handling(int subf
 	return -EINVAL;
 }
 
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/arch/x86/SYSCALLS.i386 linux-2.6.26.1-cher1/arch/x86/SYSCALLS.i386
--- linux-2.6.26.1/arch/x86/SYSCALLS.i386	1970-01-01 03:00:00.000000000 +0300
+++ linux-2.6.26.1-cher1/arch/x86/SYSCALLS.i386	2008-08-05 13:44:37.000000000 +0400
@@ -0,0 +1,335 @@
+sys_exit                        kernel/exit.c                           OK
+sys_fork                        arch/x86/kernel/process_32.c            CAP
+sys_read                        fs/read_write.c                         OK
+sys_write                       fs/read_write.c                         OK
+sys_open                        fs/open.c                               CAP
+sys_close                       fs/open.c                               OK
+sys_waitpid                     kernel/exit.c                           CAP
+sys_creat                       fs/open.c                               CAP
+sys_link                        fs/namei.c                              CAP
+sys_unlink                      fs/namei.c                              CAP
+sys_execve                      arch/x86/kernel/process_32.c            CAP
+sys_chdir                       fs/open.c                               CAP
+sys_time	                                                        OK
+sys_mknod                       fs/namei.c                              CAP
+sys_chmod                       fs/open.c                               CAP
+sys_lchown16                    kernel/uid16.c                          CAP
+sys_ni_syscall                                                          ---
+sys_stat                        fs/stat.c                               CAP
+sys_lseek                       fs/read_write.c                         CAP
+sys_getpid                                                              OK
+sys_mount                       fs/namespace.c                          CAP
+sys_oldumount                   fs/namespace.c                          CAP
+sys_setuid16                    kernel/uid16.c                          CAP
+sys_getuid16                                                            OK
+sys_stime                       kernel/time.c                           CAP
+sys_ptrace                      kernel/ptrace.c                         CAP
+sys_alarm                       kernel/timer.c                          OK
+sys_fstat                       fs/stat.c                               CAP
+sys_pause                       kernel/signal.c                         CAP
+sys_utime                       fs/utimes.c                             CAP
+sys_ni_syscall                                                          ---
+sys_ni_syscall                                                          ---
+sys_access                      fs/open.c                               CAP
+sys_nice                        kernel/sched.c                          CAP
+sys_ni_syscall                                                          ---
+sys_sync                        fs/sync.c                               CAP+
+sys_kill                        kernel/signal.c                         CAP+
+sys_rename                      fs/namei.c                              CAP+
+sys_mkdir                       fs/namei.c                              CAP+
+sys_rmdir                       fs/namei.c                              CAP+
+sys_dup                         fs/fcntl.c                              CAP?
+sys_pipe                        fs/pipe.c                               CAP
+sys_times                                                               OK
+sys_ni_syscall                                                          ---
+sys_brk                                                                 OK
+sys_setgid16                    kernel/uid16.c                          CAP+
+sys_getgid16                                                            OK
+sys_signal                                                              OK
+sys_geteuid16                                                           OK
+sys_getegid16                                                           OK
+sys_acct                        kernel/acct.c                           CAP+
+sys_umount                      fs/namespace.c                          CAP
+sys_ni_syscall                                                          ---
+sys_ioctl                       fs/ioctl.c                              CAP
+sys_fcntl                       fs/fcntl.c                              CAP
+sys_ni_syscall                                                          ---
+sys_setpgid                     kernel/sys.c                            CAP
+sys_ni_syscall                                                          ---
+sys_olduname                                                            OK
+sys_umask                       kernel/sys.c                            CAP
+sys_chroot                      fs/open.c                               CAP+
+sys_ustat                       fs/super.c                              CAP
+sys_dup2                        fs/fcntl.c                              CAP?
+sys_getppid                                                             OK
+sys_getpgrp                                                             OK
+sys_setsid                      kernel/sys.c                            CAP+
+sys_sigaction                                                           OK
+sys_sgetmask                                                            OK
+sys_ssetmask                    kernel/signal.c                         CAP
+sys_setreuid16                  kernel/uid16.c                          CAP+
+sys_setregid16                  kernel/uid16.c                          CAP+
+sys_sigsuspend                  arch/x86/kernel/signal_32.c             CAP
+sys_sigpending                  kernel/signal.c                         CAP
+sys_sethostname                 kernel/sys.c                            CAP+
+sys_setrlimit                   kernel/sys.c                            CAP
+sys_old_getrlimit                                                       OK
+sys_getrusage                                                           OK
+sys_gettimeofday                                                        OK
+sys_settimeofday                kernel/time.c                           CAP+
+sys_getgroups16                                                         OK
+sys_setgroups16                 kernel/uid16.c                          CAP+
+old_select                                                              OK
+sys_symlink                     fs/namei.c                              CAP+
+sys_lstat                       fs/stat.c                               CAP
+sys_readlink                    fs/stat.c                               CAP
+sys_uselib                      fs/exec.c                               CAP
+sys_swapon                      mm/swapfile.c                           CAP+
+sys_reboot                      kernel/sys.c                            CAP+
+old_readdir                     fs/readdir.c                            CAP
+old_mmap                                                                OK
+sys_munmap                                                              OK
+sys_truncate                    fs/open.c                               CAP
+sys_ftruncate                   fs/open.c                               CAP
+sys_fchmod                      fs/open.c                               CAP+
+sys_fchown16                    kernel/uid16.c                          CAP+
+sys_getpriority                 kernel/sys.c                            CAP
+sys_setpriority                 kernel/sys.c                            CAP
+sys_ni_syscall                                                          ---
+sys_statfs                      fs/open.c                               CAP
+sys_fstatfs                     fs/open.c                               CAP
+sys_ioperm                      arch/x86/kernel/ioport.c                CAP+
+sys_socketcall                  net/socket.c                            CAP+
+sys_syslog                      kernel/printk.c                         CAP
+sys_setitimer                                                           OK
+sys_getitimer                                                           OK
+sys_newstat                     fs/stat.c                               CAP
+sys_newlstat                    fs/stat.c                               CAP
+sys_newfstat                    fs/stat.c                               CAP
+sys_uname                                                               OK
+sys_iopl                        arch/x86/kernel/ioport.c                CAP+
+sys_vhangup                     fs/open.c                               CAP+
+sys_ni_syscall                                                          ---
+sys_vm86old                     arch/x86/kernel/vm86_32.c               CAP+
+sys_wait4                       kernel/exit.c                           CAP
+sys_swapoff                     mm/swapfile.c                           CAP+
+sys_sysinfo                     kernel/timer.c                          CAP
+sys_ipc                         arch/x86/kernel/sys_i386_32.c           CAP+
+sys_fsync                       fs/sync.c                               CAP+
+sys_sigreturn                                                           OK
+sys_clone                       arch/x86/kernel/process_32.c            CAP+
+sys_setdomainname               kernel/sys.c                            CAP+
+sys_newuname                                                            OK
+sys_modify_ldt                  arch/x86/kernel/ldt.c                   CAP+
+sys_adjtimex                    kernel/time.c                           CAP+
+sys_mprotect                    mm/mprotect.c                           CAP+
+sys_sigprocmask                 kernel/signal.c                         CAP
+sys_ni_syscall                                                          ---
+sys_init_module                 kernel/module.c                         CAP+
+sys_delete_module               kernel/module.c                         CAP+
+sys_ni_syscall                                                          ---
+sys_quotactl                    fs/quota.c                              CAP+
+sys_getpgid                     kernel/sys.c                            CAP
+sys_fchdir                      fs/open.c                               CAP
+sys_bdflush                     fs/buffer.c                             CAP+
+sys_sysfs                       fs/filesystems.c                        CAP+
+sys_personality                 kernel/exec_domain.c                    CAP+
+sys_ni_syscall                                                          ---
+sys_setfsuid16                  kernel/uid16.c                          CAP+
+sys_setfsgid16                  kernel/uid16.c                          CAP+
+sys_llseek                      fs/read_write.c                         CAP
+sys_getdents                    fs/readdir.c                            CAP
+sys_select                                                              OK
+sys_flock                       fs/locks.c                              CAP+
+sys_msync                                                               OK
+sys_readv                                                               OK
+sys_writev                                                              OK
+sys_getsid                      kernel/sys.c                            CAP
+sys_fdatasync                   fs/sync.c                               CAP+
+sys_sysctl                      kernel/sysctl.c                         CAP+
+sys_mlock                       mm/mlock.c                              CAP+
+sys_munlock                     mm/mlock.c                              CAP+
+sys_mlockall                    mm/mlock.c                              CAP+
+sys_munlockall                  mm/mlock.c                              CAP+
+sys_sched_setparam              kernel/sched.c                          CAP
+sys_sched_getparam              kernel/sched.c                          CAP
+sys_sched_setscheduler          kernel/sched.c                          CAP
+sys_sched_getscheduler          kernel/sched.c                          CAP
+sys_sched_yield                                                         OK
+sys_sched_get_priority_max                                              OK
+sys_sched_get_priority_min                                              OK
+sys_sched_rr_get_interval                                               OK
+sys_nanosleep                                                           OK?
+sys_mremap                                                              OK?
+sys_setresuid16                 kernel/uid16.c                          CAP+
+sys_getresuid16                                                         OK
+sys_vm86                        arch/x86/kernel/vm86_32.c               CAP+
+sys_ni_syscall                                                          ---
+sys_poll                                                                OK
+sys_nfsservctl                  fs/nfsctl.c                             CAP+
+sys_setresgid16                 kernel/uid16.c                          CAP+
+sys_getresgid16                                                         OK
+sys_prctl                       kernel/sys.c                            CAP
+sys_rt_sigreturn                                                        OK
+sys_rt_sigaction                                                        OK
+sys_rt_sigprocmask              kernel/signal.c                         CAP
+sys_rt_sigpending               kernel/signal.c                         CAP
+sys_rt_sigtimedwait             kernel/signal.c                         CAP
+sys_rt_sigqueueinfo             kernel/signal.c                         CAP
+sys_rt_sigsuspend               kernel/signal.c                         CAP
+sys_pread64                     fs/read_write.c                         CAP
+sys_pwrite64                    fs/read_write.c                         CAP
+sys_chown16                     kernel/uid16.c                          CAP+
+sys_getcwd                      fs/dcache.c                             CAP
+sys_capget                      kernel/capability.c                     CAP
+sys_capset                      kernel/capability.c                     CAP+
+sys_sigaltstack                                                         OK
+sys_sendfile                    fs/read_write.c                         CAP
+sys_ni_syscall                                                          ---
+sys_ni_syscall                                                          ---
+sys_vfork                       arch/x86/kernel/process_32.c            CAP+
+sys_getrlimit                                                           OK
+sys_mmap2                                                               OK
+sys_truncate64                  fs/open.c                               CAP
+sys_ftruncate64                 fs/open.c                               CAP
+sys_stat64                      fs/stat.c                               CAP
+sys_lstat64                     fs/stat.c                               CAP
+sys_fstat64                     fs/stat.c                               CAP
+sys_lchown                      fs/open.c                               CAP
+sys_getuid                                                              OK
+sys_getgid                                                              OK
+sys_geteuid                                                             OK
+sys_getegid                                                             OK
+sys_setreuid                    kernel/sys.c                            CAP+
+sys_setregid                    kernel/sys.c                            CAP+
+sys_getgroups                                                           OK
+sys_setgroups                   kernel/sys.c                            CAP+
+sys_fchown                      fs/open.c                               CAP+
+sys_setresuid                   kernel/sys.c                            CAP+
+sys_getresuid                                                           OK
+sys_setresgid                   kernel/sys.c                            CAP+
+sys_getresgid                                                           OK
+sys_chown                       fs/open.c                               CAP+
+sys_setuid                      kernel/sys.c                            CAP
+sys_setgid                      kernel/sys.c                            CAP+
+sys_setfsuid                    kernel/sys.c                            CAP+
+sys_setfsgid                    kernel/sys.c                            CAP+
+sys_pivot_root                  fs/namespace.c                          CAP+
+sys_mincore                     mm/mincore.c                            CAP
+sys_madvise                     mm/madvise.c                            CAP
+sys_getdents64                  fs/readdir.c                            CAP
+sys_fcntl64                     fs/fcntl.c                              CAP
+sys_ni_syscall                                                          ---
+sys_ni_syscall                                                          ---
+sys_gettid                                                              OK
+sys_readahead                   mm/filemap.c                            CAP
+sys_setxattr                    fs/xattr.c                              CAP+
+sys_lsetxattr                   fs/xattr.c                              CAP+
+sys_fsetxattr                   fs/xattr.c                              CAP+
+sys_getxattr                    fs/xattr.c                              CAP+
+sys_lgetxattr                   fs/xattr.c                              CAP+
+sys_fgetxattr                   fs/xattr.c                              CAP+
+sys_listxattr                   fs/xattr.c                              CAP+
+sys_llistxattr                  fs/xattr.c                              CAP+
+sys_flistxattr                  fs/xattr.c                              CAP+
+sys_removexattr                 fs/xattr.c                              CAP+
+sys_lremovexattr                fs/xattr.c                              CAP+
+sys_fremovexattr                fs/xattr.c                              CAP+
+sys_tkill                       kernel/signal.c                         CAP
+sys_sendfile64                  fs/read_write.c                         CAP
+sys_futex                                                               OK
+sys_sched_setaffinity           kernel/sched.c                          CAP
+sys_sched_getaffinity           kernel/sched.c                          CAP
+sys_set_thread_area                                                     OK
+sys_get_thread_area                                                     OK
+sys_io_setup                    fs/aio.c                                CAP
+sys_io_destroy                  fs/aio.c                                CAP
+sys_io_getevents                fs/aio.c                                CAP
+sys_io_submit                   fs/aio.c                                CAP
+sys_io_cancel                   fs/aio.c                                CAP
+sys_fadvise64                   mm/fadvise.c                            CAP
+sys_ni_syscall                                                          ---
+sys_exit_group                                                          OK?
+sys_lookup_dcookie              fs/dcookies.c                           CAP
+sys_epoll_create                fs/eventpoll.c                          CAP
+sys_epoll_ctl                   fs/eventpoll.c                          CAP
+sys_epoll_wait                  fs/eventpoll.c                          CAP
+sys_remap_file_pages                                                    OK?
+sys_set_tid_address                                                     OK
+sys_timer_create                kernel/posix-timers.c                   CAP
+sys_timer_settime               kernel/posix-timers.c                   CAP
+sys_timer_gettime               kernel/posix-timers.c                   CAP
+sys_timer_getoverrun            kernel/posix-timers.c                   CAP
+sys_timer_delete                kernel/posix-timers.c                   CAP
+sys_clock_settime               kernel/posix-timers.c                   CAP
+sys_clock_gettime               kernel/posix-timers.c                   CAP
+sys_clock_getres                kernel/posix-timers.c                   CAP
+sys_clock_nanosleep             kernel/posix-timers.c                   CAP
+sys_statfs64                    fs/open.c                               CAP
+sys_fstatfs64                   fs/open.c                               CAP
+sys_tgkill                      kernel/signal.c                         CAP
+sys_utimes                      fs/utimes.c                             CAP+
+sys_fadvise64_64                mm/fadvise.c                            CAP
+sys_ni_syscall                                                          ---
+sys_mbind                       mm/mempolicy.c                          CAP
+sys_get_mempolicy               mm/mempolicy.c                          CAP
+sys_set_mempolicy               mm/mempolicy.c                          CAP
+sys_mq_open                     ipc/mqueue.c                            CAP
+sys_mq_unlink                   ipc/mqueue.c                            CAP
+sys_mq_timedsend                ipc/mqueue.c                            CAP
+sys_mq_timedreceive             ipc/mqueue.c                            CAP
+sys_mq_notify                   ipc/mqueue.c                            CAP
+sys_mq_getsetattr               ipc/mqueue.c                            CAP
+sys_kexec_load                  kernel/kexec.c                          CAP+
+sys_waitid                      kernel/exit.c                           CAP
+sys_ni_syscall                                                          ---
+sys_add_key                     security/keys/keyctl.c                  CAP+
+sys_request_key                 security/keys/keyctl.c                  CAP+
+sys_keyctl                      security/keys/keyctl.c                  CAP+
+sys_ioprio_set                  fs/ioprio.c                             CAP+
+sys_ioprio_get                  fs/ioprio.c                             CAP+
+sys_inotify_init                fs/inotify_user.c                       CAP
+sys_inotify_add_watch           fs/inotify_user.c                       CAP
+sys_inotify_rm_watch            fs/inotify_user.c                       CAP
+sys_migrate_pages               mm/mempolicy.c                          CAP
+sys_openat                      fs/open.c                               CAP
+sys_mkdirat                     fs/namei.c                              CAP+
+sys_mknodat                     fs/namei.c                              CAP
+sys_fchownat                    fs/open.c                               CAP+
+sys_futimesat                   fs/utimes.c                             CAP+
+sys_fstatat64                   fs/stat.c                               CAP
+sys_unlinkat                    fs/namei.c                              CAP
+sys_renameat                    fs/namei.c                              CAP+
+sys_linkat                      fs/namei.c                              CAP
+sys_symlinkat                   fs/namei.c                              CAP+
+sys_readlinkat                  fs/stat.c                               CAP
+sys_fchmodat                    fs/open.c                               CAP
+sys_faccessat                   fs/open.c                               CAP
+sys_pselect6                                                            OK
+sys_ppoll                                                               OK
+sys_unshare                     kernel/fork.c                           CAP
+sys_set_robust_list                                                     OK
+sys_get_robust_list                                                     OK
+sys_splice                      fs/splice.c                             CAP
+sys_sync_file_range             fs/sync.c                               CAP+
+sys_tee                         fs/splice.c                             CAP
+sys_vmsplice                    fs/splice.c                             CAP
+sys_move_pages                  mm/migrate.c                            CAP+
+sys_getcpu                                                              OK
+sys_epoll_pwait                 fs/eventpoll.c                          CAP
+sys_utimensat                   fs/utimes.c                             CAP+
+sys_signalfd                    fs/signalfd.c                           CAP
+sys_timerfd_create              fs/timerfd.c                            CAP
+sys_eventfd                     fs/eventfd.c                            CAP
+sys_fallocate                   fs/open.c                               CAP
+sys_timerfd_settime             fs/timerfd.c                            CAP
+sys_timerfd_gettime             fs/timerfd.c                            CAP
+
+=== END OF SYSCALL TABLE ===
+*) The line number corresponds to syscall number
+**) sys_fork, sys_vfork, sys_clone -> do_fork (kernel/fork.c)
+
+Syscall 0:
+sys_restart_syscall             kernel/signal.c                         OK
+
+syscall table in arch/x86/kernel/syscall_table_32.S
diff -ruNp linux-2.6.26.1/arch/x86/SYSCALLS.x86_64 linux-2.6.26.1-cher1/arch/x86/SYSCALLS.x86_64
--- linux-2.6.26.1/arch/x86/SYSCALLS.x86_64	1970-01-01 03:00:00.000000000 +0300
+++ linux-2.6.26.1-cher1/arch/x86/SYSCALLS.x86_64	2008-08-05 13:44:37.000000000 +0400
@@ -0,0 +1,295 @@
+sys_write                       fs/read_write.c                         OK
+sys_open                        fs/open.c                               CAP
+sys_close                       fs/open.c                               OK
+sys_newstat                     fs/stat.c                               CAP
+sys_newfstat                    fs/stat.c                               CAP
+sys_newlstat                    fs/stat.c                               CAP
+sys_poll                                                                OK
+sys_lseek                       fs/read_write.c                         CAP
+sys_mmap                                                                OK
+sys_mprotect                    mm/mprotect.c                           CAP+
+sys_munmap                                                              OK
+sys_brk                                                                 OK
+sys_rt_sigaction                                                        OK
+sys_rt_sigprocmask              kernel/signal.c                         CAP
+stub_rt_sigreturn                                                       OK
+sys_ioctl                       fs/ioctl.c                              CAP
+sys_pread64                     fs/read_write.c                         CAP
+sys_pwrite64                    fs/read_write.c                         CAP
+sys_readv                                                               OK
+sys_writev                                                              OK
+sys_access                      fs/open.c                               CAP
+sys_pipe                        fs/pipe.c                               CAP
+sys_select                                                              OK
+sys_sched_yield                                                         OK
+sys_mremap                                                              OK?
+sys_msync                                                               OK
+sys_mincore                     mm/mincore.c                            CAP
+sys_madvise                     mm/madvise.c                            CAP
+sys_shmget                      ipc/shm.c                               CAP+
+sys_shmat                       ipc/shm.c                               CAP+
+sys_shmctl                      ipc/shm.c                               CAP+
+sys_dup                         fs/fcntl.c                              CAP?
+sys_dup2                        fs/fcntl.c                              CAP?
+sys_pause                       kernel/signal.c                         CAP
+sys_nanosleep                                                           OK?
+sys_getitimer                                                           OK
+sys_alarm                       kernel/timer.c                          OK
+sys_setitimer                                                           OK
+sys_getpid                                                              OK
+sys_sendfile64                  fs/read_write.c                         CAP
+sys_socket                      net/socket.c                            CAP+
+sys_connect                     net/socket.c                            CAP+
+sys_accept                      net/socket.c                            CAP+
+sys_sendto                      net/socket.c                            CAP+
+sys_recvfrom                    net/socket.c                            CAP+
+sys_sendmsg                     net/socket.c                            CAP+
+sys_recvmsg                     net/socket.c                            CAP+
+sys_shutdown                    net/socket.c                            CAP+
+sys_bind                        net/socket.c                            CAP+
+sys_listen                      net/socket.c                            CAP+
+sys_getsockname                 net/socket.c                            CAP+
+sys_getpeername                 net/socket.c                            CAP+
+sys_socketpair                  net/socket.c                            CAP+
+sys_setsockopt                  net/socket.c                            CAP+
+sys_getsockopt                  net/socket.c                            CAP+
+stub_clone                      arch/x86/kernel/entry_64.S              CAP+
+stub_fork                       arch/x86/kernel/entry_64.S              CAP+
+stub_vfork                      arch/x86/kernel/entry_64.S              CAP+
+stub_execve                     arch/x86/kernel/entry_64.S              CAP
+sys_exit                        kernel/exit.c                           OK
+sys_wait4                       kernel/exit.c                           CAP
+sys_kill                        kernel/signal.c                         CAP+
+sys_uname                                                               OK
+sys_semget                      ipc/sem.c                               CAP+
+sys_semop                       ipc/sem.c                               CAP+
+sys_semctl                      ipc/sem.c                               CAP+
+sys_shmdt                       ipc/shm.c                               CAP+
+sys_msgget                      ipc/msg.c                               CAP+
+sys_msgsnd                      ipc/msg.c                               CAP+
+sys_msgrcv                      ipc/msg.c                               CAP+
+sys_msgctl                      ipc/msg.c                               CAP+
+sys_fcntl                       fs/fcntl.c                              CAP
+sys_flock                       fs/locks.c                              CAP+
+sys_fsync                       fs/sync.c                               CAP+
+sys_fdatasync                   fs/sync.c                               CAP+
+sys_truncate                    fs/open.c                               CAP
+sys_ftruncate                   fs/open.c                               CAP
+sys_getdents                    fs/readdir.c                            CAP
+sys_getcwd                      fs/dcache.c                             CAP
+sys_chdir                       fs/open.c                               CAP
+sys_fchdir                      fs/open.c                               CAP
+sys_rename                      fs/namei.c                              CAP+
+sys_mkdir                       fs/namei.c                              CAP+
+sys_rmdir                       fs/namei.c                              CAP+
+sys_creat                       fs/open.c                               CAP
+sys_link                        fs/namei.c                              CAP
+sys_unlink                      fs/namei.c                              CAP
+sys_symlink                     fs/namei.c                              CAP+
+sys_readlink                    fs/stat.c                               CAP
+sys_chmod                       fs/open.c                               CAP
+sys_fchmod                      fs/open.c                               CAP+
+sys_chown                       fs/open.c                               CAP+
+sys_fchown                      fs/open.c                               CAP+
+sys_lchown                      fs/open.c                               CAP
+sys_umask                       kernel/sys.c                            CAP
+sys_gettimeofday                                                        OK
+sys_getrlimit                                                           OK
+sys_getrusage                                                           OK
+sys_sysinfo                     kernel/timer.c                          CAP
+sys_times                                                               OK
+sys_ptrace                      kernel/ptrace.c                         CAP
+sys_getuid                                                              OK
+sys_syslog                      kernel/printk.c                         CAP
+sys_getgid                                                              OK
+sys_setuid                      kernel/sys.c                            CAP
+sys_setgid                      kernel/sys.c                            CAP+
+sys_geteuid                                                             OK
+sys_getegid                                                             OK
+sys_setpgid                     kernel/sys.c                            CAP
+sys_getppid                                                             OK
+sys_getpgrp                                                             OK
+sys_setsid                      kernel/sys.c                            CAP+
+sys_setreuid                    kernel/sys.c                            CAP+
+sys_setregid                    kernel/sys.c                            CAP+
+sys_getgroups                                                           OK
+sys_setgroups                   kernel/sys.c                            CAP+
+sys_setresuid                   kernel/sys.c                            CAP+
+sys_getresuid                                                           OK
+sys_setresgid                   kernel/sys.c                            CAP+
+sys_getresgid                                                           OK
+sys_getpgid                     kernel/sys.c                            CAP
+sys_setfsuid                    kernel/sys.c                            CAP+
+sys_setfsgid                    kernel/sys.c                            CAP+
+sys_getsid                      kernel/sys.c                            CAP
+sys_capget                      kernel/capability.c                     CAP
+sys_capset                      kernel/capability.c                     CAP+
+sys_rt_sigpending               kernel/signal.c                         CAP
+sys_rt_sigtimedwait             kernel/signal.c                         CAP
+sys_rt_sigqueueinfo             kernel/signal.c                         CAP
+stub_rt_sigsuspend              arch/x86/kernel/entry_64.S              CAP
+stub_sigaltstack                                                        OK
+sys_utime                       fs/utimes.c                             CAP
+sys_mknod                       fs/namei.c                              CAP
+sys_ni_syscall                                                          ---
+sys_personality                 kernel/exec_domain.c                    CAP
+sys_ustat                       fs/super.c                              CAP
+sys_statfs                      fs/open.c                               CAP
+sys_fstatfs                     fs/open.c                               CAP
+sys_sysfs                       fs/filesystems.c                        CAP+
+sys_getpriority                 kernel/sys.c                            CAP
+sys_setpriority                 kernel/sys.c                            CAP
+sys_sched_setparam              kernel/sched.c                          CAP
+sys_sched_getparam              kernel/sched.c                          CAP
+sys_sched_setscheduler          kernel/sched.c                          CAP
+sys_sched_getscheduler          kernel/sched.c                          CAP
+sys_sched_get_priority_max                                              OK
+sys_sched_get_priority_min                                              OK
+sys_sched_rr_get_interval                                               OK
+sys_mlock                       mm/mlock.c                              CAP+
+sys_munlock                     mm/mlock.c                              CAP+
+sys_mlockall                    mm/mlock.c                              CAP+
+sys_munlockall                  mm/mlock.c                              CAP+
+sys_vhangup                     fs/open.c                               CAP+
+sys_modify_ldt                  arch/x86/kernel/ldt.c                   CAP+
+sys_pivot_root                  fs/namespace.c                          CAP+
+sys_sysctl                      kernel/sysctl.c                         CAP+
+sys_prctl                       kernel/sys.c                            CAP
+sys_arch_prctl                                                          OK
+sys_adjtimex                    kernel/time.c                           CAP+
+sys_setrlimit                   kernel/sys.c                            CAP
+sys_chroot                      fs/open.c                               CAP+
+sys_sync                        fs/sync.c                               CAP+
+sys_acct                        kernel/acct.c                           CAP+
+sys_settimeofday                kernel/time.c                           CAP+
+sys_mount                       fs/namespace.c                          CAP
+sys_umount                      fs/namespace.c                          CAP
+sys_swapon                      mm/swapfile.c                           CAP+
+sys_swapoff                     mm/swapfile.c                           CAP+
+sys_reboot                      kernel/sys.c                            CAP+
+sys_sethostname                 kernel/sys.c                            CAP+
+sys_setdomainname               kernel/sys.c                            CAP+
+stub_iopl                       arch/x86/kernel/entry_64.S              CAP+
+sys_ioperm                      arch/x86/kernel/ioport.c                CAP+
+sys_ni_syscall                                                          ---
+sys_init_module                 kernel/module.c                         CAP+
+sys_delete_module               kernel/module.c                         CAP+
+sys_ni_syscall                                                          ---
+sys_ni_syscall                                                          ---
+sys_quotactl                    fs/quota.c                              CAP+
+sys_nfsservctl                  fs/nfsctl.c                             CAP+
+sys_ni_syscall                                                          ---
+sys_ni_syscall                                                          ---
+sys_ni_syscall                                                          ---
+sys_ni_syscall                                                          ---
+sys_ni_syscall                                                          ---
+sys_gettid                                                              OK
+sys_readahead                   mm/filemap.c                            CAP
+sys_setxattr                    fs/xattr.c                              CAP+
+sys_lsetxattr                   fs/xattr.c                              CAP+
+sys_fsetxattr                   fs/xattr.c                              CAP+
+sys_getxattr                    fs/xattr.c                              CAP+
+sys_lgetxattr                   fs/xattr.c                              CAP+
+sys_fgetxattr                   fs/xattr.c                              CAP+
+sys_listxattr                   fs/xattr.c                              CAP+
+sys_llistxattr                  fs/xattr.c                              CAP+
+sys_flistxattr                  fs/xattr.c                              CAP+
+sys_removexattr                 fs/xattr.c                              CAP+
+sys_lremovexattr                fs/xattr.c                              CAP+
+sys_fremovexattr                fs/xattr.c                              CAP+
+sys_tkill                       kernel/signal.c                         CAP
+sys_time                                                                OK
+sys_futex                                                               OK
+sys_sched_setaffinity           kernel/sched.c                          CAP
+sys_sched_getaffinity           kernel/sched.c                          CAP
+sys_ni_syscall                                                          ---
+sys_io_setup                    fs/aio.c                                CAP
+sys_io_destroy                  fs/aio.c                                CAP
+sys_io_getevents                fs/aio.c                                CAP
+sys_io_submit                   fs/aio.c                                CAP
+sys_io_cancel                   fs/aio.c                                CAP
+sys_ni_syscall                                                          ---
+sys_lookup_dcookie              fs/dcookies.c                           CAP
+sys_epoll_create                fs/eventpoll.c                          CAP
+sys_ni_syscall                                                          ---
+sys_ni_syscall                                                          ---
+sys_remap_file_pages                                                    OK?
+sys_getdents64                  fs/readdir.c                            CAP
+sys_set_tid_address                                                     OK
+sys_restart_syscall             kernel/signal.c                         OK
+sys_semtimedop                  ipc/sem.c                               CAP+
+sys_fadvise64                   mm/fadvise.c                            CAP
+sys_timer_create                kernel/posix-timers.c                   CAP
+sys_timer_settime               kernel/posix-timers.c                   CAP
+sys_timer_gettime               kernel/posix-timers.c                   CAP
+sys_timer_getoverrun            kernel/posix-timers.c                   CAP
+sys_timer_delete                kernel/posix-timers.c                   CAP
+sys_clock_settime               kernel/posix-timers.c                   CAP
+sys_clock_gettime               kernel/posix-timers.c                   CAP
+sys_clock_getres                kernel/posix-timers.c                   CAP
+sys_clock_nanosleep             kernel/posix-timers.c                   CAP
+sys_exit_group                                                          OK?
+sys_epoll_wait                  fs/eventpoll.c                          CAP
+sys_epoll_ctl                   fs/eventpoll.c                          CAP
+sys_tgkill                      kernel/signal.c                         CAP
+sys_utimes                      fs/utimes.c                             CAP+
+sys_ni_syscall                                                          ---
+sys_mbind                       mm/mempolicy.c                          CAP
+sys_set_mempolicy               mm/mempolicy.c                          CAP
+sys_get_mempolicy               mm/mempolicy.c                          CAP
+sys_mq_open                     ipc/mqueue.c                            CAP
+sys_mq_unlink                   ipc/mqueue.c                            CAP
+sys_mq_timedsend                ipc/mqueue.c                            CAP
+sys_mq_timedreceive             ipc/mqueue.c                            CAP
+sys_mq_notify                   ipc/mqueue.c                            CAP
+sys_mq_getsetattr               ipc/mqueue.c                            CAP
+sys_kexec_load                  kernel/kexec.c                          CAP+
+sys_waitid                      kernel/exit.c                           CAP
+sys_add_key                     security/keys/keyctl.c                  CAP+
+sys_request_key                 security/keys/keyctl.c                  CAP+
+sys_keyctl                      security/keys/keyctl.c                  CAP+
+sys_ioprio_set                  fs/ioprio.c                             CAP+
+sys_ioprio_get                  fs/ioprio.c                             CAP+
+sys_inotify_init                fs/inotify_user.c                       CAP
+sys_inotify_add_watch           fs/inotify_user.c                       CAP
+sys_inotify_rm_watch            fs/inotify_user.c                       CAP
+sys_migrate_pages               mm/mempolicy.c                          CAP
+sys_openat                      fs/open.c                               CAP
+sys_mkdirat                     fs/namei.c                              CAP+
+sys_mknodat                     fs/namei.c                              CAP
+sys_fchownat                    fs/open.c                               CAP+
+sys_futimesat                   fs/utimes.c                             CAP+
+sys_newfstatat                  fs/stat.c                               CAP
+sys_unlinkat                    fs/namei.c                              CAP
+sys_renameat                    fs/namei.c                              CAP+
+sys_linkat                      fs/namei.c                              CAP
+sys_symlinkat                   fs/namei.c                              CAP+
+sys_readlinkat                  fs/stat.c                               CAP
+sys_fchmodat                    fs/open.c                               CAP
+sys_faccessat                   fs/open.c                               CAP
+sys_pselect6                                                            OK
+sys_ppoll                                                               OK
+sys_unshare                     kernel/fork.c                           CAP
+sys_set_robust_list                                                     OK
+sys_get_robust_list                                                     OK
+sys_splice                      fs/splice.c                             CAP
+sys_tee                         fs/splice.c                             CAP
+sys_sync_file_range             fs/sync.c                               CAP+
+sys_vmsplice                    fs/splice.c                             CAP
+sys_move_pages                  mm/migrate.c                            CAP+
+sys_utimensat                   fs/utimes.c                             CAP+
+sys_epoll_pwait                 fs/eventpoll.c                          CAP
+sys_signalfd                    fs/signalfd.c                           CAP
+sys_timerfd_create              fs/timerfd.c                            CAP
+sys_eventfd                     fs/eventfd.c                            CAP
+sys_fallocate                   fs/open.c                               CAP
+sys_timerfd_settime             fs/timerfd.c                            CAP
+sys_timerfd_gettime             fs/timerfd.c                            CAP
+
+=== END OF SYSCALL TABLE ===
+*) The line number corresponds to syscall number
+
+Syscall 0:
+sys_read                        fs/read_write.c                         OK
+
+syscall table is in include/asm-x86/unistd_64.h
diff -ruNp linux-2.6.26.1/arch/x86/SYSCALLS.x86_64_ia32 linux-2.6.26.1-cher1/arch/x86/SYSCALLS.x86_64_ia32
--- linux-2.6.26.1/arch/x86/SYSCALLS.x86_64_ia32	1970-01-01 03:00:00.000000000 +0300
+++ linux-2.6.26.1-cher1/arch/x86/SYSCALLS.x86_64_ia32	2008-08-05 13:44:37.000000000 +0400
@@ -0,0 +1,334 @@
+sys_exit                        kernel/exit.c                           OK
+stub32_fork                     arch/x86/ia32/ia32entry.S               CAP
+sys_read                        fs/read_write.c                         OK
+sys_write                       fs/read_write.c                         OK
+compat_sys_open                 fs/compat.c                             CAP
+sys_close                       fs/open.c                               OK
+sys32_waitpid                   arch/x86/ia32/sys_ia32.c                CAP
+sys_creat                       fs/open.c                               CAP
+sys_link                        fs/namei.c                              CAP
+sys_unlink                      fs/namei.c                              CAP
+stub32_execve                   arch/x86/ia32/ia32entry.S               CAP
+sys_chdir                       fs/open.c                               CAP
+compat_sys_time                                                         OK
+sys_mknod                       fs/namei.c                              CAP
+sys_chmod                       fs/open.c                               CAP
+sys_lchown16                    kernel/uid16.c                          CAP
+quiet_ni_syscall                                                        ---
+sys_stat                        fs/stat.c                               CAP
+sys32_lseek                     arch/x86/ia32/sys_ia32.c                CAP
+sys_getpid                                                              OK
+compat_sys_mount                fs/compat.c                             CAP
+sys_oldumount                   fs/namespace.c                          CAP
+sys_setuid16                    kernel/uid16.c                          CAP
+sys_getuid16                                                            OK
+compat_sys_stime                kernel/compat.c                         CAP
+compat_sys_ptrace               kernel/ptrace.c                         CAP
+sys_alarm                       kernel/timer.c                          OK
+sys_fstat                       fs/stat.c                               CAP
+sys_pause                       kernel/signal.c                         CAP
+compat_sys_utime                fs/compat.c                             CAP
+quiet_ni_syscall                                                        ---
+quiet_ni_syscall                                                        ---
+sys_access                      fs/open.c                               CAP
+sys_nice	                kernel/sched.c                          CAP
+quiet_ni_syscall                                                        ---
+sys_sync                        fs/sync.c                               CAP+
+sys32_kill                      arch/x86/ia32/sys_ia32.c                CAP+
+sys_rename                      fs/namei.c                              CAP+
+sys_mkdir                       fs/namei.c                              CAP+
+sys_rmdir                       fs/namei.c                              CAP+
+sys_dup                         fs/fcntl.c                              CAP?
+sys32_pipe                      arch/x86/ia32/sys_ia32.c                CAP
+compat_sys_times                                                        OK
+quiet_ni_syscall                                                        ---
+sys_brk                                                                 OK
+sys_setgid16                    kernel/uid16.c                          CAP+
+sys_getgid16                                                            OK
+sys_signal                                                              OK
+sys_geteuid16                                                           OK
+sys_getegid16                                                           OK
+sys_acct                        kernel/acct.c                           CAP+
+sys_umount                      fs/namespace.c                          CAP
+quiet_ni_syscall                                                        ---
+compat_sys_ioctl                fs/compat_ioctl.c                       CAP
+compat_sys_fcntl64              fs/compat.c                             CAP
+quiet_ni_syscall                                                        ---
+sys_setpgid                     kernel/sys.c                            CAP
+quiet_ni_syscall                                                        ---
+sys32_olduname                                                          OK
+sys_umask                       kernel/sys.c                            CAP
+sys_chroot                      fs/open.c                               CAP+
+sys32_ustat                     arch/x86/ia32/sys_ia32.c                CAP
+sys_dup2                        fs/fcntl.c                              CAP?
+sys_getppid                                                             OK
+sys_getpgrp                                                             OK
+sys_setsid                      kernel/sys.c                            CAP+
+sys32_sigaction                                                         OK
+sys_sgetmask                                                            OK
+sys_ssetmask                    kernel/signal.c                         CAP
+sys_setreuid16                  kernel/uid16.c                          CAP+
+sys_setregid16                  kernel/uid16.c                          CAP+
+stub32_sigsuspend               arch/x86/ia32/ia32entry.S               CAP
+compat_sys_sigpending           kernel/compat.c                         CAP
+sys_sethostname                 kernel/sys.c                            CAP+
+compat_sys_setrlimit            kernel/compat.c                         CAP
+compat_sys_old_getrlimit                                                OK
+compat_sys_getrusage                                                    OK
+sys32_gettimeofday                                                      OK
+sys32_settimeofday              arch/x86/ia32/sys_ia32.c                CAP+
+sys_getgroups16                                                         OK
+sys_setgroups16                 kernel/uid16.c                          CAP+
+sys32_old_select                                                        OK
+sys_symlink                     fs/namei.c                              CAP+
+sys_lstat                       fs/stat.c                               CAP
+sys_readlink                    fs/stat.c                               CAP
+sys_uselib                      fs/exec.c                               CAP
+sys_swapon                      mm/swapfile.c                           CAP+
+sys_reboot                      kernel/sys.c                            CAP+
+compat_sys_old_readdir          fs/compat.c                             CAP
+sys32_mmap                                                              OK
+sys_munmap                                                              OK
+sys_truncate                    fs/open.c                               CAP
+sys_ftruncate                   fs/open.c                               CAP
+sys_fchmod                      fs/open.c                               CAP+
+sys_fchown16                    kernel/uid16.c                          CAP+
+sys_getpriority                 kernel/sys.c                            CAP
+sys_setpriority                 kernel/sys.c                            CAP
+quiet_ni_syscall                                                        ---
+compat_sys_statfs               fs/compat.c                             CAP
+compat_sys_fstatfs              fs/compat.c                             CAP
+sys_ioperm                      arch/x86/kernel/ioport.c                CAP+
+compat_sys_socketcall           net/compat.c                            CAP+
+sys_syslog                      kernel/printk.c                         CAP
+compat_sys_setitimer                                                    OK
+compat_sys_getitimer                                                    OK
+compat_sys_newstat              fs/compat.c                             CAP
+compat_sys_newlstat             fs/compat.c                             CAP
+compat_sys_newfstat             fs/compat.c                             CAP
+sys32_uname                                                             OK
+stub32_iopl                     arch/x86/ia32/ia32entry.S               CAP+
+sys_vhangup                     fs/open.c                               CAP+
+quiet_ni_syscall                                                        ---
+sys32_vm86_warning              arch/x86/ia32/sys_ia32.c                CAP
+compat_sys_wait4                kernel/compat.c                         CAP
+sys_swapoff                     mm/swapfile.c                           CAP
+compat_sys_sysinfo              kernel/compat.c                         CAP
+sys32_ipc                       arch/x86/ia32/ipc32.c                   CAP+
+sys_fsync                       fs/sync.c                               CAP+
+stub32_sigreturn                                                        OK
+stub32_clone                    arch/x86/ia32/ia32entry.S               CAP+
+sys_setdomainname               kernel/sys.c                            CAP+
+sys_uname                                                               OK
+sys_modify_ldt                  arch/x86/kernel/ldt.c                   CAP+
+compat_sys_adjtimex             kernel/compat.c                         CAP+
+sys32_mprotect                  arch/x86/ia32/sys_ia32.c                CAP+
+compat_sys_sigprocmask          kernel/compat.c                         CAP
+quiet_ni_syscall                                                        ---
+sys_init_module                 kernel/module.c                         CAP+
+sys_delete_module               kernel/module.c                         CAP+
+quiet_ni_syscall                                                        ---
+sys32_quotactl                  kernel/quota.c                          CAP+
+sys_getpgid                     kernel/sys.c                            CAP
+sys_fchdir                      fs/open.c                               CAP
+quiet_ni_syscall                                                        ---
+sys_sysfs                       fs/filesystems.c                        CAP+
+sys_personality                 kernel/exec_domain.c                    CAP
+quiet_ni_syscall                                                        ---
+sys_setfsuid16                  kernel/uid16.c                          CAP+
+sys_setfsgid16                  kernel/uid16.c                          CAP+
+sys_llseek                      fs/read_write.c                         CAP
+compat_sys_getdents             fs/compat.c                             CAP
+compat_sys_select                                                       OK
+sys_flock                       fs/locks.c                              CAP+
+sys_msync                                                               OK
+compat_sys_readv                                                        OK
+compat_sys_writev                                                       OK
+sys_getsid                      kernel/sys.c                            CAP
+sys_fdatasync                   fs/sync.c                               CAP+
+sys32_sysctl                    arch/x86/ia32/sys_ia32.c                CAP+
+sys_mlock                       mm/mlock.c                              CAP+
+sys_munlock                     mm/mlock.c                              CAP+
+sys_mlockall                    mm/mlock.c                              CAP+
+sys_munlockall                  mm/mlock.c                              CAP+
+sys_sched_setparam              kernel/sched.c                          CAP
+sys_sched_getparam              kernel/sched.c                          CAP
+sys_sched_setscheduler          kernel/sched.c                          CAP
+sys_sched_getscheduler          kernel/sched.c                          CAP
+sys_sched_yield                                                         OK
+sys_sched_get_priority_max                                              OK
+sys_sched_get_priority_min                                              OK
+sys32_sched_rr_get_interval                                             OK
+compat_sys_nanosleep                                                    OK?
+sys_mremap                                                              OK?
+sys_setresuid16                 kernel/uid16.c                          CAP+
+sys_getresuid16                                                         OK?
+sys32_vm86_warning              arch/x86/ia32/sys_ia32.c                CAP+
+quiet_ni_syscall                                                        ---
+sys_poll                                                                OK
+compat_sys_nfsservctl           fs/compat.c                             CAP+
+sys_setresgid16                 kernel/uid16.c                          CAP+
+sys_getresgid16                                                         OK
+sys_prctl                       kernel/sys.c                            CAP
+stub32_rt_sigreturn                                                     OK
+sys32_rt_sigaction                                                      OK
+sys32_rt_sigprocmask            arch/x86/ia32/sys_ia32.c                CAP
+sys32_rt_sigpending             arch/x86/ia32/sys_ia32.c                CAP
+compat_sys_rt_sigtimedwait      kernel/compat.c                         CAP
+sys32_rt_sigqueueinfo           arch/x86/ia32/sys_ia32.c                CAP
+stub32_rt_sigsuspend            arch/x86/ia32/ia32entry.S               CAP
+sys32_pread                     arch/x86/ia32/sys_ia32.c                CAP
+sys32_pwrite                    arch/x86/ia32/sys_ia32.c                CAP
+sys_chown16                     kernel/uid16.c                          CAP+
+sys_getcwd                      fs/dcache.c                             CAP
+sys_capget                      kernel/capability.c                     CAP
+sys_capset                      kernel/capability.c                     CAP+
+stub32_sigaltstack                                                      OK
+sys32_sendfile                  arch/x86/ia32/sys_ia32.c                CAP
+quiet_ni_syscall                                                        ---
+quiet_ni_syscall                                                        ---
+stub32_vfork                    arch/x86/ia32/ia32entry.S               CAP+
+compat_sys_getrlimit                                                    OK
+sys32_mmap2                                                             OK
+sys32_truncate64                arch/x86/ia32/sys_ia32.c                CAP
+sys32_ftruncate64               arch/x86/ia32/sys_ia32.c                CAP
+sys32_stat64                    arch/x86/ia32/sys_ia32.c                CAP
+sys32_lstat64                   arch/x86/ia32/sys_ia32.c                CAP
+sys32_fstat64                   arch/x86/ia32/sys_ia32.c                CAP
+sys_lchown                      fs/open.c                               CAP
+sys_getuid                                                              OK
+sys_getgid                                                              OK
+sys_geteuid                                                             OK
+sys_getegid                                                             OK
+sys_setreuid                    kernel/sys.c                            CAP+
+sys_setregid                    kernel/sys.c                            CAP+
+sys_getgroups                                                           OK
+sys_setgroups                   kernel/sys.c                            CAP+
+sys_fchown                      fs/open.c                               CAP+
+sys_setresuid                   kernel/sys.c                            CAP+
+sys_getresuid                                                           OK
+sys_setresgid                   kernel/sys.c                            CAP+
+sys_getresgid                                                           OK
+sys_chown                       fs/open.c                               CAP+
+sys_setuid                      kernel/sys.c                            CAP
+sys_setgid                      kernel/sys.c                            CAP+
+sys_setfsuid                    kernel/sys.c                            CAP+
+sys_setfsgid                    kernel/sys.c                            CAP+
+sys_pivot_root                  fs/namespace.c                          CAP+
+sys_mincore                     mm/mincore.c                            CAP
+sys_madvise                     mm/madvise.c                            CAP
+compat_sys_getdents64           fs/compat.c                             CAP
+compat_sys_fcntl64              fs/compat.c                             CAP
+quiet_ni_syscall                                                        ---
+quiet_ni_syscall                                                        ---
+sys_gettid	                                                        OK
+sys32_readahead                 arch/x86/ia32/sys_ia32.c                CAP
+sys_setxattr                    fs/xattr.c                              CAP+
+sys_lsetxattr                   fs/xattr.c                              CAP+
+sys_fsetxattr                   fs/xattr.c                              CAP+
+sys_getxattr                    fs/xattr.c                              CAP+
+sys_lgetxattr                   fs/xattr.c                              CAP+
+sys_fgetxattr                   fs/xattr.c                              CAP+
+sys_listxattr                   fs/xattr.c                              CAP+
+sys_llistxattr                  fs/xattr.c                              CAP+
+sys_flistxattr                  fs/xattr.c                              CAP+
+sys_removexattr                 fs/xattr.c                              CAP+
+sys_lremovexattr                fs/xattr.c                              CAP+
+sys_fremovexattr                fs/xattr.c                              CAP+
+sys_tkill                       kernel/signal.c                         CAP
+sys_sendfile64                  fs/read_write.c                         CAP
+compat_sys_futex                                                        OK
+compat_sys_sched_setaffinity    kernel/compat.c                         CAP
+compat_sys_sched_getaffinity    kernel/compat.c                         CAP
+sys_set_thread_area                                                     OK
+sys_get_thread_area                                                     OK
+compat_sys_io_setup             fs/compat.c                             CAP
+sys_io_destroy                  fs/aio.c                                CAP
+compat_sys_io_getevents         fs/compat.c                             CAP
+compat_sys_io_submit            fs/compat.c                             CAP
+sys_io_cancel                   fs/aio.c                                CAP
+sys32_fadvise64                 arch/x86/ia32/sys_ia32.c                CAP
+quiet_ni_syscall                                                        ---
+sys_exit_group                                                          OK
+sys32_lookup_dcookie            arch/x86/ia32/sys_ia32.c                CAP
+sys_epoll_create                fs/eventpoll.c                          CAP
+sys_epoll_ctl                   fs/eventpoll.c                          CAP
+sys_epoll_wait                  fs/eventpoll.c                          CAP
+sys_remap_file_pages                                                    OK?
+sys_set_tid_address                                                     OK
+compat_sys_timer_create         kernel/compat.c                         CAP
+compat_sys_timer_settime        kernel/compat.c                         CAP
+compat_sys_timer_gettime        kernel/compat.c                         CAP
+sys_timer_getoverrun            kernel/posix-timers.c                   CAP
+sys_timer_delete                kernel/posix-timers.c                   CAP
+compat_sys_clock_settime        kernel/compat.c                         CAP
+compat_sys_clock_gettime        kernel/compat.c                         CAP
+compat_sys_clock_getres         kernel/compat.c                         CAP
+compat_sys_clock_nanosleep      kernel/compat.c                         CAP
+compat_sys_statfs64             fs/compat.c                             CAP
+compat_sys_fstatfs64            fs/compat.c                             CAP
+sys_tgkill                      kernel/signal.c                         CAP
+compat_sys_utimes               fs/compat.c                             CAP+
+sys32_fadvise64_64              arch/x86/ia32/sys_ia32.c                CAP
+quiet_ni_syscall                                                        ---
+sys_mbind                       mm/mempolicy.c                          CAP
+compat_sys_get_mempolicy        mm/mempolicy.c                          CAP
+sys_set_mempolicy               mm/mempolicy.c                          CAP
+compat_sys_mq_open              ipc/compat_mq.c                         CAP
+sys_mq_unlink                   ipc/mqueue.c                            CAP
+compat_sys_mq_timedsend         ipc/compat_mq.c                         CAP
+compat_sys_mq_timedreceive      ipc/compat_mq.c                         CAP
+compat_sys_mq_notify            ipc/compat_mq.c                         CAP
+compat_sys_mq_getsetattr        ipc/compat_mq.c                         CAP
+compat_sys_kexec_load           kernel/kexec.c                          CAP
+compat_sys_waitid               kernel/compat.c                         CAP
+quiet_ni_syscall                                                        ---
+sys_add_key                     security/keys/keyctl.c                  CAP+
+sys_request_key                 security/keys/keyctl.c                  CAP+
+sys_keyctl                      security/keys/keyctl.c                  CAP+
+sys_ioprio_set                  fs/ioprio.c                             CAP+
+sys_ioprio_get                  fs/ioprio.c                             CAP+
+sys_inotify_init                fs/inotify_user.c                       CAP
+sys_inotify_add_watch           fs/inotify_user.c                       CAP
+sys_inotify_rm_watch            fs/inotify_user.c                       CAP
+sys_migrate_pages               mm/mempolicy.c                          CAP
+compat_sys_openat               fs/compat.c                             CAP
+sys_mkdirat                     fs/namei.c                              CAP
+sys_mknodat                     fs/namei.c                              CAP
+sys_fchownat                    fs/open.c                               CAP+
+compat_sys_futimesat            fs/compat.c                             CAP+
+sys32_fstatat                   arch/x86/ia32/sys_ia32.c                CAP
+sys_unlinkat                    fs/namei.c                              CAP
+sys_renameat                    fs/namei.c                              CAP+
+sys_linkat                      fs/namei.c                              CAP
+sys_symlinkat                   fs/namei.c                              CAP+
+sys_readlinkat                  fs/stat.c                               CAP
+sys_fchmodat                    fs/open.c                               CAP
+sys_faccessat                   fs/open.c                               CAP
+compat_sys_pselect6                                                     OK
+compat_sys_ppoll                                                        OK
+sys_unshare                     kernel/fork.c                           CAP
+compat_sys_set_robust_list                                              OK
+compat_sys_get_robust_list                                              OK
+sys_splice                      fs/splice.c                             CAP
+sys32_sync_file_range           arch/x86/ia32/sys_ia32.c                CAP+
+sys_tee                         fs/splice.c                             CAP
+compat_sys_vmsplice             fs/compat.c                             CAP
+compat_sys_move_pages           kernel/compat.c                         CAP+
+sys_getcpu                                                              OK
+sys_epoll_pwait                 fs/eventpoll.c                          CAP
+compat_sys_utimensat            fs/compat.c                             CAP+
+compat_sys_signalfd             fs/compat.c                             CAP
+sys_timerfd_create              fs/timerfd.c                            CAP
+sys_eventfd                     fs/eventfd.c                            CAP
+sys32_fallocate                 arch/x86/ia32/sys_ia32.c                CAP
+compat_sys_timerfd_settime      fs/compat.c                             CAP
+compat_sys_timerfd_gettime      fs/compat.c                             CAP
+
+=== END OF SYSCALL TABLE ===
+*) The line number corresponds to syscall number
+
+Syscall 0:
+sys_restart_syscall             kernel/signal.c                         OK
+
+syscall table is in arch/x86/ia32/ia32entry.S
diff -ruNp linux-2.6.26.1/fs/aio.c linux-2.6.26.1-cher1/fs/aio.c
--- linux-2.6.26.1/fs/aio.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/aio.c	2008-08-05 13:44:37.000000000 +0400
@@ -1266,6 +1266,9 @@ asmlinkage long sys_io_setup(unsigned nr
 	unsigned long ctx;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = get_user(ctx, ctxp);
 	if (unlikely(ret))
 		goto out;
@@ -1300,7 +1303,12 @@ out:
  */
 asmlinkage long sys_io_destroy(aio_context_t ctx)
 {
-	struct kioctx *ioctx = lookup_ioctx(ctx);
+	struct kioctx *ioctx;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        ioctx = lookup_ioctx(ctx);
 	if (likely(NULL != ioctx)) {
 		io_destroy(ioctx);
 		return 0;
@@ -1659,6 +1667,9 @@ asmlinkage long sys_io_submit(aio_contex
 	long ret = 0;
 	int i;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (unlikely(nr < 0))
 		return -EINVAL;
 
@@ -1736,6 +1747,9 @@ asmlinkage long sys_io_cancel(aio_contex
 	u32 key;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = get_user(key, &iocb->aio_key);
 	if (unlikely(ret))
 		return -EFAULT;
@@ -1795,9 +1809,13 @@ asmlinkage long sys_io_getevents(aio_con
 				 struct io_event __user *events,
 				 struct timespec __user *timeout)
 {
-	struct kioctx *ioctx = lookup_ioctx(ctx_id);
+	struct kioctx *ioctx;
 	long ret = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        ioctx = lookup_ioctx(ctx_id);
 	if (likely(ioctx)) {
 		if (likely(min_nr <= nr && min_nr >= 0 && nr >= 0))
 			ret = read_events(ioctx, min_nr, nr, events, timeout);
@@ -1813,3 +1831,9 @@ __initcall(aio_setup);
 EXPORT_SYMBOL(aio_complete);
 EXPORT_SYMBOL(aio_put_req);
 EXPORT_SYMBOL(wait_on_sync_kiocb);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/binfmt_aout.c linux-2.6.26.1-cher1/fs/binfmt_aout.c
--- linux-2.6.26.1/fs/binfmt_aout.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/binfmt_aout.c	2008-08-05 13:44:37.000000000 +0400
@@ -291,8 +291,12 @@ static int load_aout_binary(struct linux
 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
 	if (rlim >= RLIM_INFINITY)
 		rlim = ~0;
-	if (ex.a_data + ex.a_bss > rlim)
+	if (ex.a_data + ex.a_bss > rlim) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
 	/* Flush all traces of the currently running executable */
 	retval = flush_old_exec(bprm);
@@ -550,3 +554,9 @@ static void __exit exit_aout_binfmt(void
 core_initcall(init_aout_binfmt);
 module_exit(exit_aout_binfmt);
 MODULE_LICENSE("GPL");
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/binfmt_flat.c linux-2.6.26.1-cher1/fs/binfmt_flat.c
--- linux-2.6.26.1/fs/binfmt_flat.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/binfmt_flat.c	2008-08-05 13:44:37.000000000 +0400
@@ -496,6 +496,9 @@ static int load_flat_file(struct linux_b
 	if (rlim >= RLIM_INFINITY)
 		rlim = ~0;
 	if (data_len + bss_len > rlim) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		ret = -ENOMEM;
 		goto err;
 	}
@@ -938,3 +941,9 @@ static int __init init_flat_binfmt(void)
 core_initcall(init_flat_binfmt);
 
 /****************************************************************************/
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/buffer.c linux-2.6.26.1-cher1/fs/buffer.c
--- linux-2.6.26.1/fs/buffer.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/buffer.c	2008-08-05 13:44:37.000000000 +0400
@@ -3120,6 +3120,11 @@ asmlinkage long sys_bdflush(int func, lo
 {
 	static int msg_count;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
@@ -3309,3 +3314,9 @@ EXPORT_SYMBOL(mark_buffer_dirty);
 EXPORT_SYMBOL(submit_bh);
 EXPORT_SYMBOL(sync_dirty_buffer);
 EXPORT_SYMBOL(unlock_buffer);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/compat.c linux-2.6.26.1-cher1/fs/compat.c
--- linux-2.6.26.1/fs/compat.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/compat.c	2008-08-05 13:44:37.000000000 +0400
@@ -81,6 +81,11 @@ asmlinkage long compat_sys_utime(char __
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (t) {
 		if (get_user(tv[0].tv_sec, &t->actime) ||
 		    get_user(tv[1].tv_sec, &t->modtime))
@@ -95,6 +100,11 @@ asmlinkage long compat_sys_utimensat(uns
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if  (t) {
 		if (get_compat_timespec(&tv[0], &t[0]) ||
 		    get_compat_timespec(&tv[1], &t[1]))
@@ -117,6 +127,9 @@ asmlinkage long compat_sys_futimesat(uns
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (t) {
 		if (get_user(tv[0].tv_sec, &t[0].tv_sec) ||
 		    get_user(tv[0].tv_nsec, &t[0].tv_usec) ||
@@ -141,8 +154,12 @@ asmlinkage long compat_sys_newstat(char 
 		struct compat_stat __user *statbuf)
 {
 	struct kstat stat;
-	int error = vfs_stat_fd(AT_FDCWD, filename, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 
+	error = vfs_stat_fd(AT_FDCWD, filename, &stat);
 	if (!error)
 		error = cp_compat_stat(&stat, statbuf);
 	return error;
@@ -152,8 +169,12 @@ asmlinkage long compat_sys_newlstat(char
 		struct compat_stat __user *statbuf)
 {
 	struct kstat stat;
-	int error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
+	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
 	if (!error)
 		error = cp_compat_stat(&stat, statbuf);
 	return error;
@@ -186,8 +207,12 @@ asmlinkage long compat_sys_newfstat(unsi
 		struct compat_stat __user * statbuf)
 {
 	struct kstat stat;
-	int error = vfs_fstat(fd, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 
+        error = vfs_fstat(fd, &stat);
 	if (!error)
 		error = cp_compat_stat(&stat, statbuf);
 	return error;
@@ -239,6 +264,9 @@ asmlinkage long compat_sys_statfs(const 
 	struct nameidata nd;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = user_path_walk(path, &nd);
 	if (!error) {
 		struct kstatfs tmp;
@@ -256,6 +284,9 @@ asmlinkage long compat_sys_fstatfs(unsig
 	struct kstatfs tmp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EBADF;
 	file = fget(fd);
 	if (!file)
@@ -304,6 +335,9 @@ asmlinkage long compat_sys_statfs64(cons
 	struct nameidata nd;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -324,6 +358,9 @@ asmlinkage long compat_sys_fstatfs64(uns
 	struct kstatfs tmp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -398,6 +435,9 @@ asmlinkage long compat_sys_fcntl64(unsig
 	struct flock f;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	switch (cmd) {
 	case F_GETLK:
 	case F_SETLK:
@@ -721,6 +761,9 @@ asmlinkage long compat_sys_mount(char __
 	char *dir_page;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	retval = copy_mount_options (type, &type_page);
 	if (retval < 0)
 		goto out;
@@ -819,6 +862,9 @@ asmlinkage long compat_sys_old_readdir(u
 	struct file *file;
 	struct compat_readdir_callback buf;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EBADF;
 	file = fget(fd);
 	if (!file)
@@ -898,6 +944,9 @@ asmlinkage long compat_sys_getdents(unsi
 	struct compat_getdents_callback buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EFAULT;
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		goto out;
@@ -989,6 +1038,9 @@ asmlinkage long compat_sys_getdents64(un
 	struct compat_getdents_callback64 buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EFAULT;
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		goto out;
@@ -1214,6 +1266,9 @@ compat_sys_open(const char __user *filen
 asmlinkage long
 compat_sys_openat(unsigned int dfd, const char __user *filename, int flags, int mode)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_sys_open(dfd, filename, flags, mode);
 }
 
@@ -2013,6 +2068,11 @@ asmlinkage long compat_sys_nfsservctl(in
 	mm_segment_t oldfs;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	karg = kmalloc(sizeof(*karg), GFP_USER);
 	kres = kmalloc(sizeof(*kres), GFP_USER);
 	if(!karg || !kres) {
@@ -2193,3 +2253,9 @@ asmlinkage long compat_sys_timerfd_getti
 }
 
 #endif /* CONFIG_TIMERFD */
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/compat_ioctl.c linux-2.6.26.1-cher1/fs/compat_ioctl.c
--- linux-2.6.26.1/fs/compat_ioctl.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/compat_ioctl.c	2008-08-05 13:44:37.000000000 +0400
@@ -2880,6 +2880,9 @@ asmlinkage long compat_sys_ioctl(unsigne
 	struct ioctl_trans *t;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	filp = fget_light(fd, &fput_needed);
 	if (!filp)
 		goto out;
@@ -2991,3 +2994,9 @@ static int __init init_sys32_ioctl(void)
 	return 0;
 }
 __initcall(init_sys32_ioctl);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/dcache.c linux-2.6.26.1-cher1/fs/dcache.c
--- linux-2.6.26.1/fs/dcache.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/dcache.c	2008-08-05 13:44:37.000000000 +0400
@@ -1960,8 +1960,12 @@ asmlinkage long sys_getcwd(char __user *
 {
 	int error;
 	struct path pwd, root;
-	char *page = (char *) __get_free_page(GFP_USER);
+	char *page;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        page = (char *) __get_free_page(GFP_USER);
 	if (!page)
 		return -ENOMEM;
 
@@ -2236,3 +2240,9 @@ EXPORT_SYMBOL(have_submounts);
 EXPORT_SYMBOL(names_cachep);
 EXPORT_SYMBOL(shrink_dcache_parent);
 EXPORT_SYMBOL(shrink_dcache_sb);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/dcookies.c linux-2.6.26.1-cher1/fs/dcookies.c
--- linux-2.6.26.1/fs/dcookies.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/dcookies.c	2008-08-05 13:44:37.000000000 +0400
@@ -25,6 +25,7 @@
 #include <linux/dcookies.h>
 #include <linux/mutex.h>
 #include <linux/path.h>
+#include <linux/sched.h>
 #include <asm/uaccess.h>
 
 /* The dcookies are allocated from a kmem_cache and
@@ -149,6 +150,9 @@ asmlinkage long sys_lookup_dcookie(u64 c
 	size_t pathlen;
 	struct dcookie_struct * dcs;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* we could leak path information to users
 	 * without dir read permission without this
 	 */
@@ -324,3 +328,9 @@ void dcookie_unregister(struct dcookie_u
 EXPORT_SYMBOL_GPL(dcookie_register);
 EXPORT_SYMBOL_GPL(dcookie_unregister);
 EXPORT_SYMBOL_GPL(get_dcookie);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/eventfd.c linux-2.6.26.1-cher1/fs/eventfd.c
--- linux-2.6.26.1/fs/eventfd.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/eventfd.c	2008-08-05 13:44:37.000000000 +0400
@@ -203,6 +203,9 @@ asmlinkage long sys_eventfd(unsigned int
 	int fd;
 	struct eventfd_ctx *ctx;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
 	if (!ctx)
 		return -ENOMEM;
@@ -220,3 +223,8 @@ asmlinkage long sys_eventfd(unsigned int
 	return fd;
 }
 
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/eventpoll.c linux-2.6.26.1-cher1/fs/eventpoll.c
--- linux-2.6.26.1/fs/eventpoll.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/eventpoll.c	2008-08-05 13:44:37.000000000 +0400
@@ -1051,6 +1051,9 @@ asmlinkage long sys_epoll_create(int siz
 	int error, fd = -1;
 	struct eventpoll *ep;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d)\n",
 		     current, size));
 
@@ -1093,6 +1096,9 @@ asmlinkage long sys_epoll_ctl(int epfd, 
 	struct epitem *epi;
 	struct epoll_event epds;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_ctl(%d, %d, %d, %p)\n",
 		     current, epfd, op, fd, event));
 
@@ -1189,6 +1195,9 @@ asmlinkage long sys_epoll_wait(int epfd,
 	struct file *file;
 	struct eventpoll *ep;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_wait(%d, %p, %d, %d)\n",
 		     current, epfd, events, maxevents, timeout));
 
@@ -1247,6 +1256,9 @@ asmlinkage long sys_epoll_pwait(int epfd
 	int error;
 	sigset_t ksigmask, sigsaved;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/*
 	 * If the caller wants a certain signal mask to be set during the wait,
 	 * we apply it here.
@@ -1302,3 +1314,9 @@ static int __init eventpoll_init(void)
 	return 0;
 }
 fs_initcall(eventpoll_init);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/exec.c linux-2.6.26.1-cher1/fs/exec.c
--- linux-2.6.26.1/fs/exec.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/exec.c	2008-08-05 13:44:37.000000000 +0400
@@ -112,6 +112,9 @@ asmlinkage long sys_uselib(const char __
 	struct nameidata nd;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = __user_path_lookup_open(library, LOOKUP_FOLLOW, &nd, FMODE_READ|FMODE_EXEC);
 	if (error)
 		goto out;
@@ -1790,3 +1793,9 @@ fail_unlock:
 fail:
 	return retval;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/fcntl.c linux-2.6.26.1-cher1/fs/fcntl.c
--- linux-2.6.26.1/fs/fcntl.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/fcntl.c	2008-08-05 13:44:37.000000000 +0400
@@ -133,6 +133,9 @@ asmlinkage long sys_dup2(unsigned int ol
 	struct files_struct * files = current->files;
 	struct fdtable *fdt;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	spin_lock(&files->file_lock);
 	if (!(file = fcheck(oldfd)))
 		goto out_unlock;
@@ -185,8 +188,12 @@ out_fput:
 asmlinkage long sys_dup(unsigned int fildes)
 {
 	int ret = -EBADF;
-	struct file * file = fget(fildes);
+	struct file * file;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 
+        file = fget(fildes);
 	if (file)
 		ret = dupfd(file, 0, 0);
 	return ret;
@@ -381,6 +388,9 @@ asmlinkage long sys_fcntl(unsigned int f
 	struct file *filp;
 	long err = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	filp = fget(fd);
 	if (!filp)
 		goto out;
@@ -404,6 +414,9 @@ asmlinkage long sys_fcntl64(unsigned int
 	struct file * filp;
 	long err;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	err = -EBADF;
 	filp = fget(fd);
 	if (!filp)
@@ -637,3 +650,9 @@ static int __init fasync_init(void)
 }
 
 module_init(fasync_init)
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/filesystems.c linux-2.6.26.1-cher1/fs/filesystems.c
--- linux-2.6.26.1/fs/filesystems.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/filesystems.c	2008-08-05 13:44:37.000000000 +0400
@@ -12,6 +12,7 @@
 #include <linux/kmod.h>
 #include <linux/init.h>
 #include <linux/module.h>
+#include <linux/sched.h>
 #include <asm/uaccess.h>
 
 /*
@@ -181,6 +182,11 @@ asmlinkage long sys_sysfs(int option, un
 {
 	int retval = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	switch (option) {
 		case 1:
 			retval = fs_index((const char __user *) arg1);
@@ -241,3 +247,9 @@ struct file_system_type *get_fs_type(con
 }
 
 EXPORT_SYMBOL(get_fs_type);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/inotify_user.c linux-2.6.26.1-cher1/fs/inotify_user.c
--- linux-2.6.26.1/fs/inotify_user.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/inotify_user.c	2008-08-05 13:44:37.000000000 +0400
@@ -574,6 +574,9 @@ asmlinkage long sys_inotify_init(void)
 	struct file *filp;
 	int fd, ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	fd = get_unused_fd();
 	if (fd < 0)
 		return fd;
@@ -647,6 +650,9 @@ asmlinkage long sys_inotify_add_watch(in
 	int ret, fput_needed;
 	unsigned flags = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	filp = fget_light(fd, &fput_needed);
 	if (unlikely(!filp))
 		return -EBADF;
@@ -688,6 +694,9 @@ asmlinkage long sys_inotify_rm_watch(int
 	struct inotify_device *dev;
 	int ret, fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	filp = fget_light(fd, &fput_needed);
 	if (unlikely(!filp))
 		return -EBADF;
@@ -754,3 +763,9 @@ static int __init inotify_user_setup(voi
 }
 
 module_init(inotify_user_setup);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/ioctl.c linux-2.6.26.1-cher1/fs/ioctl.c
--- linux-2.6.26.1/fs/ioctl.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/ioctl.c	2008-08-05 13:44:37.000000000 +0400
@@ -197,6 +197,9 @@ asmlinkage long sys_ioctl(unsigned int f
 	int error = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	filp = fget_light(fd, &fput_needed);
 	if (!filp)
 		goto out;
@@ -211,3 +214,9 @@ asmlinkage long sys_ioctl(unsigned int f
  out:
 	return error;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/ioprio.c linux-2.6.26.1-cher1/fs/ioprio.c
--- linux-2.6.26.1/fs/ioprio.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/ioprio.c	2008-08-05 13:44:37.000000000 +0400
@@ -74,6 +74,11 @@ asmlinkage long sys_ioprio_set(int which
 	struct pid *pgrp;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	switch (class) {
 		case IOPRIO_CLASS_RT:
 			if (!capable(CAP_SYS_ADMIN))
@@ -189,6 +194,11 @@ asmlinkage long sys_ioprio_get(int which
 	int ret = -ESRCH;
 	int tmpio;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	read_lock(&tasklist_lock);
 	switch (which) {
 		case IOPRIO_WHO_PROCESS:
@@ -246,3 +256,8 @@ asmlinkage long sys_ioprio_get(int which
 	return ret;
 }
 
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/locks.c linux-2.6.26.1-cher1/fs/locks.c
--- linux-2.6.26.1/fs/locks.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/locks.c	2008-08-05 13:44:37.000000000 +0400
@@ -1571,6 +1571,11 @@ asmlinkage long sys_flock(unsigned int f
 	int can_sleep, unlock;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = -EBADF;
 	filp = fget(fd);
 	if (!filp)
@@ -2292,3 +2297,9 @@ static int __init filelock_init(void)
 }
 
 core_initcall(filelock_init);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/namei.c linux-2.6.26.1-cher1/fs/namei.c
--- linux-2.6.26.1/fs/namei.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/namei.c	2008-08-05 13:44:37.000000000 +0400
@@ -2076,6 +2076,11 @@ asmlinkage long sys_mknodat(int dfd, con
 	struct dentry * dentry;
 	struct nameidata nd;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (S_ISDIR(mode))
 		return -EPERM;
 	tmp = getname(filename);
@@ -2156,6 +2161,11 @@ asmlinkage long sys_mkdirat(int dfd, con
 	struct dentry *dentry;
 	struct nameidata nd;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	tmp = getname(pathname);
 	error = PTR_ERR(tmp);
 	if (IS_ERR(tmp))
@@ -2301,6 +2311,11 @@ exit:
 
 asmlinkage long sys_rmdir(const char __user *pathname)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_rmdir(AT_FDCWD, pathname);
 }
 
@@ -2394,6 +2409,11 @@ slashes:
 
 asmlinkage long sys_unlinkat(int dfd, const char __user *pathname, int flag)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((flag & ~AT_REMOVEDIR) != 0)
 		return -EINVAL;
 
@@ -2405,6 +2425,11 @@ asmlinkage long sys_unlinkat(int dfd, co
 
 asmlinkage long sys_unlink(const char __user *pathname)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_unlinkat(AT_FDCWD, pathname);
 }
 
@@ -2438,6 +2463,11 @@ asmlinkage long sys_symlinkat(const char
 	struct dentry *dentry;
 	struct nameidata nd;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	from = getname(oldname);
 	if(IS_ERR(from))
 		return PTR_ERR(from);
@@ -2532,6 +2562,11 @@ asmlinkage long sys_linkat(int olddfd, c
 	int error;
 	char * to;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((flags & ~AT_SYMLINK_FOLLOW) != 0)
 		return -EINVAL;
 
@@ -2812,6 +2847,11 @@ asmlinkage long sys_renameat(int olddfd,
 	char * from;
 	char * to;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	from = getname(oldname);
 	if(IS_ERR(from))
 		return PTR_ERR(from);
@@ -2992,3 +3032,9 @@ EXPORT_SYMBOL(vfs_symlink);
 EXPORT_SYMBOL(vfs_unlink);
 EXPORT_SYMBOL(dentry_unhash);
 EXPORT_SYMBOL(generic_readlink);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/namespace.c linux-2.6.26.1-cher1/fs/namespace.c
--- linux-2.6.26.1/fs/namespace.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/namespace.c	2008-08-05 13:44:37.000000000 +0400
@@ -1124,6 +1124,11 @@ asmlinkage long sys_umount(char __user *
 	struct nameidata nd;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	retval = __user_walk(name, LOOKUP_FOLLOW, &nd);
 	if (retval)
 		goto out;
@@ -2055,6 +2060,9 @@ asmlinkage long sys_mount(char __user * 
 	unsigned long dev_page;
 	char *dir_page;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	retval = copy_mount_options(type, &type_page);
 	if (retval < 0)
 		return retval;
@@ -2180,6 +2188,11 @@ asmlinkage long sys_pivot_root(const cha
 	struct path parent_path, root_parent, root;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
@@ -2351,3 +2364,9 @@ void __put_mnt_ns(struct mnt_namespace *
 	release_mounts(&umount_list);
 	kfree(ns);
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/nfsctl.c linux-2.6.26.1-cher1/fs/nfsctl.c
--- linux-2.6.26.1/fs/nfsctl.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/nfsctl.c	2008-08-05 13:44:37.000000000 +0400
@@ -14,6 +14,7 @@
 #include <linux/namei.h>
 #include <linux/mount.h>
 #include <linux/syscalls.h>
+#include <linux/sched.h>
 #include <asm/uaccess.h>
 
 /*
@@ -90,6 +91,11 @@ asmlinkage sys_nfsservctl(int cmd, struc
 	int version;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_from_user(&version, &arg->ca_version, sizeof(int)))
 		return -EFAULT;
 
@@ -110,3 +116,9 @@ asmlinkage sys_nfsservctl(int cmd, struc
 	fput(file);
 	return err;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/open.c linux-2.6.26.1-cher1/fs/open.c
--- linux-2.6.26.1/fs/open.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/open.c	2008-08-05 13:44:37.000000000 +0400
@@ -126,6 +126,9 @@ asmlinkage long sys_statfs(const char __
 	struct nameidata nd;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = user_path_walk(path, &nd);
 	if (!error) {
 		struct statfs tmp;
@@ -143,6 +146,9 @@ asmlinkage long sys_statfs64(const char 
 	struct nameidata nd;
 	long error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 	error = user_path_walk(path, &nd);
@@ -163,6 +169,9 @@ asmlinkage long sys_fstatfs(unsigned int
 	struct statfs tmp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EBADF;
 	file = fget(fd);
 	if (!file)
@@ -181,6 +190,9 @@ asmlinkage long sys_fstatfs64(unsigned i
 	struct statfs64 tmp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -288,6 +300,9 @@ out:
 
 asmlinkage long sys_truncate(const char __user * path, unsigned long length)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* on 32-bit boxen it will cut the range 2^31--2^32-1 off */
 	return do_sys_truncate(path, (long)length);
 }
@@ -337,7 +352,12 @@ out:
 
 asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length)
 {
-	long ret = do_sys_ftruncate(fd, length, 1);
+	long ret;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        ret = do_sys_ftruncate(fd, length, 1);
 	/* avoid REGPARM breakage on x86: */
 	asmlinkage_protect(2, ret, fd, length);
 	return ret;
@@ -347,12 +367,20 @@ asmlinkage long sys_ftruncate(unsigned i
 #if BITS_PER_LONG == 32
 asmlinkage long sys_truncate64(const char __user * path, loff_t length)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_sys_truncate(path, length);
 }
 
 asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length)
 {
-	long ret = do_sys_ftruncate(fd, length, 0);
+	long ret;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        ret = do_sys_ftruncate(fd, length, 0);
 	/* avoid REGPARM breakage on x86: */
 	asmlinkage_protect(2, ret, fd, length);
 	return ret;
@@ -368,6 +396,9 @@ asmlinkage long sys_fallocate(int fd, in
 	if (offset < 0 || len <= 0)
 		goto out;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Return error if mode is not supported */
 	ret = -EOPNOTSUPP;
 	if (mode && !(mode & FALLOC_FL_KEEP_SIZE))
@@ -429,6 +460,9 @@ asmlinkage long sys_faccessat(int dfd, c
 	kernel_cap_t uninitialized_var(old_cap);  /* !SECURE_NO_SETUID_FIXUP */
 	int res;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (mode & ~S_IRWXO)	/* where's F_OK, X_OK, W_OK, R_OK? */
 		return -EINVAL;
 
@@ -500,6 +534,9 @@ asmlinkage long sys_chdir(const char __u
 	struct nameidata nd;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = __user_walk(filename,
 			    LOOKUP_FOLLOW|LOOKUP_DIRECTORY|LOOKUP_CHDIR, &nd);
 	if (error)
@@ -523,6 +560,9 @@ asmlinkage long sys_fchdir(unsigned int 
 	struct inode *inode;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EBADF;
 	file = fget(fd);
 	if (!file)
@@ -548,6 +588,11 @@ asmlinkage long sys_chroot(const char __
 	struct nameidata nd;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = __user_walk(filename, LOOKUP_FOLLOW | LOOKUP_DIRECTORY | LOOKUP_NOALT, &nd);
 	if (error)
 		goto out;
@@ -577,6 +622,11 @@ asmlinkage long sys_fchmod(unsigned int 
 	int err = -EBADF;
 	struct iattr newattrs;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	file = fget(fd);
 	if (!file)
 		goto out;
@@ -616,6 +666,11 @@ asmlinkage long sys_fchmodat(int dfd, co
 	int error;
 	struct iattr newattrs;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = __user_walk_fd(dfd, filename, LOOKUP_FOLLOW, &nd);
 	if (error)
 		goto out;
@@ -688,6 +743,11 @@ asmlinkage long sys_chown(const char __u
 	struct nameidata nd;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_walk(filename, &nd);
 	if (error)
 		goto out;
@@ -709,6 +769,11 @@ asmlinkage long sys_fchownat(int dfd, co
 	int error = -EINVAL;
 	int follow;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
 		goto out;
 
@@ -732,6 +797,11 @@ asmlinkage long sys_lchown(const char __
 	struct nameidata nd;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_walk_link(filename, &nd);
 	if (error)
 		goto out;
@@ -753,6 +823,11 @@ asmlinkage long sys_fchown(unsigned int 
 	int error = -EBADF;
 	struct dentry * dentry;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	file = fget(fd);
 	if (!file)
 		goto out;
@@ -1084,8 +1159,20 @@ EXPORT_SYMBOL(fd_install);
 long do_sys_open(int dfd, const char __user *filename, int flags, int mode)
 {
 	char *tmp = getname(filename);
-	int fd = PTR_ERR(tmp);
+	int fd;
+
+        if (!IS_ERR(tmp) && SBOX_IS_RESTRICTED()) {
+                char *s = tmp;
+                while (s[0] == '.' && s[1] == '/') s += 2;
+                for (; *s && *s != '/'; s++);
+                if (*s == '/') {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                flags &= ~(O_CREAT | O_EXCL);
+        }
 
+        fd = PTR_ERR(tmp);
 	if (!IS_ERR(tmp)) {
 		fd = get_unused_fd_flags(flags);
 		if (fd >= 0) {
@@ -1121,6 +1208,9 @@ asmlinkage long sys_openat(int dfd, cons
 {
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (force_o_largefile())
 		flags |= O_LARGEFILE;
 
@@ -1214,6 +1304,11 @@ EXPORT_SYMBOL(sys_close);
  */
 asmlinkage long sys_vhangup(void)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (capable(CAP_SYS_TTY_CONFIG)) {
 		/* XXX: this needs locking */
 		tty_vhangup(current->signal->tty);
@@ -1248,3 +1343,9 @@ int nonseekable_open(struct inode *inode
 }
 
 EXPORT_SYMBOL(nonseekable_open);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/pipe.c linux-2.6.26.1-cher1/fs/pipe.c
--- linux-2.6.26.1/fs/pipe.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/pipe.c	2008-08-05 13:44:37.000000000 +0400
@@ -1083,6 +1083,9 @@ asmlinkage long __weak sys_pipe(int __us
 	int fd[2];
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = do_pipe(fd);
 	if (!error) {
 		if (copy_to_user(fildes, fd, sizeof(fd))) {
@@ -1135,3 +1138,9 @@ static void __exit exit_pipe_fs(void)
 
 fs_initcall(init_pipe_fs);
 module_exit(exit_pipe_fs);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/proc/base.c linux-2.6.26.1-cher1/fs/proc/base.c
--- linux-2.6.26.1/fs/proc/base.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/proc/base.c	2008-08-05 13:44:37.000000000 +0400
@@ -452,6 +452,10 @@ static const struct limit_names lnames[R
 	[RLIMIT_NICE] = {"Max nice priority", NULL},
 	[RLIMIT_RTPRIO] = {"Max realtime priority", NULL},
 	[RLIMIT_RTTIME] = {"Max realtime timeout", "us"},
+	[RLIMIT_FUTURE1] = {"Future use 1", NULL},
+	[RLIMIT_FUTURE2] = {"Future use 2", NULL},
+	[RLIMIT_FUTURE3] = {"Future use 3", NULL},
+        [RLIMIT_MCPU] = { "Max cpu time", "ms" },
 };
 
 /* Display limits for a process */
@@ -3054,3 +3058,9 @@ static const struct file_operations proc
 	.read		= generic_read_dir,
 	.readdir	= proc_task_readdir,
 };
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/quota.c linux-2.6.26.1-cher1/fs/quota.c
--- linux-2.6.26.1/fs/quota.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/quota.c	2008-08-05 13:44:37.000000000 +0400
@@ -368,6 +368,11 @@ asmlinkage long sys_quotactl(unsigned in
 	struct super_block *sb = NULL;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	cmds = cmd >> SUBCMDSHIFT;
 	type = cmd & SUBCMDMASK;
 
@@ -436,6 +441,11 @@ asmlinkage long sys32_quotactl(unsigned 
 	u16 xdata;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	cmds = cmd >> SUBCMDSHIFT;
 
 	switch (cmds) {
@@ -501,3 +511,9 @@ asmlinkage long sys32_quotactl(unsigned 
 	return ret;
 }
 #endif
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/readdir.c linux-2.6.26.1-cher1/fs/readdir.c
--- linux-2.6.26.1/fs/readdir.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/readdir.c	2008-08-05 13:44:37.000000000 +0400
@@ -106,6 +106,9 @@ asmlinkage long old_readdir(unsigned int
 	struct file * file;
 	struct readdir_callback buf;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EBADF;
 	file = fget(fd);
 	if (!file)
@@ -190,6 +193,9 @@ asmlinkage long sys_getdents(unsigned in
 	struct getdents_callback buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EFAULT;
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		goto out;
@@ -274,6 +280,9 @@ asmlinkage long sys_getdents64(unsigned 
 	struct getdents_callback64 buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EFAULT;
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		goto out;
@@ -306,3 +315,9 @@ out_putf:
 out:
 	return error;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/read_write.c linux-2.6.26.1-cher1/fs/read_write.c
--- linux-2.6.26.1/fs/read_write.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/read_write.c	2008-08-05 13:44:37.000000000 +0400
@@ -134,6 +134,9 @@ asmlinkage off_t sys_lseek(unsigned int 
 	struct file * file;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	retval = -EBADF;
 	file = fget_light(fd, &fput_needed);
 	if (!file)
@@ -161,6 +164,9 @@ asmlinkage long sys_llseek(unsigned int 
 	loff_t offset;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	retval = -EBADF;
 	file = fget_light(fd, &fput_needed);
 	if (!file)
@@ -391,6 +397,9 @@ asmlinkage ssize_t sys_pread64(unsigned 
 	ssize_t ret = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -412,6 +421,9 @@ asmlinkage ssize_t sys_pwrite64(unsigned
 	ssize_t ret = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -799,6 +811,9 @@ asmlinkage ssize_t sys_sendfile(int out_
 	off_t off;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (offset) {
 		if (unlikely(get_user(off, offset)))
 			return -EFAULT;
@@ -817,6 +832,9 @@ asmlinkage ssize_t sys_sendfile64(int ou
 	loff_t pos;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (offset) {
 		if (unlikely(copy_from_user(&pos, offset, sizeof(loff_t))))
 			return -EFAULT;
@@ -828,3 +846,9 @@ asmlinkage ssize_t sys_sendfile64(int ou
 
 	return do_sendfile(out_fd, in_fd, NULL, count, 0);
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/signalfd.c linux-2.6.26.1-cher1/fs/signalfd.c
--- linux-2.6.26.1/fs/signalfd.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/signalfd.c	2008-08-05 13:44:37.000000000 +0400
@@ -210,6 +210,9 @@ asmlinkage long sys_signalfd(int ufd, si
 	sigset_t sigmask;
 	struct signalfd_ctx *ctx;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sizemask != sizeof(sigset_t) ||
 	    copy_from_user(&sigmask, user_mask, sizeof(sigmask)))
 		return -EINVAL;
@@ -249,3 +252,9 @@ asmlinkage long sys_signalfd(int ufd, si
 
 	return ufd;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/splice.c linux-2.6.26.1-cher1/fs/splice.c
--- linux-2.6.26.1/fs/splice.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/splice.c	2008-08-05 13:44:37.000000000 +0400
@@ -1464,6 +1464,9 @@ asmlinkage long sys_vmsplice(int fd, con
 	long error;
 	int fput;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (unlikely(nr_segs > UIO_MAXIOV))
 		return -EINVAL;
 	else if (unlikely(!nr_segs))
@@ -1491,6 +1494,9 @@ asmlinkage long sys_splice(int fd_in, lo
 	struct file *in, *out;
 	int fput_in, fput_out;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (unlikely(!len))
 		return 0;
 
@@ -1712,6 +1718,9 @@ asmlinkage long sys_tee(int fdin, int fd
 	struct file *in;
 	int error, fput_in;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (unlikely(!len))
 		return 0;
 
@@ -1733,3 +1742,9 @@ asmlinkage long sys_tee(int fdin, int fd
 
 	return error;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/stat.c linux-2.6.26.1-cher1/fs/stat.c
--- linux-2.6.26.1/fs/stat.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/stat.c	2008-08-05 13:44:37.000000000 +0400
@@ -155,8 +155,12 @@ static int cp_old_stat(struct kstat *sta
 asmlinkage long sys_stat(char __user * filename, struct __old_kernel_stat __user * statbuf)
 {
 	struct kstat stat;
-	int error = vfs_stat_fd(AT_FDCWD, filename, &stat);
+        int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        error = vfs_stat_fd(AT_FDCWD, filename, &stat);
 	if (!error)
 		error = cp_old_stat(&stat, statbuf);
 
@@ -165,8 +169,12 @@ asmlinkage long sys_stat(char __user * f
 asmlinkage long sys_lstat(char __user * filename, struct __old_kernel_stat __user * statbuf)
 {
 	struct kstat stat;
-	int error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 
+        error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
 	if (!error)
 		error = cp_old_stat(&stat, statbuf);
 
@@ -175,8 +183,12 @@ asmlinkage long sys_lstat(char __user * 
 asmlinkage long sys_fstat(unsigned int fd, struct __old_kernel_stat __user * statbuf)
 {
 	struct kstat stat;
-	int error = vfs_fstat(fd, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 
+        error = vfs_fstat(fd, &stat);
 	if (!error)
 		error = cp_old_stat(&stat, statbuf);
 
@@ -238,8 +250,12 @@ static int cp_new_stat(struct kstat *sta
 asmlinkage long sys_newstat(char __user *filename, struct stat __user *statbuf)
 {
 	struct kstat stat;
-	int error = vfs_stat_fd(AT_FDCWD, filename, &stat);
+	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        error = vfs_stat_fd(AT_FDCWD, filename, &stat);
 	if (!error)
 		error = cp_new_stat(&stat, statbuf);
 
@@ -249,8 +265,12 @@ asmlinkage long sys_newstat(char __user 
 asmlinkage long sys_newlstat(char __user *filename, struct stat __user *statbuf)
 {
 	struct kstat stat;
-	int error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 
+        error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
 	if (!error)
 		error = cp_new_stat(&stat, statbuf);
 
@@ -264,6 +284,9 @@ asmlinkage long sys_newfstatat(int dfd, 
 	struct kstat stat;
 	int error = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
 		goto out;
 
@@ -283,8 +306,12 @@ out:
 asmlinkage long sys_newfstat(unsigned int fd, struct stat __user *statbuf)
 {
 	struct kstat stat;
-	int error = vfs_fstat(fd, &stat);
+	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        error = vfs_fstat(fd, &stat);
 	if (!error)
 		error = cp_new_stat(&stat, statbuf);
 
@@ -297,6 +324,9 @@ asmlinkage long sys_readlinkat(int dfd, 
 	struct nameidata nd;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (bufsiz <= 0)
 		return -EINVAL;
 
@@ -368,8 +398,12 @@ static long cp_new_stat64(struct kstat *
 asmlinkage long sys_stat64(char __user * filename, struct stat64 __user * statbuf)
 {
 	struct kstat stat;
-	int error = vfs_stat(filename, &stat);
+	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        error = vfs_stat(filename, &stat);
 	if (!error)
 		error = cp_new_stat64(&stat, statbuf);
 
@@ -378,8 +412,12 @@ asmlinkage long sys_stat64(char __user *
 asmlinkage long sys_lstat64(char __user * filename, struct stat64 __user * statbuf)
 {
 	struct kstat stat;
-	int error = vfs_lstat(filename, &stat);
+	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        error = vfs_lstat(filename, &stat);
 	if (!error)
 		error = cp_new_stat64(&stat, statbuf);
 
@@ -388,8 +426,12 @@ asmlinkage long sys_lstat64(char __user 
 asmlinkage long sys_fstat64(unsigned long fd, struct stat64 __user * statbuf)
 {
 	struct kstat stat;
-	int error = vfs_fstat(fd, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 
+        error = vfs_fstat(fd, &stat);
 	if (!error)
 		error = cp_new_stat64(&stat, statbuf);
 
@@ -402,6 +444,9 @@ asmlinkage long sys_fstatat64(int dfd, c
 	struct kstat stat;
 	int error = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
 		goto out;
 
@@ -469,3 +514,9 @@ void inode_set_bytes(struct inode *inode
 }
 
 EXPORT_SYMBOL(inode_set_bytes);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/super.c linux-2.6.26.1-cher1/fs/super.c
--- linux-2.6.26.1/fs/super.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/super.c	2008-08-05 13:44:37.000000000 +0400
@@ -540,6 +540,9 @@ asmlinkage long sys_ustat(unsigned dev, 
         struct kstatfs sbuf;
 	int err = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
         s = user_get_super(new_decode_dev(dev));
         if (s == NULL)
                 goto out;
@@ -980,3 +983,9 @@ struct vfsmount *kern_mount_data(struct 
 }
 
 EXPORT_SYMBOL_GPL(kern_mount_data);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/sync.c linux-2.6.26.1-cher1/fs/sync.c
--- linux-2.6.26.1/fs/sync.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/sync.c	2008-08-05 13:44:37.000000000 +0400
@@ -38,6 +38,11 @@ static void do_sync(unsigned long wait)
 
 asmlinkage long sys_sync(void)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	do_sync(1);
 	return 0;
 }
@@ -120,11 +125,21 @@ static long __do_fsync(unsigned int fd, 
 
 asmlinkage long sys_fsync(unsigned int fd)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return __do_fsync(fd, 0);
 }
 
 asmlinkage long sys_fdatasync(unsigned int fd)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return __do_fsync(fd, 1);
 }
 
@@ -183,6 +198,11 @@ asmlinkage long sys_sync_file_range(int 
 	int fput_needed;
 	umode_t i_mode;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ret = -EINVAL;
 	if (flags & ~VALID_FLAGS)
 		goto out;
@@ -282,3 +302,9 @@ out:
 	return ret;
 }
 EXPORT_SYMBOL_GPL(do_sync_mapping_range);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/timerfd.c linux-2.6.26.1-cher1/fs/timerfd.c
--- linux-2.6.26.1/fs/timerfd.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/timerfd.c	2008-08-05 13:44:37.000000000 +0400
@@ -184,6 +184,9 @@ asmlinkage long sys_timerfd_create(int c
 	int ufd;
 	struct timerfd_ctx *ctx;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (flags)
 		return -EINVAL;
 	if (clockid != CLOCK_MONOTONIC &&
@@ -213,6 +216,9 @@ asmlinkage long sys_timerfd_settime(int 
 	struct timerfd_ctx *ctx;
 	struct itimerspec ktmr, kotmr;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (copy_from_user(&ktmr, utmr, sizeof(ktmr)))
 		return -EFAULT;
 
@@ -268,6 +274,9 @@ asmlinkage long sys_timerfd_gettime(int 
 	struct timerfd_ctx *ctx;
 	struct itimerspec kotmr;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	file = timerfd_fget(ufd);
 	if (IS_ERR(file))
 		return PTR_ERR(file);
@@ -288,3 +297,8 @@ asmlinkage long sys_timerfd_gettime(int 
 	return copy_to_user(otmr, &kotmr, sizeof(kotmr)) ? -EFAULT: 0;
 }
 
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/utimes.c linux-2.6.26.1-cher1/fs/utimes.c
--- linux-2.6.26.1/fs/utimes.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/utimes.c	2008-08-05 13:44:37.000000000 +0400
@@ -28,6 +28,11 @@ asmlinkage long sys_utime(char __user *f
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (times) {
 		if (get_user(tv[0].tv_sec, &times->actime) ||
 		    get_user(tv[1].tv_sec, &times->modtime))
@@ -171,6 +176,11 @@ asmlinkage long sys_utimensat(int dfd, c
 {
 	struct timespec tstimes[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (utimes) {
 		if (copy_from_user(&tstimes, utimes, sizeof(tstimes)))
 			return -EFAULT;
@@ -189,6 +199,11 @@ asmlinkage long sys_futimesat(int dfd, c
 	struct timeval times[2];
 	struct timespec tstimes[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (utimes) {
 		if (copy_from_user(&times, utimes, sizeof(times)))
 			return -EFAULT;
@@ -215,3 +230,9 @@ asmlinkage long sys_utimes(char __user *
 {
 	return sys_futimesat(AT_FDCWD, filename, utimes);
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/fs/xattr.c linux-2.6.26.1-cher1/fs/xattr.c
--- linux-2.6.26.1/fs/xattr.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/fs/xattr.c	2008-08-05 13:44:37.000000000 +0400
@@ -258,6 +258,11 @@ sys_setxattr(const char __user *path, co
 	struct nameidata nd;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_walk(path, &nd);
 	if (error)
 		return error;
@@ -277,6 +282,11 @@ sys_lsetxattr(const char __user *path, c
 	struct nameidata nd;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_walk_link(path, &nd);
 	if (error)
 		return error;
@@ -297,6 +307,11 @@ sys_fsetxattr(int fd, const char __user 
 	struct dentry *dentry;
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	f = fget(fd);
 	if (!f)
 		return error;
@@ -356,6 +371,11 @@ sys_getxattr(const char __user *path, co
 	struct nameidata nd;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_walk(path, &nd);
 	if (error)
 		return error;
@@ -371,6 +391,11 @@ sys_lgetxattr(const char __user *path, c
 	struct nameidata nd;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_walk_link(path, &nd);
 	if (error)
 		return error;
@@ -385,6 +410,11 @@ sys_fgetxattr(int fd, const char __user 
 	struct file *f;
 	ssize_t error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	f = fget(fd);
 	if (!f)
 		return error;
@@ -430,6 +460,11 @@ sys_listxattr(const char __user *path, c
 	struct nameidata nd;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_walk(path, &nd);
 	if (error)
 		return error;
@@ -444,6 +479,11 @@ sys_llistxattr(const char __user *path, 
 	struct nameidata nd;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_walk_link(path, &nd);
 	if (error)
 		return error;
@@ -458,6 +498,11 @@ sys_flistxattr(int fd, char __user *list
 	struct file *f;
 	ssize_t error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	f = fget(fd);
 	if (!f)
 		return error;
@@ -491,6 +536,11 @@ sys_removexattr(const char __user *path,
 	struct nameidata nd;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_walk(path, &nd);
 	if (error)
 		return error;
@@ -509,6 +559,11 @@ sys_lremovexattr(const char __user *path
 	struct nameidata nd;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_walk_link(path, &nd);
 	if (error)
 		return error;
@@ -528,6 +583,11 @@ sys_fremovexattr(int fd, const char __us
 	struct dentry *dentry;
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	f = fget(fd);
 	if (!f)
 		return error;
@@ -669,3 +729,9 @@ EXPORT_SYMBOL(generic_getxattr);
 EXPORT_SYMBOL(generic_listxattr);
 EXPORT_SYMBOL(generic_setxattr);
 EXPORT_SYMBOL(generic_removexattr);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/include/asm-generic/resource.h linux-2.6.26.1-cher1/include/asm-generic/resource.h
--- linux-2.6.26.1/include/asm-generic/resource.h	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/include/asm-generic/resource.h	2008-08-05 13:44:37.000000000 +0400
@@ -45,7 +45,11 @@
 					   0-39 for nice level 19 .. -20 */
 #define RLIMIT_RTPRIO		14	/* maximum realtime priority */
 #define RLIMIT_RTTIME		15	/* timeout for RT tasks in us */
-#define RLIM_NLIMITS		16
+#define RLIMIT_FUTURE1          16      /* for future use */
+#define RLIMIT_FUTURE2          17      /* for future use */
+#define RLIMIT_FUTURE3          18      /* for future use */
+#define RLIMIT_MCPU             19      /* millisecond cpu limit */
+#define RLIM_NLIMITS		20
 
 /*
  * SuS says limits have to be unsigned.
@@ -87,6 +91,10 @@
 	[RLIMIT_NICE]		= { 0, 0 },				\
 	[RLIMIT_RTPRIO]		= { 0, 0 },				\
 	[RLIMIT_RTTIME]		= {  RLIM_INFINITY,  RLIM_INFINITY },	\
+	[RLIMIT_FUTURE1]        = { 0, 0 },				\
+	[RLIMIT_FUTURE2]        = { 0, 0 },				\
+	[RLIMIT_FUTURE3]        = { 0, 0 },				\
+        [RLIMIT_MCPU]           = {  RLIM_INFINITY,  RLIM_INFINITY },   \
 }
 
 #endif	/* __KERNEL__ */
diff -ruNp linux-2.6.26.1/include/linux/ptrace.h linux-2.6.26.1-cher1/include/linux/ptrace.h
--- linux-2.6.26.1/include/linux/ptrace.h	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/include/linux/ptrace.h	2008-08-05 13:44:37.000000000 +0400
@@ -27,6 +27,9 @@
 #define PTRACE_GETSIGINFO	0x4202
 #define PTRACE_SETSIGINFO	0x4203
 
+#define PTRACE_MEMLIMIT         0x4280
+#define PTRACE_NO_SYSCALLS      0x4281
+
 /* options set using PTRACE_SETOPTIONS */
 #define PTRACE_O_TRACESYSGOOD	0x00000001
 #define PTRACE_O_TRACEFORK	0x00000002
diff -ruNp linux-2.6.26.1/include/linux/sched.h linux-2.6.26.1-cher1/include/linux/sched.h
--- linux-2.6.26.1/include/linux/sched.h	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/include/linux/sched.h	2008-08-05 13:44:37.000000000 +0400
@@ -1023,6 +1023,15 @@ struct sched_rt_entity {
 #endif
 };
 
+/* sandbox flags */
+enum {
+        SBOX_NO_SYSCALLS  = 1,   /* disable most "dangerous" syscalls */
+        SBOX_NO_EXEC      = 2,   /* disable exec syscall */
+        SBOX_MEMLIMITON   = 4,   /* enable memory limit check */
+        SBOX_WAS_MEMLIMIT = 8,   /* memory limit happened  */
+        SBOX_WAS_SECURITY = 16,  /* was security violation */
+};
+
 struct task_struct {
 	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
 	void *stack;
@@ -1303,8 +1312,16 @@ struct task_struct {
 	int latency_record_count;
 	struct latency_record latency_record[LT_SAVECOUNT];
 #endif
+        /* sandbox flags */
+        int sbox_flags;
 };
 
+#define SBOX_IS_RESTRICTED() unlikely(current->sbox_flags & SBOX_NO_SYSCALLS)
+#define SBOX_SET_SECURITY_ERR() (current->sbox_flags |= SBOX_WAS_SECURITY)
+
+#define SBOX_IS_MEMLIMIT_ERR(p) (p->sbox_flags & SBOX_WAS_MEMLIMIT)
+#define SBOX_IS_SECURITY_ERR(p) (p->sbox_flags & SBOX_WAS_SECURITY)
+
 /*
  * Priority of a process goes from 0..MAX_PRIO-1, valid RT
  * priority is 0..MAX_RT_PRIO-1, and SCHED_NORMAL/SCHED_BATCH
diff -ruNp linux-2.6.26.1/ipc/mqueue.c linux-2.6.26.1-cher1/ipc/mqueue.c
--- linux-2.6.26.1/ipc/mqueue.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/ipc/mqueue.c	2008-08-05 13:44:37.000000000 +0400
@@ -666,6 +666,9 @@ asmlinkage long sys_mq_open(const char _
 	char *name;
 	int fd, error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = audit_mq_open(oflag, mode, u_attr);
 	if (error != 0)
 		return error;
@@ -733,6 +736,9 @@ asmlinkage long sys_mq_unlink(const char
 	struct dentry *dentry;
 	struct inode *inode = NULL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	name = getname(u_name);
 	if (IS_ERR(name))
 		return PTR_ERR(name);
@@ -832,6 +838,9 @@ asmlinkage long sys_mq_timedsend(mqd_t m
 	long timeout;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = audit_mq_timedsend(mqdes, msg_len, msg_prio, u_abs_timeout);
 	if (ret != 0)
 		return ret;
@@ -919,6 +928,9 @@ asmlinkage ssize_t sys_mq_timedreceive(m
 	struct mqueue_inode_info *info;
 	struct ext_wait_queue wait;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = audit_mq_timedreceive(mqdes, msg_len, u_msg_prio, u_abs_timeout);
 	if (ret != 0)
 		return ret;
@@ -1003,6 +1015,9 @@ asmlinkage long sys_mq_notify(mqd_t mqde
 	struct mqueue_inode_info *info;
 	struct sk_buff *nc;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = audit_mq_notify(mqdes, u_notification);
 	if (ret != 0)
 		return ret;
@@ -1128,6 +1143,9 @@ asmlinkage long sys_mq_getsetattr(mqd_t 
 	struct inode *inode;
 	struct mqueue_inode_info *info;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (u_mqstat != NULL) {
 		if (copy_from_user(&mqstat, u_mqstat, sizeof(struct mq_attr)))
 			return -EFAULT;
@@ -1294,3 +1312,9 @@ out_sysctl:
 }
 
 __initcall(init_mqueue_fs);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/ipc/msg.c linux-2.6.26.1-cher1/ipc/msg.c
--- linux-2.6.26.1/ipc/msg.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/ipc/msg.c	2008-08-05 13:44:37.000000000 +0400
@@ -315,6 +315,11 @@ asmlinkage long sys_msgget(key_t key, in
 	struct ipc_ops msg_ops;
 	struct ipc_params msg_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	msg_ops.getnew = newque;
@@ -472,6 +477,11 @@ asmlinkage long sys_msgctl(int msqid, in
 	int err, version;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (msqid < 0 || cmd < 0)
 		return -EINVAL;
 
@@ -728,6 +738,11 @@ sys_msgsnd(int msqid, struct msgbuf __us
 {
 	long mtype;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(mtype, &msgp->mtype))
 		return -EFAULT;
 	return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
@@ -909,6 +924,11 @@ asmlinkage long sys_msgrcv(int msqid, st
 {
 	long err, mtype;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err =  do_msgrcv(msqid, &mtype, msgp->mtext, msgsz, msgtyp, msgflg);
 	if (err < 0)
 		goto out;
@@ -942,3 +962,9 @@ static int sysvipc_msg_proc_show(struct 
 			msq->q_ctime);
 }
 #endif
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/ipc/sem.c linux-2.6.26.1-cher1/ipc/sem.c
--- linux-2.6.26.1/ipc/sem.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/ipc/sem.c	2008-08-05 13:44:37.000000000 +0400
@@ -315,6 +315,11 @@ asmlinkage long sys_semget(key_t key, in
 	struct ipc_ops sem_ops;
 	struct ipc_params sem_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	if (nsems < 0 || nsems > ns->sc_semmsl)
@@ -899,6 +904,11 @@ asmlinkage long sys_semctl (int semid, i
 	int version;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (semid < 0)
 		return -EINVAL;
 
@@ -1052,6 +1062,11 @@ asmlinkage long sys_semtimedop(int semid
 	unsigned long jiffies_left = 0;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	if (nsops < 1 || semid < 0)
@@ -1341,3 +1356,9 @@ static int sysvipc_sem_proc_show(struct 
 			  sma->sem_ctime);
 }
 #endif
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/ipc/shm.c linux-2.6.26.1-cher1/ipc/shm.c
--- linux-2.6.26.1/ipc/shm.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/ipc/shm.c	2008-08-05 13:44:37.000000000 +0400
@@ -461,6 +461,11 @@ asmlinkage long sys_shmget (key_t key, s
 	struct ipc_ops shm_ops;
 	struct ipc_params shm_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	shm_ops.getnew = newseg;
@@ -641,6 +646,11 @@ asmlinkage long sys_shmctl(int shmid, in
 	int err, version;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (cmd < 0 || shmid < 0) {
 		err = -EINVAL;
 		goto out;
@@ -960,6 +970,11 @@ asmlinkage long sys_shmat(int shmid, cha
 	unsigned long ret;
 	long err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = do_shmat(shmid, shmaddr, shmflg, &ret);
 	if (err)
 		return err;
@@ -979,6 +994,11 @@ asmlinkage long sys_shmdt(char __user *s
 	loff_t size = 0;
 	int retval = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (addr & ~PAGE_MASK)
 		return retval;
 
@@ -1084,3 +1104,9 @@ static int sysvipc_shm_proc_show(struct 
 			  shp->shm_ctim);
 }
 #endif
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/acct.c linux-2.6.26.1-cher1/kernel/acct.c
--- linux-2.6.26.1/kernel/acct.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/acct.c	2008-08-05 13:44:37.000000000 +0400
@@ -259,6 +259,11 @@ asmlinkage long sys_acct(const char __us
 {
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_PACCT))
 		return -EPERM;
 
@@ -608,3 +613,9 @@ void acct_process(void)
 	fput(file);
 	put_pid_ns(ns);
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/capability.c linux-2.6.26.1-cher1/kernel/capability.c
--- linux-2.6.26.1/kernel/capability.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/capability.c	2008-08-05 13:44:37.000000000 +0400
@@ -159,6 +159,9 @@ asmlinkage long sys_capget(cap_user_head
 	unsigned tocopy;
 	kernel_cap_t pE, pI, pP;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = cap_validate_magic(header, &tocopy);
 	if (ret != 0)
 		return ret;
@@ -317,6 +320,11 @@ asmlinkage long sys_capset(cap_user_head
 	int ret;
 	pid_t pid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ret = cap_validate_magic(header, &tocopy);
 	if (ret != 0)
 		return ret;
@@ -396,3 +404,9 @@ int capable(int cap)
 	return __capable(current, cap);
 }
 EXPORT_SYMBOL(capable);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/compat.c linux-2.6.26.1-cher1/kernel/compat.c
--- linux-2.6.26.1/kernel/compat.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/compat.c	2008-08-05 13:44:37.000000000 +0400
@@ -210,6 +210,9 @@ asmlinkage long compat_sys_sigpending(co
 	long ret;
 	mm_segment_t old_fs = get_fs();
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	set_fs(KERNEL_DS);
 	ret = sys_sigpending((old_sigset_t __user *) &s);
 	set_fs(old_fs);
@@ -225,6 +228,9 @@ asmlinkage long compat_sys_sigprocmask(i
 	long ret;
 	mm_segment_t old_fs;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (set && get_user(s, set))
 		return -EFAULT;
 	old_fs = get_fs();
@@ -441,6 +447,9 @@ asmlinkage long compat_sys_sched_setaffi
 	cpumask_t new_mask;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	retval = compat_get_user_cpu_mask(user_mask_ptr, len, &new_mask);
 	if (retval)
 		return retval;
@@ -456,6 +465,9 @@ asmlinkage long compat_sys_sched_getaffi
 	unsigned long *k;
 	unsigned int min_length = sizeof(cpumask_t);
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (NR_CPUS <= BITS_PER_COMPAT_LONG)
 		min_length = sizeof(compat_ulong_t);
 
@@ -781,6 +793,9 @@ compat_sys_rt_sigtimedwait (compat_sigse
 	siginfo_t info;
 	long ret, timeout = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sigsetsize != sizeof(sigset_t))
 		return -EINVAL;
 
@@ -860,6 +875,11 @@ asmlinkage long compat_sys_stime(compat_
 	struct timespec tv;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(tv.tv_sec, tptr))
 		return -EFAULT;
 
@@ -908,6 +928,11 @@ asmlinkage long compat_sys_adjtimex(stru
 	struct timex txc;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	memset(&txc, 0, sizeof(struct timex));
 
 	if (!access_ok(VERIFY_READ, utp, sizeof(struct compat_timex)) ||
@@ -1039,6 +1064,9 @@ compat_sys_sysinfo(struct compat_sysinfo
 {
 	struct sysinfo s;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	do_sysinfo(&s);
 
 	/* Check to see if any memory value is too large for 32-bit and scale
@@ -1081,3 +1109,9 @@ compat_sys_sysinfo(struct compat_sysinfo
 
 	return 0;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/exec_domain.c linux-2.6.26.1-cher1/kernel/exec_domain.c
--- linux-2.6.26.1/kernel/exec_domain.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/exec_domain.c	2008-08-05 13:44:37.000000000 +0400
@@ -194,6 +194,9 @@ sys_personality(u_long personality)
 {
 	u_long old = current->personality;
 
+        if (SBOX_IS_RESTRICTED())
+                return (long) old;
+
 	if (personality != 0xffffffff) {
 		set_personality(personality);
 		if (current->personality != personality)
@@ -207,3 +210,9 @@ sys_personality(u_long personality)
 EXPORT_SYMBOL(register_exec_domain);
 EXPORT_SYMBOL(unregister_exec_domain);
 EXPORT_SYMBOL(__set_personality);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/exit.c linux-2.6.26.1-cher1/kernel/exit.c
--- linux-2.6.26.1/kernel/exit.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/exit.c	2008-08-05 13:44:37.000000000 +0400
@@ -1244,6 +1244,7 @@ static int wait_task_zombie(struct task_
 	unsigned long state;
 	int retval, status, traced;
 	pid_t pid = task_pid_vnr(p);
+        int status2;
 
 	if (unlikely(noreap)) {
 		uid_t uid = p->uid;
@@ -1338,8 +1339,13 @@ static int wait_task_zombie(struct task_
 	retval = ru ? getrusage(p, RUSAGE_BOTH, ru) : 0;
 	status = (p->signal->flags & SIGNAL_GROUP_EXIT)
 		? p->signal->group_exit_code : p->exit_code;
+        status2 = status;
+        if (SBOX_IS_MEMLIMIT_ERR(p))
+                status2 |= 0x10000;
+        if (SBOX_IS_SECURITY_ERR(p))
+                status2 |= 0x20000;
 	if (!retval && stat_addr)
-		retval = put_user(status, stat_addr);
+		retval = put_user(status2, stat_addr);
 	if (!retval && infop)
 		retval = put_user(SIGCHLD, &infop->si_signo);
 	if (!retval && infop)
@@ -1655,6 +1661,9 @@ asmlinkage long sys_waitid(int which, pi
 	enum pid_type type;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (options & ~(WNOHANG|WNOWAIT|WEXITED|WSTOPPED|WCONTINUED))
 		return -EINVAL;
 	if (!(options & (WEXITED|WSTOPPED|WCONTINUED)))
@@ -1695,6 +1704,9 @@ asmlinkage long sys_wait4(pid_t upid, in
 	enum pid_type type;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (options & ~(WNOHANG|WUNTRACED|WCONTINUED|
 			__WNOTHREAD|__WCLONE|__WALL))
 		return -EINVAL;
@@ -1732,3 +1744,9 @@ asmlinkage long sys_waitpid(pid_t pid, i
 }
 
 #endif
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/fork.c linux-2.6.26.1-cher1/kernel/fork.c
--- linux-2.6.26.1/kernel/fork.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/fork.c	2008-08-05 13:44:37.000000000 +0400
@@ -795,7 +795,10 @@ static int copy_signal(unsigned long clo
 	memcpy(sig->rlim, current->signal->rlim, sizeof sig->rlim);
 	task_unlock(current->group_leader);
 
-	if (sig->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
+	if (sig->rlim[RLIMIT_MCPU].rlim_cur != RLIM_INFINITY) {
+                tsk->it_prof_expires =
+                        msecs_to_cputime(sig->rlim[RLIMIT_MCPU].rlim_cur);
+	} else if (sig->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
 		/*
 		 * New sole thread in the process gets an expiry time
 		 * of the whole CPU time limit.
@@ -1185,6 +1188,7 @@ static struct task_struct *copy_process(
 		    !cputime_eq(current->signal->it_prof_expires,
 				cputime_zero) ||
 		    current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY ||
+		    current->signal->rlim[RLIMIT_MCPU].rlim_cur != RLIM_INFINITY ||
 		    !list_empty(&current->signal->cpu_timers[0]) ||
 		    !list_empty(&current->signal->cpu_timers[1]) ||
 		    !list_empty(&current->signal->cpu_timers[2])) {
@@ -1324,6 +1328,11 @@ long do_fork(unsigned long clone_flags,
 	int trace = 0;
 	long nr;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/*
 	 * We hope to recycle these flags after 2.6.26
 	 */
@@ -1560,6 +1569,9 @@ asmlinkage long sys_unshare(unsigned lon
 	struct nsproxy *new_nsproxy = NULL;
 	int do_sysvsem = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	check_unshare_flags(&unshare_flags);
 
 	/* Return -EINVAL for all unsupported flags */
@@ -1678,3 +1690,9 @@ int unshare_files(struct files_struct **
 	task_unlock(task);
 	return 0;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/kexec.c linux-2.6.26.1-cher1/kernel/kexec.c
--- linux-2.6.26.1/kernel/kexec.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/kexec.c	2008-08-05 13:44:37.000000000 +0400
@@ -929,6 +929,11 @@ asmlinkage long sys_kexec_load(unsigned 
 	int locked;
 	int result;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* We only trust the superuser with rebooting the system. */
 	if (!capable(CAP_SYS_BOOT))
 		return -EPERM;
@@ -1415,3 +1420,9 @@ static int __init crash_save_vmcoreinfo_
 }
 
 module_init(crash_save_vmcoreinfo_init)
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/module.c linux-2.6.26.1-cher1/kernel/module.c
--- linux-2.6.26.1/kernel/module.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/module.c	2008-08-05 13:44:37.000000000 +0400
@@ -692,6 +692,11 @@ sys_delete_module(const char __user *nam
 	char name[MODULE_NAME_LEN];
 	int ret, forced = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_MODULE))
 		return -EPERM;
 
@@ -2197,6 +2202,11 @@ sys_init_module(void __user *umod,
 	struct module *mod;
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Must have permission */
 	if (!capable(CAP_SYS_MODULE))
 		return -EPERM;
@@ -2646,3 +2656,9 @@ void module_update_markers(void)
 	mutex_unlock(&module_mutex);
 }
 #endif
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/posix-cpu-timers.c linux-2.6.26.1-cher1/kernel/posix-cpu-timers.c
--- linux-2.6.26.1/kernel/posix-cpu-timers.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/posix-cpu-timers.c	2008-08-05 13:44:37.000000000 +0400
@@ -648,6 +648,12 @@ static void arm_timer(struct k_itimer *t
 				    cputime_lt(p->signal->it_prof_expires,
 					       timer->it.cpu.expires.cpu))
 					break;
+				i = p->signal->rlim[RLIMIT_MCPU].rlim_cur;
+				if (i != RLIM_INFINITY) {
+                                        if (i <= cputime_to_msecs(timer->it.cpu.expires.cpu))
+                                                break;
+                                        goto rebalance;
+                                }
 				i = p->signal->rlim[RLIMIT_CPU].rlim_cur;
 				if (i != RLIM_INFINITY &&
 				    i <= cputime_to_secs(timer->it.cpu.expires.cpu))
@@ -1062,6 +1068,7 @@ static void check_process_timers(struct 
 	 */
 	if (list_empty(&timers[CPUCLOCK_PROF]) &&
 	    cputime_eq(sig->it_prof_expires, cputime_zero) &&
+	    sig->rlim[RLIMIT_MCPU].rlim_cur == RLIM_INFINITY &&
 	    sig->rlim[RLIMIT_CPU].rlim_cur == RLIM_INFINITY &&
 	    list_empty(&timers[CPUCLOCK_VIRT]) &&
 	    cputime_eq(sig->it_virt_expires, cputime_zero) &&
@@ -1162,6 +1169,33 @@ static void check_process_timers(struct 
 			virt_expires = sig->it_virt_expires;
 		}
 	}
+	if (sig->rlim[RLIMIT_MCPU].rlim_cur != RLIM_INFINITY) {
+		unsigned long psecs = cputime_to_msecs(ptime);
+		cputime_t x;
+		if (psecs >= sig->rlim[RLIMIT_MCPU].rlim_max) {
+			/*
+			 * At the hard limit, we just die.
+			 * No need to calculate anything else now.
+			 */
+			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
+			return;
+		}
+		if (psecs >= sig->rlim[RLIMIT_MCPU].rlim_cur) {
+			/*
+			 * At the soft limit, send a SIGXCPU every second.
+			 */
+			__group_send_sig_info(SIGXCPU, SEND_SIG_PRIV, tsk);
+			if (sig->rlim[RLIMIT_MCPU].rlim_cur
+			    < sig->rlim[RLIMIT_MCPU].rlim_max) {
+				sig->rlim[RLIMIT_MCPU].rlim_cur++;
+			}
+		}
+		x = msecs_to_cputime(sig->rlim[RLIMIT_MCPU].rlim_cur);
+		if (cputime_eq(prof_expires, cputime_zero) ||
+		    cputime_lt(x, prof_expires)) {
+			prof_expires = x;
+		}
+	}
 	if (sig->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
 		unsigned long psecs = cputime_to_secs(ptime);
 		cputime_t x;
@@ -1418,6 +1452,9 @@ void set_process_cpu_timer(struct task_s
 		 * If the RLIMIT_CPU timer will expire before the
 		 * ITIMER_PROF timer, we have nothing else to do.
 		 */
+		if (tsk->signal->rlim[RLIMIT_MCPU].rlim_cur
+		    < cputime_to_msecs(*newval))
+			return;
 		if (tsk->signal->rlim[RLIMIT_CPU].rlim_cur
 		    < cputime_to_secs(*newval))
 			return;
@@ -1656,3 +1693,9 @@ static __init int init_posix_cpu_timers(
 	return 0;
 }
 __initcall(init_posix_cpu_timers);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/posix-timers.c linux-2.6.26.1-cher1/kernel/posix-timers.c
--- linux-2.6.26.1/kernel/posix-timers.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/posix-timers.c	2008-08-05 13:44:37.000000000 +0400
@@ -470,6 +470,9 @@ sys_timer_create(const clockid_t which_c
 	sigevent_t event;
 	int it_id_set = IT_ID_NOT_SET;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (invalid_clockid(which_clock))
 		return -EINVAL;
 
@@ -683,6 +686,9 @@ sys_timer_gettime(timer_t timer_id, stru
 	struct itimerspec cur_setting;
 	unsigned long flags;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	timr = lock_timer(timer_id, &flags);
 	if (!timr)
 		return -EINVAL;
@@ -713,6 +719,9 @@ sys_timer_getoverrun(timer_t timer_id)
 	int overrun;
 	unsigned long flags;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	timr = lock_timer(timer_id, &flags);
 	if (!timr)
 		return -EINVAL;
@@ -788,6 +797,9 @@ sys_timer_settime(timer_t timer_id, int 
 	unsigned long flag;
 	struct itimerspec *rtn = old_setting ? &old_spec : NULL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!new_setting)
 		return -EINVAL;
 
@@ -839,6 +851,9 @@ sys_timer_delete(timer_t timer_id)
 	struct k_itimer *timer;
 	unsigned long flags;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 retry_delete:
 	timer = lock_timer(timer_id, &flags);
 	if (!timer)
@@ -931,6 +946,9 @@ asmlinkage long sys_clock_settime(const 
 {
 	struct timespec new_tp;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (invalid_clockid(which_clock))
 		return -EINVAL;
 	if (copy_from_user(&new_tp, tp, sizeof (*tp)))
@@ -945,6 +963,9 @@ sys_clock_gettime(const clockid_t which_
 	struct timespec kernel_tp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (invalid_clockid(which_clock))
 		return -EINVAL;
 	error = CLOCK_DISPATCH(which_clock, clock_get,
@@ -962,6 +983,9 @@ sys_clock_getres(const clockid_t which_c
 	struct timespec rtn_tp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (invalid_clockid(which_clock))
 		return -EINVAL;
 
@@ -993,6 +1017,9 @@ sys_clock_nanosleep(const clockid_t whic
 {
 	struct timespec t;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (invalid_clockid(which_clock))
 		return -EINVAL;
 
@@ -1026,3 +1053,9 @@ clock_nanosleep_restart(struct restart_b
 	return CLOCK_DISPATCH(which_clock, nsleep_restart,
 			      (restart_block));
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/printk.c linux-2.6.26.1-cher1/kernel/printk.c
--- linux-2.6.26.1/kernel/printk.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/printk.c	2008-08-05 13:44:37.000000000 +0400
@@ -432,6 +432,9 @@ out:
 
 asmlinkage long sys_syslog(int type, char __user *buf, int len)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_syslog(type, buf, len);
 }
 
@@ -1366,3 +1369,9 @@ bool printk_timed_ratelimit(unsigned lon
 }
 EXPORT_SYMBOL(printk_timed_ratelimit);
 #endif
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/ptrace.c linux-2.6.26.1-cher1/kernel/ptrace.c
--- linux-2.6.26.1/kernel/ptrace.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/ptrace.c	2008-08-05 13:44:37.000000000 +0400
@@ -539,6 +539,20 @@ asmlinkage long sys_ptrace(long request,
 	struct task_struct *child;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+        if (request == PTRACE_MEMLIMIT) {
+                current->sbox_flags |= SBOX_MEMLIMITON;
+                return 0;
+        }
+        if (request == PTRACE_NO_SYSCALLS) {
+                current->sbox_flags |= SBOX_NO_SYSCALLS;
+                return 0;
+        }
+
 	/*
 	 * This lock_kernel fixes a subtle race with suid exec
 	 */
@@ -662,6 +676,20 @@ asmlinkage long compat_sys_ptrace(compat
 	struct task_struct *child;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+        if (request == PTRACE_MEMLIMIT) {
+                current->sbox_flags |= SBOX_MEMLIMITON;
+                return 0;
+        }
+        if (request == PTRACE_NO_SYSCALLS) {
+                current->sbox_flags |= SBOX_NO_SYSCALLS;
+                return 0;
+        }
+
 	/*
 	 * This lock_kernel fixes a subtle race with suid exec
 	 */
@@ -699,3 +727,9 @@ asmlinkage long compat_sys_ptrace(compat
 	return ret;
 }
 #endif	/* CONFIG_COMPAT && __ARCH_WANT_COMPAT_SYS_PTRACE */
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/sched.c linux-2.6.26.1-cher1/kernel/sched.c
--- linux-2.6.26.1/kernel/sched.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/sched.c	2008-08-05 13:44:37.000000000 +0400
@@ -4639,6 +4639,11 @@ asmlinkage long sys_nice(int increment)
 {
 	long nice, retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/*
 	 * Setpriority might change our priority at the same moment.
 	 * We don't have to worry. Conceptually one call occurs first
@@ -4903,6 +4908,9 @@ do_sched_setscheduler(pid_t pid, int pol
 asmlinkage long
 sys_sched_setscheduler(pid_t pid, int policy, struct sched_param __user *param)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* negative values for policy are not valid */
 	if (policy < 0)
 		return -EINVAL;
@@ -4917,6 +4925,9 @@ sys_sched_setscheduler(pid_t pid, int po
  */
 asmlinkage long sys_sched_setparam(pid_t pid, struct sched_param __user *param)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_sched_setscheduler(pid, -1, param);
 }
 
@@ -4929,6 +4940,9 @@ asmlinkage long sys_sched_getscheduler(p
 	struct task_struct *p;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pid < 0)
 		return -EINVAL;
 
@@ -4955,6 +4969,9 @@ asmlinkage long sys_sched_getparam(pid_t
 	struct task_struct *p;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!param || pid < 0)
 		return -EINVAL;
 
@@ -5063,6 +5080,9 @@ asmlinkage long sys_sched_setaffinity(pi
 	cpumask_t new_mask;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	retval = get_user_cpu_mask(user_mask_ptr, len, &new_mask);
 	if (retval)
 		return retval;
@@ -5126,6 +5146,9 @@ asmlinkage long sys_sched_getaffinity(pi
 	int ret;
 	cpumask_t mask;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (len < sizeof(cpumask_t))
 		return -EINVAL;
 
@@ -8867,3 +8890,9 @@ struct cgroup_subsys cpuacct_subsys = {
 	.subsys_id = cpuacct_subsys_id,
 };
 #endif	/* CONFIG_CGROUP_CPUACCT */
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/signal.c linux-2.6.26.1-cher1/kernel/signal.c
--- linux-2.6.26.1/kernel/signal.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/signal.c	2008-08-05 13:44:37.000000000 +0400
@@ -1129,6 +1129,14 @@ static int kill_something_info(int sig, 
 {
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                if (!pid) pid = current->pid;
+                if (pid != current->pid) {
+                        SBOX_SET_SECURITY_ERR();
+                        return -EPERM;
+                }
+        }
+
 	if (pid > 0) {
 		rcu_read_lock();
 		ret = kill_pid_info(sig, info, find_vpid(pid));
@@ -1992,6 +2000,9 @@ sys_rt_sigprocmask(int how, sigset_t __u
 	int error = -EINVAL;
 	sigset_t old_set, new_set;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		goto out;
@@ -2049,6 +2060,9 @@ out:
 asmlinkage long
 sys_rt_sigpending(sigset_t __user *set, size_t sigsetsize)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_sigpending(set, sigsetsize);
 }
 
@@ -2130,6 +2144,9 @@ sys_rt_sigtimedwait(const sigset_t __use
 	siginfo_t info;
 	long timeout = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		return -EINVAL;
@@ -2257,6 +2274,9 @@ static int do_tkill(int tgid, int pid, i
  */
 asmlinkage long sys_tgkill(int tgid, int pid, int sig)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* This is only valid for single tasks */
 	if (pid <= 0 || tgid <= 0)
 		return -EINVAL;
@@ -2270,6 +2290,9 @@ asmlinkage long sys_tgkill(int tgid, int
 asmlinkage long
 sys_tkill(int pid, int sig)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* This is only valid for single tasks */
 	if (pid <= 0)
 		return -EINVAL;
@@ -2282,6 +2305,9 @@ sys_rt_sigqueueinfo(int pid, int sig, si
 {
 	siginfo_t info;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (copy_from_user(&info, uinfo, sizeof(siginfo_t)))
 		return -EFAULT;
 
@@ -2409,6 +2435,9 @@ out:
 asmlinkage long
 sys_sigpending(old_sigset_t __user *set)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_sigpending(set, sizeof(*set));
 }
 
@@ -2424,6 +2453,9 @@ sys_sigprocmask(int how, old_sigset_t __
 	int error;
 	old_sigset_t old_set, new_set;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (set) {
 		error = -EFAULT;
 		if (copy_from_user(&new_set, set, sizeof(*set)))
@@ -2515,6 +2547,9 @@ sys_ssetmask(int newmask)
 {
 	int old;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	spin_lock_irq(&current->sighand->siglock);
 	old = current->blocked.sig[0];
 
@@ -2552,6 +2587,9 @@ sys_signal(int sig, __sighandler_t handl
 asmlinkage long
 sys_pause(void)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	current->state = TASK_INTERRUPTIBLE;
 	schedule();
 	return -ERESTARTNOHAND;
@@ -2564,6 +2602,9 @@ asmlinkage long sys_rt_sigsuspend(sigset
 {
 	sigset_t newset;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		return -EINVAL;
@@ -2594,3 +2635,9 @@ void __init signals_init(void)
 {
 	sigqueue_cachep = KMEM_CACHE(sigqueue, SLAB_PANIC);
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/sys.c linux-2.6.26.1-cher1/kernel/sys.c
--- linux-2.6.26.1/kernel/sys.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/sys.c	2008-08-05 13:44:37.000000000 +0400
@@ -144,6 +144,9 @@ asmlinkage long sys_setpriority(int whic
 	int error = -EINVAL;
 	struct pid *pgrp;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (which > PRIO_USER || which < PRIO_PROCESS)
 		goto out;
 
@@ -208,6 +211,9 @@ asmlinkage long sys_getpriority(int whic
 	long niceval, retval = -ESRCH;
 	struct pid *pgrp;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (which > PRIO_USER || which < PRIO_PROCESS)
 		return -EINVAL;
 
@@ -371,6 +377,11 @@ asmlinkage long sys_reboot(int magic1, i
 {
 	char buffer[256];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* We only trust the superuser with rebooting the system. */
 	if (!capable(CAP_SYS_BOOT))
 		return -EPERM;
@@ -493,6 +504,11 @@ asmlinkage long sys_setregid(gid_t rgid,
 	int new_egid = old_egid;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	retval = security_task_setgid(rgid, egid, (gid_t)-1, LSM_SETID_RE);
 	if (retval)
 		return retval;
@@ -539,6 +555,11 @@ asmlinkage long sys_setgid(gid_t gid)
 	int old_egid = current->egid;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	retval = security_task_setgid(gid, (gid_t)-1, (gid_t)-1, LSM_SETID_ID);
 	if (retval)
 		return retval;
@@ -609,6 +630,11 @@ asmlinkage long sys_setreuid(uid_t ruid,
 	int old_ruid, old_euid, old_suid, new_ruid, new_euid;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	retval = security_task_setuid(ruid, euid, (uid_t)-1, LSM_SETID_RE);
 	if (retval)
 		return retval;
@@ -672,6 +698,11 @@ asmlinkage long sys_setuid(uid_t uid)
 	int old_ruid, old_suid, new_suid;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	retval = security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_ID);
 	if (retval)
 		return retval;
@@ -712,6 +743,11 @@ asmlinkage long sys_setresuid(uid_t ruid
 	int old_suid = current->suid;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	retval = security_task_setuid(ruid, euid, suid, LSM_SETID_RES);
 	if (retval)
 		return retval;
@@ -766,6 +802,11 @@ asmlinkage long sys_setresgid(gid_t rgid
 {
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	retval = security_task_setgid(rgid, egid, sgid, LSM_SETID_RES);
 	if (retval)
 		return retval;
@@ -821,6 +862,11 @@ asmlinkage long sys_setfsuid(uid_t uid)
 {
 	int old_fsuid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	old_fsuid = current->fsuid;
 	if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS))
 		return old_fsuid;
@@ -850,6 +896,11 @@ asmlinkage long sys_setfsgid(gid_t gid)
 {
 	int old_fsgid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	old_fsgid = current->fsgid;
 	if (security_task_setgid(gid, (gid_t)-1, (gid_t)-1, LSM_SETID_FS))
 		return old_fsgid;
@@ -925,6 +976,9 @@ asmlinkage long sys_setpgid(pid_t pid, p
 	struct pid *pgrp;
 	int err;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!pid)
 		pid = task_pid_vnr(group_leader);
 	if (!pgid)
@@ -995,6 +1049,9 @@ asmlinkage long sys_getpgid(pid_t pid)
 	struct pid *grp;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED() && pid != current->pid)
+                return -EPERM;
+
 	rcu_read_lock();
 	if (!pid)
 		grp = task_pgrp(current);
@@ -1036,6 +1093,11 @@ asmlinkage long sys_getsid(pid_t pid)
 	if (!pid)
 		sid = task_session(current);
 	else {
+                if (SBOX_IS_RESTRICTED() && pid != current->pid) {
+                        retval = -EPERM;
+                        goto out;
+                }
+
 		retval = -ESRCH;
 		p = find_task_by_vpid(pid);
 		if (!p)
@@ -1061,6 +1123,11 @@ asmlinkage long sys_setsid(void)
 	pid_t session = pid_vnr(sid);
 	int err = -EPERM;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	write_lock_irq(&tasklist_lock);
 	/* Fail if I am already a session leader */
 	if (group_leader->signal->leader)
@@ -1298,6 +1365,11 @@ asmlinkage long sys_setgroups(int gidset
 	struct group_info *group_info;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SETGID))
 		return -EPERM;
 	if ((unsigned)gidsetsize > NGROUPS_MAX)
@@ -1361,6 +1433,11 @@ asmlinkage long sys_sethostname(char __u
 	int errno;
 	char tmp[__NEW_UTS_LEN];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 	if (len < 0 || len > __NEW_UTS_LEN)
@@ -1406,6 +1483,11 @@ asmlinkage long sys_setdomainname(char _
 	int errno;
 	char tmp[__NEW_UTS_LEN];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 	if (len < 0 || len > __NEW_UTS_LEN)
@@ -1463,8 +1545,12 @@ asmlinkage long sys_setrlimit(unsigned i
 {
 	struct rlimit new_rlim, *old_rlim;
 	unsigned long it_prof_secs;
+        unsigned long it_prof_msecs;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (resource >= RLIM_NLIMITS)
 		return -EINVAL;
 	if (copy_from_user(&new_rlim, rlim, sizeof(*rlim)))
@@ -1491,11 +1577,35 @@ asmlinkage long sys_setrlimit(unsigned i
 		 */
 		new_rlim.rlim_cur = 1;
 	}
+        if (resource == RLIMIT_MCPU && new_rlim.rlim_cur == 0) {
+                new_rlim.rlim_cur = 1;
+        }
 
 	task_lock(current->group_leader);
 	*old_rlim = new_rlim;
 	task_unlock(current->group_leader);
 
+        if (resource == RLIMIT_MCPU) {
+                if (new_rlim.rlim_cur == RLIM_INFINITY)
+                        goto out;
+
+                it_prof_msecs = cputime_to_msecs(current->signal->it_prof_expires);
+                if (it_prof_msecs == 0 || new_rlim.rlim_cur <= it_prof_msecs) {
+                        unsigned long rlim_cur = new_rlim.rlim_cur;
+                        cputime_t cputime;
+
+                        cputime = msecs_to_cputime(rlim_cur);
+                        read_lock(&tasklist_lock);
+                        spin_lock_irq(&current->sighand->siglock);
+                        set_process_cpu_timer(current, CPUCLOCK_PROF, &cputime,
+                                              NULL);
+                        spin_unlock_irq(&current->sighand->siglock);
+                        read_unlock(&tasklist_lock);
+                }
+
+                goto out;
+        }
+
 	if (resource != RLIMIT_CPU)
 		goto out;
 
@@ -1645,6 +1755,9 @@ asmlinkage long sys_getrusage(int who, s
 
 asmlinkage long sys_umask(int mask)
 {
+        if (SBOX_IS_RESTRICTED())
+                return current->fs->umask;
+
 	mask = xchg(&current->fs->umask, mask & S_IRWXUGO);
 	return mask;
 }
@@ -1654,6 +1767,9 @@ asmlinkage long sys_prctl(int option, un
 {
 	long error = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (security_task_prctl(option, arg2, arg3, arg4, arg5, &error))
 		return error;
 
@@ -1820,3 +1936,9 @@ int orderly_poweroff(bool force)
 	return ret;
 }
 EXPORT_SYMBOL_GPL(orderly_poweroff);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/sysctl.c linux-2.6.26.1-cher1/kernel/sysctl.c
--- linux-2.6.26.1/kernel/sysctl.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/sysctl.c	2008-08-05 13:44:37.000000000 +0400
@@ -1538,6 +1538,11 @@ asmlinkage long sys_sysctl(struct __sysc
 	struct __sysctl_args tmp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_from_user(&tmp, args, sizeof(tmp)))
 		return -EFAULT;
 
@@ -2849,3 +2854,9 @@ EXPORT_SYMBOL(sysctl_ms_jiffies);
 EXPORT_SYMBOL(sysctl_string);
 EXPORT_SYMBOL(sysctl_data);
 EXPORT_SYMBOL(unregister_sysctl_table);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/time.c linux-2.6.26.1-cher1/kernel/time.c
--- linux-2.6.26.1/kernel/time.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/time.c	2008-08-05 13:44:37.000000000 +0400
@@ -82,6 +82,11 @@ asmlinkage long sys_stime(time_t __user 
 	struct timespec tv;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(tv.tv_sec, tptr))
 		return -EFAULT;
 
@@ -189,6 +194,11 @@ asmlinkage long sys_settimeofday(struct 
 	struct timespec	new_ts;
 	struct timezone new_tz;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (tv) {
 		if (copy_from_user(&user_tv, tv, sizeof(*tv)))
 			return -EFAULT;
@@ -208,6 +218,11 @@ asmlinkage long sys_adjtimex(struct time
 	struct timex txc;		/* Local copy of parameter */
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Copy the user data space into the kernel copy
 	 * structure. But bear in mind that the structures
 	 * may change
@@ -669,3 +684,9 @@ EXPORT_SYMBOL(get_jiffies_64);
 #endif
 
 EXPORT_SYMBOL(jiffies);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/timer.c linux-2.6.26.1-cher1/kernel/timer.c
--- linux-2.6.26.1/kernel/timer.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/timer.c	2008-08-05 13:44:37.000000000 +0400
@@ -1357,6 +1357,9 @@ asmlinkage long sys_sysinfo(struct sysin
 {
 	struct sysinfo val;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	do_sysinfo(&val);
 
 	if (copy_to_user(info, &val, sizeof(struct sysinfo)))
@@ -1533,3 +1536,9 @@ unsigned long msleep_interruptible(unsig
 }
 
 EXPORT_SYMBOL(msleep_interruptible);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/kernel/uid16.c linux-2.6.26.1-cher1/kernel/uid16.c
--- linux-2.6.26.1/kernel/uid16.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/kernel/uid16.c	2008-08-05 13:44:37.000000000 +0400
@@ -188,6 +188,11 @@ asmlinkage long sys_setgroups16(int gids
 	struct group_info *group_info;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SETGID))
 		return -EPERM;
 	if ((unsigned)gidsetsize > NGROUPS_MAX)
diff -ruNp linux-2.6.26.1/Makefile linux-2.6.26.1-cher1/Makefile
--- linux-2.6.26.1/Makefile	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/Makefile	2008-08-05 13:44:53.000000000 +0400
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 26
-EXTRAVERSION = .1
+EXTRAVERSION = .1-cher1
 NAME = Rotary Wombat
 
 # *DOCUMENTATION*
diff -ruNp linux-2.6.26.1/mm/fadvise.c linux-2.6.26.1-cher1/mm/fadvise.c
--- linux-2.6.26.1/mm/fadvise.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/mm/fadvise.c	2008-08-05 13:44:37.000000000 +0400
@@ -35,6 +35,11 @@ asmlinkage long sys_fadvise64_64(int fd,
 	unsigned long nrpages;
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                ret = -EPERM;
+                goto out;
+        }
+
 	if (!file)
 		return -EBADF;
 
@@ -135,3 +140,9 @@ asmlinkage long sys_fadvise64(int fd, lo
 }
 
 #endif
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/mm/filemap.c linux-2.6.26.1-cher1/mm/filemap.c
--- linux-2.6.26.1/mm/filemap.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/mm/filemap.c	2008-08-05 13:44:37.000000000 +0400
@@ -1258,6 +1258,9 @@ asmlinkage ssize_t sys_readahead(int fd,
 	ssize_t ret;
 	struct file *file;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = -EBADF;
 	file = fget(fd);
 	if (file) {
@@ -2599,3 +2602,9 @@ int try_to_release_page(struct page *pag
 }
 
 EXPORT_SYMBOL(try_to_release_page);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/mm/madvise.c linux-2.6.26.1-cher1/mm/madvise.c
--- linux-2.6.26.1/mm/madvise.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/mm/madvise.c	2008-08-05 13:44:37.000000000 +0400
@@ -290,6 +290,9 @@ asmlinkage long sys_madvise(unsigned lon
 	int write;
 	size_t len;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	write = madvise_need_mmap_write(behavior);
 	if (write)
 		down_write(&current->mm->mmap_sem);
@@ -363,3 +366,9 @@ out:
 
 	return error;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/mm/mempolicy.c linux-2.6.26.1-cher1/mm/mempolicy.c
--- linux-2.6.26.1/mm/mempolicy.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/mm/mempolicy.c	2008-08-05 13:44:37.000000000 +0400
@@ -1069,6 +1069,9 @@ asmlinkage long sys_mbind(unsigned long 
 	int err;
 	unsigned short mode_flags;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	mode_flags = mode & MPOL_MODE_FLAGS;
 	mode &= ~MPOL_MODE_FLAGS;
 	if (mode >= MPOL_MAX)
@@ -1090,6 +1093,9 @@ asmlinkage long sys_set_mempolicy(int mo
 	nodemask_t nodes;
 	unsigned short flags;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	flags = mode & MPOL_MODE_FLAGS;
 	mode &= ~MPOL_MODE_FLAGS;
 	if ((unsigned int)mode >= MPOL_MAX)
@@ -1113,6 +1119,9 @@ asmlinkage long sys_migrate_pages(pid_t 
 	nodemask_t task_nodes;
 	int err;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	err = get_nodes(&old, old_nodes, maxnode);
 	if (err)
 		return err;
@@ -1181,6 +1190,9 @@ asmlinkage long sys_get_mempolicy(int __
 	int uninitialized_var(pval);
 	nodemask_t nodes;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (nmask != NULL && maxnode < MAX_NUMNODES)
 		return -EINVAL;
 
@@ -1210,6 +1222,9 @@ asmlinkage long compat_sys_get_mempolicy
 	unsigned long nr_bits, alloc_size;
 	DECLARE_BITMAP(bm, MAX_NUMNODES);
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
@@ -1236,6 +1251,9 @@ asmlinkage long compat_sys_set_mempolicy
 	unsigned long nr_bits, alloc_size;
 	DECLARE_BITMAP(bm, MAX_NUMNODES);
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
@@ -1260,6 +1278,9 @@ asmlinkage long compat_sys_mbind(compat_
 	unsigned long nr_bits, alloc_size;
 	nodemask_t bm;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
@@ -2327,3 +2348,9 @@ out:
 		m->version = (vma != priv->tail_vma) ? vma->vm_start : 0;
 	return 0;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/mm/migrate.c linux-2.6.26.1-cher1/mm/migrate.c
--- linux-2.6.26.1/mm/migrate.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/mm/migrate.c	2008-08-05 13:44:37.000000000 +0400
@@ -968,6 +968,11 @@ asmlinkage long sys_move_pages(pid_t pid
 	struct mm_struct *mm;
 	struct page_to_node *pm = NULL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Check flags */
 	if (flags & ~(MPOL_MF_MOVE|MPOL_MF_MOVE_ALL))
 		return -EINVAL;
@@ -1092,3 +1097,9 @@ int migrate_vmas(struct mm_struct *mm, c
  	}
  	return err;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/mm/mincore.c linux-2.6.26.1-cher1/mm/mincore.c
--- linux-2.6.26.1/mm/mincore.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/mm/mincore.c	2008-08-05 13:44:37.000000000 +0400
@@ -184,6 +184,9 @@ asmlinkage long sys_mincore(unsigned lon
 	unsigned long pages;
 	unsigned char *tmp;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the start address: needs to be page-aligned.. */
  	if (start & ~PAGE_CACHE_MASK)
 		return -EINVAL;
@@ -227,3 +230,9 @@ asmlinkage long sys_mincore(unsigned lon
 	free_page((unsigned long) tmp);
 	return retval;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/mm/mlock.c linux-2.6.26.1-cher1/mm/mlock.c
--- linux-2.6.26.1/mm/mlock.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/mm/mlock.c	2008-08-05 13:44:37.000000000 +0400
@@ -138,6 +138,11 @@ asmlinkage long sys_mlock(unsigned long 
 	unsigned long lock_limit;
 	int error = -ENOMEM;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!can_do_mlock())
 		return -EPERM;
 
@@ -162,6 +167,11 @@ asmlinkage long sys_munlock(unsigned lon
 {
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	down_write(&current->mm->mmap_sem);
 	len = PAGE_ALIGN(len + (start & ~PAGE_MASK));
 	start &= PAGE_MASK;
@@ -200,6 +210,11 @@ asmlinkage long sys_mlockall(int flags)
 	unsigned long lock_limit;
 	int ret = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!flags || (flags & ~(MCL_CURRENT | MCL_FUTURE)))
 		goto out;
 
@@ -225,6 +240,11 @@ asmlinkage long sys_munlockall(void)
 {
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	down_write(&current->mm->mmap_sem);
 	ret = do_mlockall(0);
 	up_write(&current->mm->mmap_sem);
@@ -266,3 +286,9 @@ void user_shm_unlock(size_t size, struct
 	spin_unlock(&shmlock_user_lock);
 	free_uid(user);
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/mm/mmap.c linux-2.6.26.1-cher1/mm/mmap.c
--- linux-2.6.26.1/mm/mmap.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/mm/mmap.c	2008-08-05 13:44:37.000000000 +0400
@@ -264,9 +264,14 @@ asmlinkage unsigned long sys_brk(unsigne
 	 * not page aligned -Ram Gupta
 	 */
 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
-	if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
-			(mm->end_data - mm->start_data) > rlim)
+	if (rlim < RLIM_INFINITY
+            && (brk - mm->start_brk) + (mm->end_data - mm->start_data) > rlim) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                        send_sig(SIGKILL, current, 0);
+                }
 		goto out;
+        }
 
 	newbrk = PAGE_ALIGN(brk);
 	oldbrk = PAGE_ALIGN(mm->brk);
@@ -1535,8 +1540,13 @@ static int acct_stack_growth(struct vm_a
 		return -ENOMEM;
 
 	/* Stack limit test */
-	if (size > rlim[RLIMIT_STACK].rlim_cur)
+	if (size > rlim[RLIMIT_STACK].rlim_cur) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                        send_sig(SIGKILL, current, 0);
+                }
 		return -ENOMEM;
+        }
 
 	/* mlock limit tests */
 	if (vma->vm_flags & VM_LOCKED) {
@@ -2178,8 +2188,13 @@ int may_expand_vm(struct mm_struct *mm, 
 
 	lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
 
-	if (cur + npages > lim)
+	if (cur + npages > lim) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                        send_sig(SIGKILL, current, 0);
+                }
 		return 0;
+        }
 	return 1;
 }
 
@@ -2261,3 +2276,9 @@ int install_special_mapping(struct mm_st
 
 	return 0;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/mm/mprotect.c linux-2.6.26.1-cher1/mm/mprotect.c
--- linux-2.6.26.1/mm/mprotect.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/mm/mprotect.c	2008-08-05 13:44:37.000000000 +0400
@@ -231,6 +231,11 @@ sys_mprotect(unsigned long start, size_t
 	if (grows == (PROT_GROWSDOWN|PROT_GROWSUP)) /* can't be both */
 		return -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (start & ~PAGE_MASK)
 		return -EINVAL;
 	if (!len)
@@ -318,3 +323,9 @@ out:
 	up_write(&current->mm->mmap_sem);
 	return error;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/mm/swapfile.c linux-2.6.26.1-cher1/mm/swapfile.c
--- linux-2.6.26.1/mm/swapfile.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/mm/swapfile.c	2008-08-05 13:44:37.000000000 +0400
@@ -1214,6 +1214,11 @@ asmlinkage long sys_swapoff(const char _
 	int i, type, prev;
 	int err;
 	
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
@@ -1460,6 +1465,11 @@ asmlinkage long sys_swapon(const char __
 	struct inode *inode = NULL;
 	int did_down = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 	spin_lock(&swap_lock);
@@ -1848,3 +1858,9 @@ int valid_swaphandles(swp_entry_t entry,
 	*offset = ++toff;
 	return nr_pages? ++nr_pages: 0;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/net/compat.c linux-2.6.26.1-cher1/net/compat.c
--- linux-2.6.26.1/net/compat.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/net/compat.c	2008-08-05 13:44:37.000000000 +0400
@@ -743,6 +743,11 @@ asmlinkage long compat_sys_socketcall(in
 	u32 a[6];
 	u32 a0, a1;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (call < SYS_SOCKET || call > SYS_RECVMSG)
 		return -EINVAL;
 	if (copy_from_user(a, args, nas[call]))
@@ -810,3 +815,9 @@ asmlinkage long compat_sys_socketcall(in
 	}
 	return ret;
 }
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/net/socket.c linux-2.6.26.1-cher1/net/socket.c
--- linux-2.6.26.1/net/socket.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/net/socket.c	2008-08-05 13:44:37.000000000 +0400
@@ -1218,6 +1218,11 @@ asmlinkage long sys_socket(int family, i
 	int retval;
 	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	retval = sock_create(family, type, protocol, &sock);
 	if (retval < 0)
 		goto out;
@@ -1246,6 +1251,11 @@ asmlinkage long sys_socketpair(int famil
 	int fd1, fd2, err;
 	struct file *newfile1, *newfile2;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/*
 	 * Obtain the first socket and check if the underlying protocol
 	 * supports the socketpair call.
@@ -1344,6 +1354,11 @@ asmlinkage long sys_bind(int fd, struct 
 	char address[MAX_SOCK_ADDR];
 	int err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock) {
 		err = move_addr_to_kernel(umyaddr, addrlen, address);
@@ -1373,6 +1388,11 @@ asmlinkage long sys_listen(int fd, int b
 	int err, fput_needed;
 	int somaxconn;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock) {
 		somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
@@ -1408,6 +1428,11 @@ asmlinkage long sys_accept(int fd, struc
 	int err, len, newfd, fput_needed;
 	char address[MAX_SOCK_ADDR];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1497,6 +1522,11 @@ asmlinkage long sys_connect(int fd, stru
 	char address[MAX_SOCK_ADDR];
 	int err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1529,6 +1559,11 @@ asmlinkage long sys_getsockname(int fd, 
 	char address[MAX_SOCK_ADDR];
 	int len, err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1560,6 +1595,11 @@ asmlinkage long sys_getpeername(int fd, 
 	char address[MAX_SOCK_ADDR];
 	int len, err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_getpeername(sock);
@@ -1596,6 +1636,11 @@ asmlinkage long sys_sendto(int fd, void 
 	struct iovec iov;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1652,6 +1697,11 @@ asmlinkage long sys_recvfrom(int fd, voi
 	int err, err2;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1700,6 +1750,11 @@ asmlinkage long sys_setsockopt(int fd, i
 	int err, fput_needed;
 	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (optlen < 0)
 		return -EINVAL;
 
@@ -1734,6 +1789,11 @@ asmlinkage long sys_getsockopt(int fd, i
 	int err, fput_needed;
 	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_getsockopt(sock, level, optname);
@@ -1763,6 +1823,11 @@ asmlinkage long sys_shutdown(int fd, int
 	int err, fput_needed;
 	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_shutdown(sock, how);
@@ -1799,6 +1864,11 @@ asmlinkage long sys_sendmsg(int fd, stru
 	int err, ctl_len, iov_size, total_len;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = -EFAULT;
 	if (MSG_CMSG_COMPAT & flags) {
 		if (get_compat_msghdr(&msg_sys, msg_compat))
@@ -1906,6 +1976,11 @@ asmlinkage long sys_recvmsg(int fd, stru
 	struct sockaddr __user *uaddr;
 	int __user *uaddr_len;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (MSG_CMSG_COMPAT & flags) {
 		if (get_compat_msghdr(&msg_sys, msg_compat))
 			return -EFAULT;
@@ -2010,6 +2085,11 @@ asmlinkage long sys_socketcall(int call,
 	unsigned long a0, a1;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (call < 1 || call > SYS_RECVMSG)
 		return -EINVAL;
 
@@ -2351,3 +2431,9 @@ EXPORT_SYMBOL(kernel_setsockopt);
 EXPORT_SYMBOL(kernel_sendpage);
 EXPORT_SYMBOL(kernel_sock_ioctl);
 EXPORT_SYMBOL(kernel_sock_shutdown);
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
diff -ruNp linux-2.6.26.1/security/keys/keyctl.c linux-2.6.26.1-cher1/security/keys/keyctl.c
--- linux-2.6.26.1/security/keys/keyctl.c	2008-08-02 02:58:24.000000000 +0400
+++ linux-2.6.26.1-cher1/security/keys/keyctl.c	2008-08-05 13:44:37.000000000 +0400
@@ -66,6 +66,11 @@ asmlinkage long sys_add_key(const char _
 	long ret;
 	bool vm;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ret = -EINVAL;
 	if (plen > 1024 * 1024 - 1)
 		goto error;
@@ -158,6 +163,11 @@ asmlinkage long sys_request_key(const ch
 	char type[32], *description, *callout_info;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* pull the type into kernel space */
 	ret = key_get_type_from_user(type, _type, sizeof(type));
 	if (ret < 0)
@@ -1155,6 +1165,11 @@ long keyctl_get_security(key_serial_t ke
 asmlinkage long sys_keyctl(int option, unsigned long arg2, unsigned long arg3,
 			   unsigned long arg4, unsigned long arg5)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	switch (option) {
 	case KEYCTL_GET_KEYRING_ID:
 		return keyctl_get_keyring_ID((key_serial_t) arg2,
@@ -1238,3 +1253,9 @@ asmlinkage long sys_keyctl(int option, u
 	}
 
 } /* end sys_keyctl() */
+
+/*
+ * Local variables:
+ *  c-basic-offset: 8
+ * End:
+ */
