diff -ruNp linux-3.4.10/arch/x86/FIX_32.txt linux-3.4.10-cher1/arch/x86/FIX_32.txt
--- linux-3.4.10/arch/x86/FIX_32.txt	1970-01-01 03:00:00.000000000 +0300
+++ linux-3.4.10-cher1/arch/x86/FIX_32.txt	2012-09-01 20:32:46.056303463 +0400
@@ -0,0 +1,357 @@
+#
+# 32-bit system call numbers and entry vectors
+#
+# The format is:
+# <number> <abi> <name> <entry point> <compat entry point>
+#
+# The abi is always "i386" for this file.
+#
+0	i386	restart_syscall		sys_restart_syscall
+1	i386	exit			sys_exit+
+2	i386	fork			ptregs_fork*			stub32_fork*
+3	i386	read			sys_read+
+4	i386	write			sys_write+
+5	i386	open			sys_open*			compat_sys_open*
+6	i386	close			sys_close+
+7	i386	waitpid			sys_waitpid+			sys32_waitpid+
+8	i386	creat			sys_creat*
+9	i386	link			sys_link*
+10	i386	unlink			sys_unlink*
+11	i386	execve			ptregs_execve*			stub32_execve*
+12	i386	chdir			sys_chdir*
+13	i386	time			sys_time+			compat_sys_time+
+14	i386	mknod			sys_mknod*
+15	i386	chmod			sys_chmod*
+16	i386	lchown			sys_lchown16*
+17	i386	break
+18	i386	oldstat			sys_stat*
+19	i386	lseek			sys_lseek+			sys32_lseek+
+20	i386	getpid			sys_getpid+
+21	i386	mount			sys_mount*			compat_sys_mount*
+22	i386	umount			sys_oldumount*
+23	i386	setuid			sys_setuid16*
+24	i386	getuid			sys_getuid16+
+25	i386	stime			sys_stime*			compat_sys_stime*
+26	i386	ptrace			sys_ptrace*			compat_sys_ptrace*
+27	i386	alarm			sys_alarm+
+28	i386	oldfstat		sys_fstat+
+29	i386	pause			sys_pause+
+30	i386	utime			sys_utime*			compat_sys_utime*
+31	i386	stty
+32	i386	gtty
+33	i386	access			sys_access*
+34	i386	nice			sys_nice*
+35	i386	ftime
+36	i386	sync			sys_sync*
+37	i386	kill			sys_kill*			sys32_kill*
+38	i386	rename			sys_rename*
+39	i386	mkdir			sys_mkdir*
+40	i386	rmdir			sys_rmdir*
+41	i386	dup			sys_dup+
+42	i386	pipe			sys_pipe*
+43	i386	times			sys_times+			compat_sys_times+
+44	i386	prof
+45	i386	brk			sys_brk+
+46	i386	setgid			sys_setgid16*
+47	i386	getgid			sys_getgid16+
+48	i386	signal			sys_signal+
+49	i386	geteuid			sys_geteuid16+
+50	i386	getegid			sys_getegid16+
+51	i386	acct			sys_acct*
+52	i386	umount2			sys_umount*
+53	i386	lock
+54	i386	ioctl			sys_ioctl*			compat_sys_ioctl*
+55	i386	fcntl			sys_fcntl*			compat_sys_fcntl64*
+56	i386	mpx
+57	i386	setpgid			sys_setpgid*
+58	i386	ulimit
+59	i386	oldolduname		sys_olduname+
+60	i386	umask			sys_umask*
+61	i386	chroot			sys_chroot*
+62	i386	ustat			sys_ustat*			compat_sys_ustat*
+63	i386	dup2			sys_dup2+
+64	i386	getppid			sys_getppid+
+65	i386	getpgrp			sys_getpgrp+
+66	i386	setsid			sys_setsid*
+67	i386	sigaction		sys_sigaction+			sys32_sigaction+
+68	i386	sgetmask		sys_sgetmask+
+69	i386	ssetmask		sys_ssetmask+
+70	i386	setreuid		sys_setreuid16*
+71	i386	setregid		sys_setregid16*
+72	i386	sigsuspend		sys_sigsuspend+			sys32_sigsuspend+
+73	i386	sigpending		sys_sigpending+			compat_sys_sigpending+
+74	i386	sethostname		sys_sethostname*
+75	i386	setrlimit		sys_setrlimit*			compat_sys_setrlimit*
+76	i386	getrlimit		sys_old_getrlimit+		compat_sys_old_getrlimit+
+77	i386	getrusage		sys_getrusage+			compat_sys_getrusage+
+78	i386	gettimeofday		sys_gettimeofday+		compat_sys_gettimeofday+
+79	i386	settimeofday		sys_settimeofday*		compat_sys_settimeofday*
+80	i386	getgroups		sys_getgroups16+
+81	i386	setgroups		sys_setgroups16*
+82	i386	select			sys_old_select+			compat_sys_old_select+
+83	i386	symlink			sys_symlink*
+84	i386	oldlstat		sys_lstat*
+85	i386	readlink		sys_readlink*
+86	i386	uselib			sys_uselib*
+87	i386	swapon			sys_swapon*
+88	i386	reboot			sys_reboot*
+89	i386	readdir			sys_old_readdir*		compat_sys_old_readdir*
+90	i386	mmap			sys_old_mmap+			sys32_mmap+
+91	i386	munmap			sys_munmap+
+92	i386	truncate		sys_truncate*
+93	i386	ftruncate		sys_ftruncate+
+94	i386	fchmod			sys_fchmod*
+95	i386	fchown			sys_fchown16*
+96	i386	getpriority		sys_getpriority+
+97	i386	setpriority		sys_setpriority*
+98	i386	profil
+99	i386	statfs			sys_statfs*			compat_sys_statfs*
+100	i386	fstatfs			sys_fstatfs*			compat_sys_fstatfs*
+101	i386	ioperm			sys_ioperm*
+102	i386	socketcall		sys_socketcall*			compat_sys_socketcall*
+103	i386	syslog			sys_syslog*
+104	i386	setitimer		sys_setitimer+			compat_sys_setitimer+
+105	i386	getitimer		sys_getitimer+			compat_sys_getitimer+
+106	i386	stat			sys_newstat*			compat_sys_newstat*
+107	i386	lstat			sys_newlstat*			compat_sys_newlstat*
+108	i386	fstat			sys_newfstat+			compat_sys_newfstat+
+109	i386	olduname		sys_uname+
+110	i386	iopl			ptregs_iopl*			stub32_iopl*
+111	i386	vhangup			sys_vhangup*
+112	i386	idle
+113	i386	vm86old			ptregs_vm86old*			sys32_vm86_warning*
+114	i386	wait4			sys_wait4+			compat_sys_wait4+
+115	i386	swapoff			sys_swapoff*
+116	i386	sysinfo			sys_sysinfo+			compat_sys_sysinfo+
+117	i386	ipc			sys_ipc*			sys32_ipc*
+118	i386	fsync			sys_fsync*
+119	i386	sigreturn		ptregs_sigreturn+		stub32_sigreturn+
+120	i386	clone			ptregs_clone*			stub32_clone*
+121	i386	setdomainname		sys_setdomainname*
+122	i386	uname			sys_newuname+
+123	i386	modify_ldt		sys_modify_ldt*
+124	i386	adjtimex		sys_adjtimex*			compat_sys_adjtimex*
+125	i386	mprotect		sys_mprotect+			sys32_mprotect+
+126	i386	sigprocmask		sys_sigprocmask+		compat_sys_sigprocmask+
+127	i386	create_module
+128	i386	init_module		sys_init_module*
+129	i386	delete_module		sys_delete_module*
+130	i386	get_kernel_syms
+131	i386	quotactl		sys_quotactl*			sys32_quotactl*
+132	i386	getpgid			sys_getpgid+
+133	i386	fchdir			sys_fchdir*
+134	i386	bdflush			sys_bdflush*
+135	i386	sysfs			sys_sysfs*
+136	i386	personality		sys_personality*
+137	i386	afs_syscall
+138	i386	setfsuid		sys_setfsuid16*
+139	i386	setfsgid		sys_setfsgid16*
+140	i386	_llseek			sys_llseek+
+141	i386	getdents		sys_getdents*			compat_sys_getdents*
+142	i386	_newselect		sys_select+			compat_sys_select+
+143	i386	flock			sys_flock*
+144	i386	msync			sys_msync*
+145	i386	readv			sys_readv+			compat_sys_readv+
+146	i386	writev			sys_writev+			compat_sys_writev+
+147	i386	getsid			sys_getsid+
+148	i386	fdatasync		sys_fdatasync*
+149	i386	_sysctl			sys_sysctl*			compat_sys_sysctl*
+150	i386	mlock			sys_mlock*
+151	i386	munlock			sys_munlock*
+152	i386	mlockall		sys_mlockall*
+153	i386	munlockall		sys_munlockall*
+154	i386	sched_setparam		sys_sched_setparam*
+155	i386	sched_getparam		sys_sched_getparam+
+156	i386	sched_setscheduler	sys_sched_setscheduler*
+157	i386	sched_getscheduler	sys_sched_getscheduler+
+158	i386	sched_yield		sys_sched_yield+
+159	i386	sched_get_priority_max	sys_sched_get_priority_max+
+160	i386	sched_get_priority_min	sys_sched_get_priority_min+
+161	i386	sched_rr_get_interval	sys_sched_rr_get_interval+	sys32_sched_rr_get_interval+
+162	i386	nanosleep		sys_nanosleep+			compat_sys_nanosleep+
+163	i386	mremap			sys_mremap+
+164	i386	setresuid		sys_setresuid16*
+165	i386	getresuid		sys_getresuid16+
+166	i386	vm86			ptregs_vm86*			sys32_vm86_warning*
+167	i386	query_module
+168	i386	poll			sys_poll+
+169	i386	nfsservctl
+170	i386	setresgid		sys_setresgid16*
+171	i386	getresgid		sys_getresgid16+
+172	i386	prctl			sys_prctl*
+173	i386	rt_sigreturn		ptregs_rt_sigreturn+		stub32_rt_sigreturn+
+174	i386	rt_sigaction		sys_rt_sigaction+		sys32_rt_sigaction+
+175	i386	rt_sigprocmask		sys_rt_sigprocmask+
+176	i386	rt_sigpending		sys_rt_sigpending+		sys32_rt_sigpending+
+177	i386	rt_sigtimedwait		sys_rt_sigtimedwait+		compat_sys_rt_sigtimedwait+
+178	i386	rt_sigqueueinfo		sys_rt_sigqueueinfo+		sys32_rt_sigqueueinfo+
+179	i386	rt_sigsuspend		sys_rt_sigsuspend+
+180	i386	pread64			sys_pread64*			sys32_pread*
+181	i386	pwrite64		sys_pwrite64*			sys32_pwrite*
+182	i386	chown			sys_chown16*
+183	i386	getcwd			sys_getcwd*
+184	i386	capget			sys_capget*
+185	i386	capset			sys_capset*
+186	i386	sigaltstack		ptregs_sigaltstack*		stub32_sigaltstack*
+187	i386	sendfile		sys_sendfile+			sys32_sendfile+
+188	i386	getpmsg
+189	i386	putpmsg
+190	i386	vfork			ptregs_vfork*			stub32_vfork*
+191	i386	ugetrlimit		sys_getrlimit+			compat_sys_getrlimit+
+192	i386	mmap2			sys_mmap_pgoff+
+193	i386	truncate64		sys_truncate64*			sys32_truncate64*
+194	i386	ftruncate64		sys_ftruncate64+		sys32_ftruncate64+
+195	i386	stat64			sys_stat64*			sys32_stat64*
+196	i386	lstat64			sys_lstat64*			sys32_lstat64*
+197	i386	fstat64			sys_fstat64+			sys32_fstat64+
+198	i386	lchown32		sys_lchown*
+199	i386	getuid32		sys_getuid+
+200	i386	getgid32		sys_getgid+
+201	i386	geteuid32		sys_geteuid+
+202	i386	getegid32		sys_getegid+
+203	i386	setreuid32		sys_setreuid*
+204	i386	setregid32		sys_setregid*
+205	i386	getgroups32		sys_getgroups+
+206	i386	setgroups32		sys_setgroups*
+207	i386	fchown32		sys_fchown*
+208	i386	setresuid32		sys_setresuid*
+209	i386	getresuid32		sys_getresuid+
+210	i386	setresgid32		sys_setresgid*
+211	i386	getresgid32		sys_getresgid+
+212	i386	chown32			sys_chown*
+213	i386	setuid32		sys_setuid*
+214	i386	setgid32		sys_setgid*
+215	i386	setfsuid32		sys_setfsuid*
+216	i386	setfsgid32		sys_setfsgid*
+217	i386	pivot_root		sys_pivot_root*
+218	i386	mincore			sys_mincore*
+219	i386	madvise			sys_madvise*
+220	i386	getdents64		sys_getdents64*			compat_sys_getdents64*
+221	i386	fcntl64			sys_fcntl64*			compat_sys_fcntl64*
+# 222 is unused
+# 223 is unused
+224	i386	gettid			sys_gettid+
+225	i386	readahead		sys_readahead*			sys32_readahead*
+226	i386	setxattr		sys_setxattr*
+227	i386	lsetxattr		sys_lsetxattr*
+228	i386	fsetxattr		sys_fsetxattr*
+229	i386	getxattr		sys_getxattr*
+230	i386	lgetxattr		sys_lgetxattr*
+231	i386	fgetxattr		sys_fgetxattr*
+232	i386	listxattr		sys_listxattr*
+233	i386	llistxattr		sys_llistxattr*
+234	i386	flistxattr		sys_flistxattr*
+235	i386	removexattr		sys_removexattr*
+236	i386	lremovexattr		sys_lremovexattr*
+237	i386	fremovexattr		sys_fremovexattr*
+238	i386	tkill			sys_tkill*
+239	i386	sendfile64		sys_sendfile64+
+240	i386	futex			sys_futex+			compat_sys_futex+
+241	i386	sched_setaffinity	sys_sched_setaffinity*		compat_sys_sched_setaffinity*
+242	i386	sched_getaffinity	sys_sched_getaffinity+		compat_sys_sched_getaffinity+
+243	i386	set_thread_area		sys_set_thread_area+
+244	i386	get_thread_area		sys_get_thread_area+
+245	i386	io_setup		sys_io_setup*			compat_sys_io_setup*
+246	i386	io_destroy		sys_io_destroy*
+247	i386	io_getevents		sys_io_getevents*		compat_sys_io_getevents*
+248	i386	io_submit		sys_io_submit*			compat_sys_io_submit*
+249	i386	io_cancel		sys_io_cancel*
+250	i386	fadvise64		sys_fadvise64*			sys32_fadvise64*
+# 251 is available for reuse (was briefly sys_set_zone_reclaim)
+252	i386	exit_group		sys_exit_group+
+253	i386	lookup_dcookie		sys_lookup_dcookie*		sys32_lookup_dcookie*
+254	i386	epoll_create		sys_epoll_create*
+255	i386	epoll_ctl		sys_epoll_ctl*
+256	i386	epoll_wait		sys_epoll_wait*
+257	i386	remap_file_pages	sys_remap_file_pages*
+258	i386	set_tid_address		sys_set_tid_address+
+259	i386	timer_create		sys_timer_create+		compat_sys_timer_create+
+260	i386	timer_settime		sys_timer_settime+		compat_sys_timer_settime+
+261	i386	timer_gettime		sys_timer_gettime+		compat_sys_timer_gettime+
+262	i386	timer_getoverrun	sys_timer_getoverrun+
+263	i386	timer_delete		sys_timer_delete+
+264	i386	clock_settime		sys_clock_settime+		compat_sys_clock_settime+
+265	i386	clock_gettime		sys_clock_gettime+		compat_sys_clock_gettime+
+266	i386	clock_getres		sys_clock_getres+		compat_sys_clock_getres+
+267	i386	clock_nanosleep		sys_clock_nanosleep+		compat_sys_clock_nanosleep+
+268	i386	statfs64		sys_statfs64*			compat_sys_statfs64*
+269	i386	fstatfs64		sys_fstatfs64*			compat_sys_fstatfs64*
+270	i386	tgkill			sys_tgkill*
+271	i386	utimes			sys_utimes*			compat_sys_utimes*
+272	i386	fadvise64_64		sys_fadvise64_64*		sys32_fadvise64_64*
+273	i386	vserver
+274	i386	mbind			sys_mbind*
+275	i386	get_mempolicy		sys_get_mempolicy*		compat_sys_get_mempolicy*
+276	i386	set_mempolicy		sys_set_mempolicy*
+277	i386	mq_open			sys_mq_open*			compat_sys_mq_open*
+278	i386	mq_unlink		sys_mq_unlink*
+279	i386	mq_timedsend		sys_mq_timedsend*		compat_sys_mq_timedsend*
+280	i386	mq_timedreceive		sys_mq_timedreceive*		compat_sys_mq_timedreceive*
+281	i386	mq_notify		sys_mq_notify*			compat_sys_mq_notify*
+282	i386	mq_getsetattr		sys_mq_getsetattr*		compat_sys_mq_getsetattr*
+283	i386	kexec_load		sys_kexec_load*			compat_sys_kexec_load*
+284	i386	waitid			sys_waitid+			compat_sys_waitid+
+# 285 sys_setaltroot
+286	i386	add_key			sys_add_key*
+287	i386	request_key		sys_request_key*
+288	i386	keyctl			sys_keyctl*
+289	i386	ioprio_set		sys_ioprio_set*
+290	i386	ioprio_get		sys_ioprio_get*
+291	i386	inotify_init		sys_inotify_init*
+292	i386	inotify_add_watch	sys_inotify_add_watch*
+293	i386	inotify_rm_watch	sys_inotify_rm_watch*
+294	i386	migrate_pages		sys_migrate_pages*
+295	i386	openat			sys_openat*			compat_sys_openat*
+296	i386	mkdirat			sys_mkdirat*
+297	i386	mknodat			sys_mknodat*
+298	i386	fchownat		sys_fchownat*
+299	i386	futimesat		sys_futimesat*			compat_sys_futimesat*
+300	i386	fstatat64		sys_fstatat64+			sys32_fstatat+
+301	i386	unlinkat		sys_unlinkat*
+302	i386	renameat		sys_renameat*
+303	i386	linkat			sys_linkat*
+304	i386	symlinkat		sys_symlinkat*
+305	i386	readlinkat		sys_readlinkat*
+306	i386	fchmodat		sys_fchmodat*
+307	i386	faccessat		sys_faccessat*
+308	i386	pselect6		sys_pselect6+			compat_sys_pselect6+
+309	i386	ppoll			sys_ppoll+			compat_sys_ppoll+
+310	i386	unshare			sys_unshare*
+311	i386	set_robust_list		sys_set_robust_list+		compat_sys_set_robust_list+
+312	i386	get_robust_list		sys_get_robust_list+		compat_sys_get_robust_list+
+313	i386	splice			sys_splice*
+314	i386	sync_file_range		sys_sync_file_range*		sys32_sync_file_range*
+315	i386	tee			sys_tee*
+316	i386	vmsplice		sys_vmsplice*			compat_sys_vmsplice*
+317	i386	move_pages		sys_move_pages*			compat_sys_move_pages*
+318	i386	getcpu			sys_getcpu+
+319	i386	epoll_pwait		sys_epoll_pwait*
+320	i386	utimensat		sys_utimensat*			compat_sys_utimensat*
+321	i386	signalfd		sys_signalfd*			compat_sys_signalfd*
+322	i386	timerfd_create		sys_timerfd_create*
+323	i386	eventfd			sys_eventfd*
+324	i386	fallocate		sys_fallocate+			sys32_fallocate+
+325	i386	timerfd_settime		sys_timerfd_settime*		compat_sys_timerfd_settime*
+326	i386	timerfd_gettime		sys_timerfd_gettime*		compat_sys_timerfd_gettime*
+327	i386	signalfd4		sys_signalfd4*			compat_sys_signalfd4*
+328	i386	eventfd2		sys_eventfd2*
+329	i386	epoll_create1		sys_epoll_create1*
+330	i386	dup3			sys_dup3+
+331	i386	pipe2			sys_pipe2*
+332	i386	inotify_init1		sys_inotify_init1*
+333	i386	preadv			sys_preadv*			compat_sys_preadv*
+334	i386	pwritev			sys_pwritev*			compat_sys_pwritev*
+335	i386	rt_tgsigqueueinfo	sys_rt_tgsigqueueinfo+		compat_sys_rt_tgsigqueueinfo+
+336	i386	perf_event_open		sys_perf_event_open*
+337	i386	recvmmsg		sys_recvmmsg*			compat_sys_recvmmsg*
+338	i386	fanotify_init		sys_fanotify_init*
+339	i386	fanotify_mark		sys_fanotify_mark*		sys32_fanotify_mark*
+340	i386	prlimit64		sys_prlimit64*
+341	i386	name_to_handle_at	sys_name_to_handle_at*
+342	i386	open_by_handle_at	sys_open_by_handle_at*		compat_sys_open_by_handle_at*
+343	i386	clock_adjtime		sys_clock_adjtime+		compat_sys_clock_adjtime+
+344	i386	syncfs			sys_syncfs*
+345	i386	sendmmsg		sys_sendmmsg*			compat_sys_sendmmsg*
+346	i386	setns			sys_setns*
+347	i386	process_vm_readv	sys_process_vm_readv*		compat_sys_process_vm_readv*
+348	i386	process_vm_writev	sys_process_vm_writev*		compat_sys_process_vm_writev*
diff -ruNp linux-3.4.10/arch/x86/FIX_64.txt linux-3.4.10-cher1/arch/x86/FIX_64.txt
--- linux-3.4.10/arch/x86/FIX_64.txt	1970-01-01 03:00:00.000000000 +0300
+++ linux-3.4.10-cher1/arch/x86/FIX_64.txt	2012-09-01 20:32:46.056303463 +0400
@@ -0,0 +1,353 @@
+#
+# 64-bit system call numbers and entry vectors
+#
+# The format is:
+# <number> <abi> <name> <entry point>
+#
+# The abi is "common", "64" or "x32" for this file.
+#
+0	common	read			sys_read+
+1	common	write			sys_write+
+2	common	open			sys_open*
+3	common	close			sys_close+
+4	common	stat			sys_newstat*
+5	common	fstat			sys_newfstat+
+6	common	lstat			sys_newlstat*
+7	common	poll			sys_poll+
+8	common	lseek			sys_lseek+
+9	common	mmap			sys_mmap+
+10	common	mprotect		sys_mprotect+
+11	common	munmap			sys_munmap+
+12	common	brk			sys_brk+
+13	64	rt_sigaction		sys_rt_sigaction+
+14	common	rt_sigprocmask		sys_rt_sigprocmask+
+15	64	rt_sigreturn		stub_rt_sigreturn+
+16	64	ioctl			sys_ioctl*
+17	common	pread64			sys_pread64*
+18	common	pwrite64		sys_pwrite64*
+19	64	readv			sys_readv+
+20	64	writev			sys_writev+
+21	common	access			sys_access*
+22	common	pipe			sys_pipe*
+23	common	select			sys_select+
+24	common	sched_yield		sys_sched_yield+
+25	common	mremap			sys_mremap+
+26	common	msync			sys_msync*
+27	common	mincore			sys_mincore*
+28	common	madvise			sys_madvise*
+29	common	shmget			sys_shmget*
+30	common	shmat			sys_shmat*
+31	common	shmctl			sys_shmctl*
+32	common	dup			sys_dup+
+33	common	dup2			sys_dup2+
+34	common	pause			sys_pause+
+35	common	nanosleep		sys_nanosleep+
+36	common	getitimer		sys_getitimer+
+37	common	alarm			sys_alarm+
+38	common	setitimer		sys_setitimer+
+39	common	getpid			sys_getpid+
+40	common	sendfile		sys_sendfile64+
+41	common	socket			sys_socket*
+42	common	connect			sys_connect*
+43	common	accept			sys_accept*
+44	common	sendto			sys_sendto*
+45	64	recvfrom		sys_recvfrom*
+46	64	sendmsg			sys_sendmsg*
+47	64	recvmsg			sys_recvmsg*
+48	common	shutdown		sys_shutdown*
+49	common	bind			sys_bind*
+50	common	listen			sys_listen*
+51	common	getsockname		sys_getsockname*
+52	common	getpeername		sys_getpeername*
+53	common	socketpair		sys_socketpair*
+54	common	setsockopt		sys_setsockopt*
+55	common	getsockopt		sys_getsockopt*
+56	common	clone			stub_clone*
+57	common	fork			stub_fork*
+58	common	vfork			stub_vfork*
+59	64	execve			stub_execve*
+60	common	exit			sys_exit+
+61	common	wait4			sys_wait4
+62	common	kill			sys_kill*
+63	common	uname			sys_newuname+
+64	common	semget			sys_semget*
+65	common	semop			sys_semop*
+66	common	semctl			sys_semctl*
+67	common	shmdt			sys_shmdt*
+68	common	msgget			sys_msgget*
+69	common	msgsnd			sys_msgsnd*
+70	common	msgrcv			sys_msgrcv*
+71	common	msgctl			sys_msgctl*
+72	common	fcntl			sys_fcntl*
+73	common	flock			sys_flock*
+74	common	fsync			sys_fsync*
+75	common	fdatasync		sys_fdatasync*
+76	common	truncate		sys_truncate*
+77	common	ftruncate		sys_ftruncate+
+78	common	getdents		sys_getdents*
+79	common	getcwd			sys_getcwd*
+80	common	chdir			sys_chdir*
+81	common	fchdir			sys_fchdir*
+82	common	rename			sys_rename*
+83	common	mkdir			sys_mkdir*
+84	common	rmdir			sys_rmdir*
+85	common	creat			sys_creat*
+86	common	link			sys_link*
+87	common	unlink			sys_unlink*
+88	common	symlink			sys_symlink*
+89	common	readlink		sys_readlink*
+90	common	chmod			sys_chmod*
+91	common	fchmod			sys_fchmod*
+92	common	chown			sys_chown*
+93	common	fchown			sys_fchown*
+94	common	lchown			sys_lchown*
+95	common	umask			sys_umask*
+96	common	gettimeofday		sys_gettimeofday+
+97	common	getrlimit		sys_getrlimit+
+98	common	getrusage		sys_getrusage+
+99	common	sysinfo			sys_sysinfo+
+100	common	times			sys_times+
+101	64	ptrace*			sys_ptrace*
+102	common	getuid			sys_getuid+
+103	common	syslog			sys_syslog*
+104	common	getgid			sys_getgid+
+105	common	setuid			sys_setuid*
+106	common	setgid			sys_setgid*
+107	common	geteuid			sys_geteuid+
+108	common	getegid			sys_getegid+
+109	common	setpgid			sys_setpgid*
+110	common	getppid			sys_getppid+
+111	common	getpgrp			sys_getpgrp+
+112	common	setsid			sys_setsid*
+113	common	setreuid		sys_setreuid*
+114	common	setregid		sys_setregid*
+115	common	getgroups		sys_getgroups+
+116	common	setgroups		sys_setgroups*
+117	common	setresuid		sys_setresuid*
+118	common	getresuid		sys_getresuid+
+119	common	setresgid		sys_setresgid*
+120	common	getresgid		sys_getresgid+
+121	common	getpgid			sys_getpgid+
+122	common	setfsuid		sys_setfsuid*
+123	common	setfsgid		sys_setfsgid*
+124	common	getsid			sys_getsid+
+125	common	capget			sys_capget*
+126	common	capset			sys_capset*
+127	64	rt_sigpending		sys_rt_sigpending+
+128	64	rt_sigtimedwait		sys_rt_sigtimedwait+
+129	64	rt_sigqueueinfo		sys_rt_sigqueueinfo+
+130	common	rt_sigsuspend		sys_rt_sigsuspend+
+131	64	sigaltstack		stub_sigaltstack*
+132	common	utime			sys_utime*
+133	common	mknod			sys_mknod*
+134	64	uselib
+135	common	personality		sys_personality*
+136	common	ustat			sys_ustat*
+137	common	statfs			sys_statfs*
+138	common	fstatfs			sys_fstatfs*
+139	common	sysfs			sys_sysfs*
+140	common	getpriority		sys_getpriority+
+141	common	setpriority		sys_setpriority*
+142	common	sched_setparam		sys_sched_setparam*
+143	common	sched_getparam		sys_sched_getparam+
+144	common	sched_setscheduler	sys_sched_setscheduler*
+145	common	sched_getscheduler	sys_sched_getscheduler+
+146	common	sched_get_priority_max	sys_sched_get_priority_max+
+147	common	sched_get_priority_min	sys_sched_get_priority_min+
+148	common	sched_rr_get_interval	sys_sched_rr_get_interval+
+149	common	mlock			sys_mlock*
+150	common	munlock			sys_munlock*
+151	common	mlockall		sys_mlockall*
+152	common	munlockall		sys_munlockall*
+153	common	vhangup			sys_vhangup*
+154	common	modify_ldt		sys_modify_ldt*
+155	common	pivot_root		sys_pivot_root*
+156	64	_sysctl			sys_sysctl*
+157	common	prctl			sys_prctl*
+158	common	arch_prctl		sys_arch_prctl+
+159	common	adjtimex		sys_adjtimex*
+160	common	setrlimit		sys_setrlimit*
+161	common	chroot			sys_chroot*
+162	common	sync			sys_sync*
+163	common	acct			sys_acct*
+164	common	settimeofday		sys_settimeofday*
+165	common	mount			sys_mount*
+166	common	umount2			sys_umount*
+167	common	swapon			sys_swapon*
+168	common	swapoff			sys_swapoff*
+169	common	reboot			sys_reboot*
+170	common	sethostname		sys_sethostname*
+171	common	setdomainname		sys_setdomainname*
+172	common	iopl			stub_iopl*
+173	common	ioperm			sys_ioperm*
+174	64	create_module
+175	common	init_module		sys_init_module*
+176	common	delete_module		sys_delete_module*
+177	64	get_kernel_syms
+178	64	query_module
+179	common	quotactl		sys_quotactl*
+180	64	nfsservctl
+181	common	getpmsg
+182	common	putpmsg
+183	common	afs_syscall
+184	common	tuxcall
+185	common	security
+186	common	gettid			sys_gettid+
+187	common	readahead		sys_readahead*
+188	common	setxattr		sys_setxattr*
+189	common	lsetxattr		sys_lsetxattr*
+190	common	fsetxattr		sys_fsetxattr*
+191	common	getxattr		sys_getxattr*
+192	common	lgetxattr		sys_lgetxattr*
+193	common	fgetxattr		sys_fgetxattr*
+194	common	listxattr		sys_listxattr*
+195	common	llistxattr		sys_llistxattr*
+196	common	flistxattr		sys_flistxattr*
+197	common	removexattr		sys_removexattr*
+198	common	lremovexattr		sys_lremovexattr*
+199	common	fremovexattr		sys_fremovexattr*
+200	common	tkill			sys_tkill*
+201	common	time			sys_time+
+202	common	futex			sys_futex+
+203	common	sched_setaffinity	sys_sched_setaffinity*
+204	common	sched_getaffinity	sys_sched_getaffinity+
+205	64	set_thread_area
+206	common	io_setup		sys_io_setup*
+207	common	io_destroy		sys_io_destroy*
+208	common	io_getevents		sys_io_getevents*
+209	common	io_submit		sys_io_submit*
+210	common	io_cancel		sys_io_cancel*
+211	64	get_thread_area
+212	common	lookup_dcookie		sys_lookup_dcookie*
+213	common	epoll_create		sys_epoll_create*
+214	64	epoll_ctl_old
+215	64	epoll_wait_old
+216	common	remap_file_pages	sys_remap_file_pages*
+217	common	getdents64		sys_getdents64*
+218	common	set_tid_address		sys_set_tid_address+
+219	common	restart_syscall		sys_restart_syscall+
+220	common	semtimedop		sys_semtimedop*
+221	common	fadvise64		sys_fadvise64*
+222	64	timer_create		sys_timer_create+
+223	common	timer_settime		sys_timer_settime+
+224	common	timer_gettime		sys_timer_gettime+
+225	common	timer_getoverrun	sys_timer_getoverrun+
+226	common	timer_delete		sys_timer_delete+
+227	common	clock_settime		sys_clock_settime+
+228	common	clock_gettime		sys_clock_gettime+
+229	common	clock_getres		sys_clock_getres+
+230	common	clock_nanosleep		sys_clock_nanosleep+
+231	common	exit_group		sys_exit_group+
+232	common	epoll_wait		sys_epoll_wait*
+233	common	epoll_ctl		sys_epoll_ctl*
+234	common	tgkill			sys_tgkill*
+235	common	utimes			sys_utimes*
+236	64	vserver
+237	common	mbind			sys_mbind*
+238	common	set_mempolicy		sys_set_mempolicy*
+239	common	get_mempolicy		sys_get_mempolicy*
+240	common	mq_open			sys_mq_open*
+241	common	mq_unlink		sys_mq_unlink*
+242	common	mq_timedsend		sys_mq_timedsend*
+243	common	mq_timedreceive		sys_mq_timedreceive*
+244	64	mq_notify		sys_mq_notify*
+245	common	mq_getsetattr		sys_mq_getsetattr*
+246	64	kexec_load		sys_kexec_load*
+247	64	waitid			sys_waitid+
+248	common	add_key			sys_add_key*
+249	common	request_key		sys_request_key*
+250	common	keyctl			sys_keyctl*
+251	common	ioprio_set		sys_ioprio_set*
+252	common	ioprio_get		sys_ioprio_get*
+253	common	inotify_init		sys_inotify_init*
+254	common	inotify_add_watch	sys_inotify_add_watch*
+255	common	inotify_rm_watch	sys_inotify_rm_watch*
+256	common	migrate_pages		sys_migrate_pages*
+257	common	openat			sys_openat*
+258	common	mkdirat			sys_mkdirat*
+259	common	mknodat			sys_mknodat*
+260	common	fchownat		sys_fchownat*
+261	common	futimesat		sys_futimesat*
+262	common	newfstatat		sys_newfstatat*
+263	common	unlinkat		sys_unlinkat*
+264	common	renameat		sys_renameat*
+265	common	linkat			sys_linkat*
+266	common	symlinkat		sys_symlinkat*
+267	common	readlinkat		sys_readlinkat*
+268	common	fchmodat		sys_fchmodat*
+269	common	faccessat		sys_faccessat*
+270	common	pselect6		sys_pselect6+
+271	common	ppoll			sys_ppoll+
+272	common	unshare			sys_unshare*
+273	64	set_robust_list		sys_set_robust_list+
+274	64	get_robust_list		sys_get_robust_list+
+275	common	splice			sys_splice*
+276	common	tee			sys_tee*
+277	common	sync_file_range		sys_sync_file_range*
+278	64	vmsplice		sys_vmsplice*
+279	64	move_pages		sys_move_pages*
+280	common	utimensat		sys_utimensat*
+281	common	epoll_pwait		sys_epoll_pwait*
+282	common	signalfd		sys_signalfd*
+283	common	timerfd_create		sys_timerfd_create*
+284	common	eventfd			sys_eventfd*
+285	common	fallocate		sys_fallocate+
+286	common	timerfd_settime		sys_timerfd_settime*
+287	common	timerfd_gettime		sys_timerfd_gettime*
+288	common	accept4			sys_accept4*
+289	common	signalfd4		sys_signalfd4*
+290	common	eventfd2		sys_eventfd2*
+291	common	epoll_create1		sys_epoll_create1*
+292	common	dup3			sys_dup3+
+293	common	pipe2			sys_pipe2*
+294	common	inotify_init1		sys_inotify_init1*
+295	64	preadv			sys_preadv*
+296	64	pwritev			sys_pwritev*
+297	64	rt_tgsigqueueinfo	sys_rt_tgsigqueueinfo+
+298	common	perf_event_open		sys_perf_event_open*
+299	64	recvmmsg		sys_recvmmsg*
+300	common	fanotify_init		sys_fanotify_init*
+301	common	fanotify_mark		sys_fanotify_mark*
+302	common	prlimit64		sys_prlimit64*
+303	common	name_to_handle_at	sys_name_to_handle_at*
+304	common	open_by_handle_at	sys_open_by_handle_at*
+305	common	clock_adjtime		sys_clock_adjtime+
+306	common	syncfs			sys_syncfs*
+307	64	sendmmsg		sys_sendmmsg*
+308	common	setns			sys_setns*
+309	common	getcpu			sys_getcpu+
+310	64	process_vm_readv	sys_process_vm_readv*
+311	64	process_vm_writev	sys_process_vm_writev*
+#
+# x32-specific system call numbers start at 512 to avoid cache impact
+# for native 64-bit operation.
+#
+512	x32	rt_sigaction		sys32_rt_sigaction+
+513	x32	rt_sigreturn		stub_x32_rt_sigreturn+
+514	x32	ioctl			compat_sys_ioctl*
+515	x32	readv			compat_sys_readv+
+516	x32	writev			compat_sys_writev+
+517	x32	recvfrom		compat_sys_recvfrom*
+518	x32	sendmsg			compat_sys_sendmsg*
+519	x32	recvmsg			compat_sys_recvmsg*
+520	x32	execve			stub_x32_execve*
+521	x32	ptrace			compat_sys_ptrace*
+522	x32	rt_sigpending		sys32_rt_sigpending+
+523	x32	rt_sigtimedwait		compat_sys_rt_sigtimedwait+
+524	x32	rt_sigqueueinfo		sys32_rt_sigqueueinfo+
+525	x32	sigaltstack		stub_x32_sigaltstack*
+526	x32	timer_create		compat_sys_timer_create+
+527	x32	mq_notify		compat_sys_mq_notify*
+528	x32	kexec_load		compat_sys_kexec_load*
+529	x32	waitid			compat_sys_waitid+
+530	x32	set_robust_list		compat_sys_set_robust_list+
+531	x32	get_robust_list		compat_sys_get_robust_list+
+532	x32	vmsplice		compat_sys_vmsplice*
+533	x32	move_pages		compat_sys_move_pages*
+534	x32	preadv			compat_sys_preadv64*
+535	x32	pwritev			compat_sys_pwritev64*
+536	x32	rt_tgsigqueueinfo	compat_sys_rt_tgsigqueueinfo+
+537	x32	recvmmsg		compat_sys_recvmmsg*
+538	x32	sendmmsg		compat_sys_sendmmsg*
+539	x32	process_vm_readv	compat_sys_process_vm_readv*
+540	x32	process_vm_writev	compat_sys_process_vm_writev*
diff -ruNp linux-3.4.10/arch/x86/ia32/ia32_signal.c linux-3.4.10-cher1/arch/x86/ia32/ia32_signal.c
--- linux-3.4.10/arch/x86/ia32/ia32_signal.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/arch/x86/ia32/ia32_signal.c	2012-09-01 20:32:46.057303480 +0400
@@ -149,6 +149,9 @@ asmlinkage long sys32_sigaltstack(const 
 	int ret, err = 0;
 	mm_segment_t seg;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (uss_ptr) {
 		u32 ptr;
 
diff -ruNp linux-3.4.10/arch/x86/ia32/ipc32.c linux-3.4.10-cher1/arch/x86/ia32/ipc32.c
--- linux-3.4.10/arch/x86/ia32/ipc32.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/arch/x86/ia32/ipc32.c	2012-09-01 20:32:46.057303480 +0400
@@ -15,6 +15,11 @@ asmlinkage long sys32_ipc(u32 call, int 
 {
 	int version;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	version = call >> 16; /* hack for backward compatibility */
 	call &= 0xffff;
 
diff -ruNp linux-3.4.10/arch/x86/ia32/sys_ia32.c linux-3.4.10-cher1/arch/x86/ia32/sys_ia32.c
--- linux-3.4.10/arch/x86/ia32/sys_ia32.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/arch/x86/ia32/sys_ia32.c	2012-09-01 20:32:46.057303480 +0400
@@ -95,12 +95,26 @@ static int cp_stat64(struct stat64 __use
 	return 0;
 }
 
+int cher_patch_is_secure_path(const char *);
+
 asmlinkage long sys32_stat64(const char __user *filename,
 			     struct stat64 __user *statbuf)
 {
 	struct kstat stat;
-	int ret = vfs_stat(filename, &stat);
+	int ret;
+
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
 
+        ret = vfs_stat(filename, &stat);
 	if (!ret)
 		ret = cp_stat64(statbuf, &stat);
 	return ret;
@@ -110,7 +124,20 @@ asmlinkage long sys32_lstat64(const char
 			      struct stat64 __user *statbuf)
 {
 	struct kstat stat;
-	int ret = vfs_lstat(filename, &stat);
+	int ret;
+
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
+        ret = vfs_lstat(filename, &stat);
 	if (!ret)
 		ret = cp_stat64(statbuf, &stat);
 	return ret;
@@ -414,11 +441,22 @@ asmlinkage long sys32_execve(const char 
 	long error;
 	char *filename;
 
+        if ((current->sbox_flags & SBOX_NO_EXEC)) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	filename = getname(name);
 	error = PTR_ERR(filename);
 	if (IS_ERR(filename))
 		return error;
 	error = compat_do_execve(filename, argv, envp, regs);
+
+        if (!error) {
+                if ((current->sbox_flags & SBOX_NO_SYSCALLS))
+                        current->sbox_flags |= SBOX_NO_EXEC;
+        }
+
 	putname(filename);
 	return error;
 }
@@ -462,6 +500,11 @@ long sys32_vm86_warning(void)
 	struct task_struct *me = current;
 	static char lastcomm[sizeof(me->comm)];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (strncmp(lastcomm, me->comm, sizeof(lastcomm))) {
 		compat_printk(KERN_INFO
 			      "%s: vm86 mode not supported on 64 bit kernel\n",
diff -ruNp linux-3.4.10/arch/x86/kernel/ioport.c linux-3.4.10-cher1/arch/x86/kernel/ioport.c
--- linux-3.4.10/arch/x86/kernel/ioport.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/arch/x86/kernel/ioport.c	2012-09-01 20:32:46.058303497 +0400
@@ -26,6 +26,11 @@ asmlinkage long sys_ioperm(unsigned long
 	struct tss_struct *tss;
 	unsigned int i, max_long, bytes, bytes_updated;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
 		return -EINVAL;
 	if (turn_on && !capable(CAP_SYS_RAWIO))
@@ -98,6 +103,11 @@ long sys_iopl(unsigned int level, struct
 	unsigned int old = (regs->flags >> 12) & 3;
 	struct thread_struct *t = &current->thread;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (level > 3)
 		return -EINVAL;
 	/* Trying to gain more privileges? */
diff -ruNp linux-3.4.10/arch/x86/kernel/ldt.c linux-3.4.10-cher1/arch/x86/kernel/ldt.c
--- linux-3.4.10/arch/x86/kernel/ldt.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/arch/x86/kernel/ldt.c	2012-09-01 20:32:46.058303497 +0400
@@ -249,6 +249,11 @@ asmlinkage int sys_modify_ldt(int func, 
 {
 	int ret = -ENOSYS;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	switch (func) {
 	case 0:
 		ret = read_ldt(ptr, bytecount);
diff -ruNp linux-3.4.10/arch/x86/kernel/process.c linux-3.4.10-cher1/arch/x86/kernel/process.c
--- linux-3.4.10/arch/x86/kernel/process.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/arch/x86/kernel/process.c	2012-09-01 20:32:46.058303497 +0400
@@ -331,12 +331,22 @@ long sys_execve(const char __user *name,
 	long error;
 	char *filename;
 
+        if ((current->sbox_flags & SBOX_NO_EXEC)) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	filename = getname(name);
 	error = PTR_ERR(filename);
 	if (IS_ERR(filename))
 		return error;
 	error = do_execve(filename, argv, envp, regs);
 
+        if (!error) {
+                if ((current->sbox_flags & SBOX_NO_SYSCALLS))
+                        current->sbox_flags |= SBOX_NO_EXEC;
+        }
+
 #ifdef CONFIG_X86_32
 	if (error == 0) {
 		/* Make sure we don't return using sysenter.. */
diff -ruNp linux-3.4.10/arch/x86/kernel/signal.c linux-3.4.10-cher1/arch/x86/kernel/signal.c
--- linux-3.4.10/arch/x86/kernel/signal.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/arch/x86/kernel/signal.c	2012-09-01 20:32:46.059303514 +0400
@@ -542,6 +542,9 @@ long
 sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
 		struct pt_regs *regs)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_sigaltstack(uss, uoss, regs->sp);
 }
 
diff -ruNp linux-3.4.10/arch/x86/kernel/vm86_32.c linux-3.4.10-cher1/arch/x86/kernel/vm86_32.c
--- linux-3.4.10/arch/x86/kernel/vm86_32.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/arch/x86/kernel/vm86_32.c	2012-09-01 20:32:46.059303514 +0400
@@ -210,6 +210,11 @@ int sys_vm86old(struct vm86_struct __use
 	struct task_struct *tsk;
 	int tmp, ret = -EPERM;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	tsk = current;
 	if (tsk->thread.saved_sp0)
 		goto out;
@@ -240,6 +245,11 @@ int sys_vm86(unsigned long cmd, unsigned
 	int tmp, ret;
 	struct vm86plus_struct __user *v86;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	tsk = current;
 	switch (cmd) {
 	case VM86_REQUEST_IRQ:
diff -ruNp linux-3.4.10/fs/aio.c linux-3.4.10-cher1/fs/aio.c
--- linux-3.4.10/fs/aio.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/aio.c	2012-09-01 20:32:46.060303531 +0400
@@ -1301,6 +1301,9 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_e
 	unsigned long ctx;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = get_user(ctx, ctxp);
 	if (unlikely(ret))
 		goto out;
@@ -1333,7 +1336,12 @@ out:
  */
 SYSCALL_DEFINE1(io_destroy, aio_context_t, ctx)
 {
-	struct kioctx *ioctx = lookup_ioctx(ctx);
+	struct kioctx *ioctx;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        ioctx = lookup_ioctx(ctx);
 	if (likely(NULL != ioctx)) {
 		io_destroy(ioctx);
 		put_ioctx(ioctx);
@@ -1746,6 +1754,9 @@ long do_io_submit(aio_context_t ctx_id, 
 SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr,
 		struct iocb __user * __user *, iocbpp)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_io_submit(ctx_id, nr, iocbpp, 0);
 }
 
@@ -1787,6 +1798,9 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t
 	u32 key;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = get_user(key, &iocb->aio_key);
 	if (unlikely(ret))
 		return -EFAULT;
@@ -1847,9 +1861,13 @@ SYSCALL_DEFINE5(io_getevents, aio_contex
 		struct io_event __user *, events,
 		struct timespec __user *, timeout)
 {
-	struct kioctx *ioctx = lookup_ioctx(ctx_id);
+	struct kioctx *ioctx;
 	long ret = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        ioctx = lookup_ioctx(ctx_id);
 	if (likely(ioctx)) {
 		if (likely(min_nr <= nr && min_nr >= 0))
 			ret = read_events(ioctx, min_nr, nr, events, timeout);
diff -ruNp linux-3.4.10/fs/buffer.c linux-3.4.10-cher1/fs/buffer.c
--- linux-3.4.10/fs/buffer.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/buffer.c	2012-09-01 20:32:46.061303548 +0400
@@ -3137,6 +3137,9 @@ SYSCALL_DEFINE2(bdflush, int, func, long
 {
 	static int msg_count;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
diff -ruNp linux-3.4.10/fs/compat.c linux-3.4.10-cher1/fs/compat.c
--- linux-3.4.10/fs/compat.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/compat.c	2012-09-01 20:32:46.062303565 +0400
@@ -79,6 +79,11 @@ asmlinkage long compat_sys_utime(const c
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (t) {
 		if (get_user(tv[0].tv_sec, &t->actime) ||
 		    get_user(tv[1].tv_sec, &t->modtime))
@@ -93,6 +98,11 @@ asmlinkage long compat_sys_utimensat(uns
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if  (t) {
 		if (get_compat_timespec(&tv[0], &t[0]) ||
 		    get_compat_timespec(&tv[1], &t[1]))
@@ -108,6 +118,11 @@ asmlinkage long compat_sys_futimesat(uns
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (t) {
 		if (get_user(tv[0].tv_sec, &t[0].tv_sec) ||
 		    get_user(tv[0].tv_nsec, &t[0].tv_usec) ||
@@ -161,12 +176,25 @@ static int cp_compat_stat(struct kstat *
 	return copy_to_user(ubuf, &tmp, sizeof(tmp)) ? -EFAULT : 0;
 }
 
+int cher_patch_is_secure_path(const char*);
+
 asmlinkage long compat_sys_newstat(const char __user * filename,
 		struct compat_stat __user *statbuf)
 {
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
 	error = vfs_stat(filename, &stat);
 	if (error)
 		return error;
@@ -179,6 +207,17 @@ asmlinkage long compat_sys_newlstat(cons
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
 	error = vfs_lstat(filename, &stat);
 	if (error)
 		return error;
@@ -193,6 +232,9 @@ asmlinkage long compat_sys_newfstatat(un
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = vfs_fstatat(dfd, filename, &stat, flag);
 	if (error)
 		return error;
@@ -252,7 +294,12 @@ static int put_compat_statfs(struct comp
 asmlinkage long compat_sys_statfs(const char __user *pathname, struct compat_statfs __user *buf)
 {
 	struct kstatfs tmp;
-	int error = user_statfs(pathname, &tmp);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        error = user_statfs(pathname, &tmp);
 	if (!error)
 		error = put_compat_statfs(buf, &tmp);
 	return error;
@@ -261,7 +308,12 @@ asmlinkage long compat_sys_statfs(const 
 asmlinkage long compat_sys_fstatfs(unsigned int fd, struct compat_statfs __user *buf)
 {
 	struct kstatfs tmp;
-	int error = fd_statfs(fd, &tmp);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        error = fd_statfs(fd, &tmp);
 	if (!error)
 		error = put_compat_statfs(buf, &tmp);
 	return error;
@@ -305,6 +357,9 @@ asmlinkage long compat_sys_statfs64(cons
 	struct kstatfs tmp;
 	int error;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -319,6 +374,9 @@ asmlinkage long compat_sys_fstatfs64(uns
 	struct kstatfs tmp;
 	int error;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -337,7 +395,12 @@ asmlinkage long compat_sys_ustat(unsigne
 {
 	struct compat_ustat tmp;
 	struct kstatfs sbuf;
-	int err = vfs_ustat(new_decode_dev(dev), &sbuf);
+	int err;
+
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        err = vfs_ustat(new_decode_dev(dev), &sbuf);
 	if (err)
 		return err;
 
@@ -408,6 +471,9 @@ asmlinkage long compat_sys_fcntl64(unsig
 	struct flock f;
 	long ret;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	switch (cmd) {
 	case F_GETLK:
 	case F_SETLK:
@@ -485,6 +551,10 @@ compat_sys_io_setup(unsigned nr_reqs, u3
 	aio_context_t ctx64;
 
 	mm_segment_t oldfs = get_fs();
+
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (unlikely(get_user(ctx64, ctx32p)))
 		return -EFAULT;
 
@@ -509,6 +579,9 @@ compat_sys_io_getevents(aio_context_t ct
 	struct timespec t;
 	struct timespec __user *ut = NULL;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = -EFAULT;
 	if (unlikely(!access_ok(VERIFY_WRITE, events, 
 				nr * sizeof(struct io_event))))
@@ -621,6 +694,9 @@ compat_sys_io_submit(aio_context_t ctx_i
 	struct iocb __user * __user *iocb64; 
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (unlikely(nr < 0))
 		return -EINVAL;
 
@@ -779,6 +855,11 @@ asmlinkage long compat_sys_mount(const c
 	char *dir_page;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	retval = copy_mount_string(type, &kernel_type);
 	if (retval < 0)
 		goto out;
@@ -873,6 +954,9 @@ asmlinkage long compat_sys_old_readdir(u
 	struct file *file;
 	struct compat_readdir_callback buf;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EBADF;
 	file = fget(fd);
 	if (!file)
@@ -955,6 +1039,9 @@ asmlinkage long compat_sys_getdents(unsi
 	struct compat_getdents_callback buf;
 	int error;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EFAULT;
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		goto out;
@@ -1043,6 +1130,9 @@ asmlinkage long compat_sys_getdents64(un
 	struct compat_getdents_callback64 buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EFAULT;
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		goto out;
@@ -1177,6 +1267,9 @@ compat_sys_preadv64(unsigned long fd, co
 	int fput_needed;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 	file = fget_light(fd, &fput_needed);
@@ -1243,6 +1336,9 @@ compat_sys_pwritev64(unsigned long fd, c
 	int fput_needed;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 	file = fget_light(fd, &fput_needed);
@@ -1269,6 +1365,12 @@ compat_sys_vmsplice(int fd, const struct
 {
 	unsigned i;
 	struct iovec __user *iov;
+
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (nr_segs > UIO_MAXIOV)
 		return -EINVAL;
 	iov = compat_alloc_user_space(nr_segs * sizeof(struct iovec));
@@ -1300,6 +1402,10 @@ compat_sys_open(const char __user *filen
 asmlinkage long
 compat_sys_openat(unsigned int dfd, const char __user *filename, int flags, umode_t mode)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
 	return do_sys_open(dfd, filename, flags, mode);
 }
 
@@ -1685,6 +1791,9 @@ asmlinkage long compat_sys_epoll_pwait(i
 	compat_sigset_t csigmask;
 	sigset_t ksigmask, sigsaved;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/*
 	 * If the caller wants a certain signal mask to be set during the wait,
 	 * we apply it here.
@@ -1732,6 +1841,9 @@ asmlinkage long compat_sys_signalfd4(int
 	sigset_t tmp;
 	sigset_t __user *ksigmask;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sigsetsize != sizeof(compat_sigset_t))
 		return -EINVAL;
 	if (copy_from_user(&ss32, sigmask, sizeof(ss32)))
@@ -1762,6 +1874,9 @@ asmlinkage long compat_sys_timerfd_setti
 	struct itimerspec t;
 	struct itimerspec __user *ut;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (get_compat_itimerspec(&t, utmr))
 		return -EFAULT;
 	ut = compat_alloc_user_space(2 * sizeof(struct itimerspec));
@@ -1782,6 +1897,9 @@ asmlinkage long compat_sys_timerfd_getti
 	struct itimerspec t;
 	struct itimerspec __user *ut;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ut = compat_alloc_user_space(sizeof(struct itimerspec));
 	error = sys_timerfd_gettime(ufd, ut);
 	if (!error)
@@ -1802,6 +1920,9 @@ asmlinkage long
 compat_sys_open_by_handle_at(int mountdirfd,
 			     struct file_handle __user *handle, int flags)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_handle_open(mountdirfd, handle, flags);
 }
 #endif
diff -ruNp linux-3.4.10/fs/compat_ioctl.c linux-3.4.10-cher1/fs/compat_ioctl.c
--- linux-3.4.10/fs/compat_ioctl.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/compat_ioctl.c	2012-09-01 20:32:46.063303582 +0400
@@ -1535,6 +1535,9 @@ asmlinkage long compat_sys_ioctl(unsigne
 	int error = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	filp = fget_light(fd, &fput_needed);
 	if (!filp)
 		goto out;
diff -ruNp linux-3.4.10/fs/dcache.c linux-3.4.10-cher1/fs/dcache.c
--- linux-3.4.10/fs/dcache.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/dcache.c	2012-09-01 20:32:46.064303599 +0400
@@ -2818,8 +2818,14 @@ SYSCALL_DEFINE2(getcwd, char __user *, b
 {
 	int error;
 	struct path pwd, root;
-	char *page = (char *) __get_free_page(GFP_USER);
+	char *page;
 
+        if (SBOX_IS_RESTRICTED()) {
+                copy_to_user(buf, "/SANDBOX", 9);
+                return 9;
+        }
+
+        page = (char *) __get_free_page(GFP_USER);
 	if (!page)
 		return -ENOMEM;
 
diff -ruNp linux-3.4.10/fs/dcookies.c linux-3.4.10-cher1/fs/dcookies.c
--- linux-3.4.10/fs/dcookies.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/dcookies.c	2012-09-01 20:32:46.064303599 +0400
@@ -154,6 +154,11 @@ SYSCALL_DEFINE(lookup_dcookie)(u64 cooki
 	size_t pathlen;
 	struct dcookie_struct * dcs;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* we could leak path information to users
 	 * without dir read permission without this
 	 */
diff -ruNp linux-3.4.10/fs/eventfd.c linux-3.4.10-cher1/fs/eventfd.c
--- linux-3.4.10/fs/eventfd.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/eventfd.c	2012-09-01 20:32:46.065303616 +0400
@@ -412,6 +412,9 @@ SYSCALL_DEFINE2(eventfd2, unsigned int, 
 	int fd, error;
 	struct file *file;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = get_unused_fd_flags(flags & EFD_SHARED_FCNTL_FLAGS);
 	if (error < 0)
 		return error;
diff -ruNp linux-3.4.10/fs/eventpoll.c linux-3.4.10-cher1/fs/eventpoll.c
--- linux-3.4.10/fs/eventpoll.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/eventpoll.c	2012-09-01 20:32:46.067303651 +0400
@@ -1548,6 +1548,9 @@ SYSCALL_DEFINE1(epoll_create1, int, flag
 	struct eventpoll *ep = NULL;
 	struct file *file;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the EPOLL_* constant for consistency.  */
 	BUILD_BUG_ON(EPOLL_CLOEXEC != O_CLOEXEC);
 
@@ -1608,6 +1611,9 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, in
 	struct epitem *epi;
 	struct epoll_event epds;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EFAULT;
 	if (ep_op_has_event(op) &&
 	    copy_from_user(&epds, event, sizeof(struct epoll_event)))
@@ -1729,6 +1735,9 @@ SYSCALL_DEFINE4(epoll_wait, int, epfd, s
 	struct file *file;
 	struct eventpoll *ep;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* The maximum number of event must be greater than zero */
 	if (maxevents <= 0 || maxevents > EP_MAX_EVENTS)
 		return -EINVAL;
@@ -1782,6 +1791,9 @@ SYSCALL_DEFINE6(epoll_pwait, int, epfd, 
 	int error;
 	sigset_t ksigmask, sigsaved;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/*
 	 * If the caller wants a certain signal mask to be set during the wait,
 	 * we apply it here.
diff -ruNp linux-3.4.10/fs/exec.c linux-3.4.10-cher1/fs/exec.c
--- linux-3.4.10/fs/exec.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/exec.c	2012-09-01 20:32:46.069303687 +0400
@@ -127,6 +127,11 @@ SYSCALL_DEFINE1(uselib, const char __use
 	if (IS_ERR(tmp))
 		goto out;
 
+        if (SBOX_IS_RESTRICTED()) {
+                putname(tmp);
+                return -EPERM;
+        }
+
 	file = do_filp_open(AT_FDCWD, tmp, &uselib_flags, LOOKUP_FOLLOW);
 	putname(tmp);
 	error = PTR_ERR(file);
diff -ruNp linux-3.4.10/fs/fcntl.c linux-3.4.10-cher1/fs/fcntl.c
--- linux-3.4.10/fs/fcntl.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/fcntl.c	2012-09-01 20:32:46.071303723 +0400
@@ -444,6 +444,9 @@ SYSCALL_DEFINE3(fcntl, unsigned int, fd,
 	struct file *filp;
 	long err = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	filp = fget_raw(fd);
 	if (!filp)
 		goto out;
@@ -475,6 +478,9 @@ SYSCALL_DEFINE3(fcntl64, unsigned int, f
 	struct file * filp;
 	long err;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	err = -EBADF;
 	filp = fget_raw(fd);
 	if (!filp)
diff -ruNp linux-3.4.10/fs/fhandle.c linux-3.4.10-cher1/fs/fhandle.c
--- linux-3.4.10/fs/fhandle.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/fhandle.c	2012-09-01 20:32:46.072303741 +0400
@@ -97,6 +97,11 @@ SYSCALL_DEFINE5(name_to_handle_at, int, 
 	int lookup_flags;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
 		return -EINVAL;
 
@@ -260,6 +265,11 @@ SYSCALL_DEFINE3(open_by_handle_at, int, 
 {
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (force_o_largefile())
 		flags |= O_LARGEFILE;
 
diff -ruNp linux-3.4.10/fs/filesystems.c linux-3.4.10-cher1/fs/filesystems.c
--- linux-3.4.10/fs/filesystems.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/filesystems.c	2012-09-01 20:32:46.073303758 +0400
@@ -184,6 +184,9 @@ SYSCALL_DEFINE3(sysfs, int, option, unsi
 {
 	int retval = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	switch (option) {
 		case 1:
 			retval = fs_index((const char __user *) arg1);
diff -ruNp linux-3.4.10/fs/ioctl.c linux-3.4.10-cher1/fs/ioctl.c
--- linux-3.4.10/fs/ioctl.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/ioctl.c	2012-09-01 20:32:46.074303775 +0400
@@ -607,6 +607,9 @@ SYSCALL_DEFINE3(ioctl, unsigned int, fd,
 	int error = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	filp = fget_light(fd, &fput_needed);
 	if (!filp)
 		goto out;
diff -ruNp linux-3.4.10/fs/ioprio.c linux-3.4.10-cher1/fs/ioprio.c
--- linux-3.4.10/fs/ioprio.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/ioprio.c	2012-09-01 20:32:46.075303792 +0400
@@ -67,6 +67,9 @@ SYSCALL_DEFINE3(ioprio_set, int, which, 
 	struct pid *pgrp;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	switch (class) {
 		case IOPRIO_CLASS_RT:
 			if (!capable(CAP_SYS_ADMIN))
@@ -177,6 +180,9 @@ SYSCALL_DEFINE2(ioprio_get, int, which, 
 	int ret = -ESRCH;
 	int tmpio;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	rcu_read_lock();
 	switch (which) {
 		case IOPRIO_WHO_PROCESS:
diff -ruNp linux-3.4.10/fs/locks.c linux-3.4.10-cher1/fs/locks.c
--- linux-3.4.10/fs/locks.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/locks.c	2012-09-01 20:32:46.076303809 +0400
@@ -1640,6 +1640,9 @@ SYSCALL_DEFINE2(flock, unsigned int, fd,
 	int can_sleep, unlock;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EBADF;
 	filp = fget(fd);
 	if (!filp)
diff -ruNp linux-3.4.10/fs/namei.c linux-3.4.10-cher1/fs/namei.c
--- linux-3.4.10/fs/namei.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/namei.c	2012-09-01 20:32:46.079303860 +0400
@@ -2576,6 +2576,11 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (S_ISDIR(mode))
 		return -EPERM;
 
@@ -2652,6 +2657,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	dentry = user_path_create(dfd, pathname, &path, 1);
 	if (IS_ERR(dentry))
 		return PTR_ERR(dentry);
@@ -2795,6 +2805,9 @@ exit1:
 
 SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_rmdir(AT_FDCWD, pathname);
 }
 
@@ -2893,6 +2906,11 @@ slashes:
 
 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((flag & ~AT_REMOVEDIR) != 0)
 		return -EINVAL;
 
@@ -2904,6 +2922,9 @@ SYSCALL_DEFINE3(unlinkat, int, dfd, cons
 
 SYSCALL_DEFINE1(unlink, const char __user *, pathname)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_unlinkat(AT_FDCWD, pathname);
 }
 
@@ -2935,6 +2956,9 @@ SYSCALL_DEFINE3(symlinkat, const char __
 	struct dentry *dentry;
 	struct path path;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	from = getname(oldname);
 	if (IS_ERR(from))
 		return PTR_ERR(from);
@@ -3028,6 +3052,9 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
 	int how = 0;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
 		return -EINVAL;
 	/*
@@ -3243,6 +3270,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
 	char *to;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = user_path_parent(olddfd, oldname, &oldnd, &from);
 	if (error)
 		goto exit;
diff -ruNp linux-3.4.10/fs/namespace.c linux-3.4.10-cher1/fs/namespace.c
--- linux-3.4.10/fs/namespace.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/namespace.c	2012-09-01 20:32:46.082303911 +0400
@@ -1193,6 +1193,11 @@ SYSCALL_DEFINE2(umount, char __user *, n
 	int retval;
 	int lookup_flags = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
 		return -EINVAL;
 
@@ -2367,6 +2372,11 @@ SYSCALL_DEFINE5(mount, char __user *, de
 	char *kernel_dev;
 	unsigned long data_page;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ret = copy_mount_string(type, &kernel_type);
 	if (ret < 0)
 		goto out_type;
@@ -2456,6 +2466,11 @@ SYSCALL_DEFINE2(pivot_root, const char _
 	struct mount *new_mnt, *root_mnt;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
diff -ruNp linux-3.4.10/fs/notify/fanotify/fanotify_user.c linux-3.4.10-cher1/fs/notify/fanotify/fanotify_user.c
--- linux-3.4.10/fs/notify/fanotify/fanotify_user.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/notify/fanotify/fanotify_user.c	2012-09-01 20:32:46.084303947 +0400
@@ -682,6 +682,9 @@ SYSCALL_DEFINE2(fanotify_init, unsigned 
 	int f_flags, fd;
 	struct user_struct *user;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	pr_debug("%s: flags=%d event_f_flags=%d\n",
 		__func__, flags, event_f_flags);
 
@@ -775,6 +778,9 @@ SYSCALL_DEFINE(fanotify_mark)(int fanoti
 	struct path path;
 	int ret, fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	pr_debug("%s: fanotify_fd=%d flags=%x dfd=%d pathname=%p mask=%llx\n",
 		 __func__, fanotify_fd, flags, dfd, pathname, mask);
 
diff -ruNp linux-3.4.10/fs/notify/inotify/inotify_user.c linux-3.4.10-cher1/fs/notify/inotify/inotify_user.c
--- linux-3.4.10/fs/notify/inotify/inotify_user.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/notify/inotify/inotify_user.c	2012-09-01 20:32:46.086303983 +0400
@@ -726,6 +726,9 @@ SYSCALL_DEFINE1(inotify_init1, int, flag
 	struct fsnotify_group *group;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the IN_* constants for consistency.  */
 	BUILD_BUG_ON(IN_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(IN_NONBLOCK != O_NONBLOCK);
@@ -761,6 +764,9 @@ SYSCALL_DEFINE3(inotify_add_watch, int, 
 	int ret, fput_needed;
 	unsigned flags = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	filp = fget_light(fd, &fput_needed);
 	if (unlikely(!filp))
 		return -EBADF;
@@ -799,6 +805,9 @@ SYSCALL_DEFINE2(inotify_rm_watch, int, f
 	struct file *filp;
 	int ret = 0, fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	filp = fget_light(fd, &fput_needed);
 	if (unlikely(!filp))
 		return -EBADF;
diff -ruNp linux-3.4.10/fs/open.c linux-3.4.10-cher1/fs/open.c
--- linux-3.4.10/fs/open.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/open.c	2012-09-01 20:32:46.088304019 +0400
@@ -127,6 +127,8 @@ out:
 
 SYSCALL_DEFINE2(truncate, const char __user *, path, long, length)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 	return do_sys_truncate(path, length);
 }
 
@@ -187,11 +189,15 @@ SYSCALL_DEFINE2(ftruncate, unsigned int,
 #if BITS_PER_LONG == 32
 SYSCALL_DEFINE(truncate64)(const char __user * path, loff_t length)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 	return do_sys_truncate(path, length);
 }
 #ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
 asmlinkage long SyS_truncate64(long path, loff_t length)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 	return SYSC_truncate64((const char __user *) path, length);
 }
 SYSCALL_ALIAS(sys_truncate64, SyS_truncate64);
@@ -291,6 +297,8 @@ asmlinkage long SyS_fallocate(long fd, l
 SYSCALL_ALIAS(sys_fallocate, SyS_fallocate);
 #endif
 
+int cher_patch_is_secure_path(const char*);
+
 /*
  * access() needs to use the real uid/gid, not the effective uid/gid.
  * We do this by temporarily clearing all FS-related capabilities and
@@ -304,6 +312,19 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
 	struct inode *inode;
 	int res;
 
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp;
+                if (dfd != AT_FDCWD) return -EPERM;
+                tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp("/SANDBOX/", tmp, 9)) filename += 9;
+                putname(tmp);
+        }
+
 	if (mode & ~S_IRWXO)	/* where's F_OK, X_OK, W_OK, R_OK? */
 		return -EINVAL;
 
@@ -376,6 +397,11 @@ SYSCALL_DEFINE1(chdir, const char __user
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_dir(filename, &path);
 	if (error)
 		goto out;
@@ -398,6 +424,11 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
 	struct inode *inode;
 	int error, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = -EBADF;
 	file = fget_raw_light(fd, &fput_needed);
 	if (!file)
@@ -423,6 +454,11 @@ SYSCALL_DEFINE1(chroot, const char __use
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_dir(filename, &path);
 	if (error)
 		goto out;
@@ -473,6 +509,9 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
 	struct file * file;
 	int err = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	file = fget(fd);
 	if (file) {
 		audit_inode(NULL, file->f_path.dentry);
@@ -487,6 +526,9 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = user_path_at(dfd, filename, LOOKUP_FOLLOW, &path);
 	if (!error) {
 		error = chmod_common(&path, mode);
@@ -532,6 +574,11 @@ SYSCALL_DEFINE3(chown, const char __user
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path(filename, &path);
 	if (error)
 		goto out;
@@ -553,6 +600,11 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
 	int error = -EINVAL;
 	int lookup_flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
 		goto out;
 
@@ -578,6 +630,11 @@ SYSCALL_DEFINE3(lchown, const char __use
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_lpath(filename, &path);
 	if (error)
 		goto out;
@@ -598,6 +655,11 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
 	int error = -EBADF;
 	struct dentry * dentry;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	file = fget(fd);
 	if (!file)
 		goto out;
@@ -970,17 +1032,62 @@ struct file *file_open_root(struct dentr
 }
 EXPORT_SYMBOL(file_open_root);
 
+static const char * const secure_paths[] =
+{
+        "/lib/", "/lib32/", "/lib64/",
+        "/usr/lib/", "/usr/lib32/", "/usr/lib64/",
+        "/usr/include/", "/usr/libexec/",
+        "/usr/local/lib/", "/usr/local/lib32/", "/usr/local/lib64/",
+        "/usr/local/include/", "/usr/local/libexec/",
+        "/bin/", "/usr/bin/", "/usr/local/bin/",
+        "/usr/share/", "/usr/local/share/",
+        "/SANDBOX/",
+        NULL
+};
+
+int cher_patch_is_secure_path(const char *path)
+{
+        const char *s;
+        int i;
+
+        if (strstr(path, ".."))
+                return -1;
+        for (i = 0; secure_paths[i] && strncmp(path, secure_paths[i], strlen(secure_paths[i])); ++i);
+        if (secure_paths[i]) {
+                return 0;
+        }
+
+        if (!strncmp(path, "/SANDBOX/", 9)) path += 9;
+        s = path;
+        while (s[0] == '.' && s[1] == '/') s += 2;
+        for (; *s && *s != '/'; s++);
+        if (*s == '/') return -1;
+        return 0;
+}
+
 long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
 {
 	struct open_flags op;
-	int lookup = build_open_flags(flags, mode, &op);
+	int lookup;
 	char *tmp = getname(filename);
-	int fd = PTR_ERR(tmp);
+        char *tmpname = tmp;
+	int fd;
 
+        if (!IS_ERR(tmp) && SBOX_IS_RESTRICTED()) {
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) tmpname += 9;
+                flags &= ~(O_CREAT | O_EXCL);
+        }
+
+        lookup = build_open_flags(flags, mode, &op);
+        fd = PTR_ERR(tmp);
 	if (!IS_ERR(tmp)) {
 		fd = get_unused_fd_flags(flags);
 		if (fd >= 0) {
-			struct file *f = do_filp_open(dfd, tmp, &op, lookup);
+			struct file *f = do_filp_open(dfd, tmpname, &op, lookup);
 			if (IS_ERR(f)) {
 				put_unused_fd(fd);
 				fd = PTR_ERR(f);
@@ -1012,6 +1119,11 @@ SYSCALL_DEFINE4(openat, int, dfd, const 
 {
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (force_o_largefile())
 		flags |= O_LARGEFILE;
 
@@ -1106,6 +1218,10 @@ EXPORT_SYMBOL(sys_close);
  */
 SYSCALL_DEFINE0(vhangup)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
 	if (capable(CAP_SYS_TTY_CONFIG)) {
 		tty_vhangup_self();
 		return 0;
diff -ruNp linux-3.4.10/fs/pipe.c linux-3.4.10-cher1/fs/pipe.c
--- linux-3.4.10/fs/pipe.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/pipe.c	2012-09-01 20:32:46.090304053 +0400
@@ -1132,6 +1132,11 @@ SYSCALL_DEFINE2(pipe2, int __user *, fil
 	int fd[2];
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = do_pipe_flags(fd, flags);
 	if (!error) {
 		if (copy_to_user(fildes, fd, sizeof(fd))) {
diff -ruNp linux-3.4.10/fs/quota/compat.c linux-3.4.10-cher1/fs/quota/compat.c
--- linux-3.4.10/fs/quota/compat.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/quota/compat.c	2012-09-01 20:32:46.091304070 +0400
@@ -52,6 +52,11 @@ asmlinkage long sys32_quotactl(unsigned 
 	u16 xdata;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	cmds = cmd >> SUBCMDSHIFT;
 
 	switch (cmds) {
diff -ruNp linux-3.4.10/fs/quota/quota.c linux-3.4.10-cher1/fs/quota/quota.c
--- linux-3.4.10/fs/quota/quota.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/quota/quota.c	2012-09-01 20:32:46.092304087 +0400
@@ -351,6 +351,11 @@ SYSCALL_DEFINE4(quotactl, unsigned int, 
 	struct path path, *pathp = NULL;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	cmds = cmd >> SUBCMDSHIFT;
 	type = cmd & SUBCMDMASK;
 
diff -ruNp linux-3.4.10/fs/readdir.c linux-3.4.10-cher1/fs/readdir.c
--- linux-3.4.10/fs/readdir.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/readdir.c	2012-09-01 20:32:46.094304121 +0400
@@ -109,6 +109,9 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
 	struct file * file;
 	struct readdir_callback buf;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EBADF;
 	file = fget(fd);
 	if (!file)
@@ -197,6 +200,9 @@ SYSCALL_DEFINE3(getdents, unsigned int, 
 	struct getdents_callback buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EFAULT;
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		goto out;
@@ -280,6 +286,9 @@ SYSCALL_DEFINE3(getdents64, unsigned int
 	struct getdents_callback64 buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EFAULT;
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		goto out;
diff -ruNp linux-3.4.10/fs/read_write.c linux-3.4.10-cher1/fs/read_write.c
--- linux-3.4.10/fs/read_write.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/read_write.c	2012-09-01 20:32:46.095304138 +0400
@@ -499,6 +499,9 @@ SYSCALL_DEFINE(pread64)(unsigned int fd,
 	ssize_t ret = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -528,6 +531,9 @@ SYSCALL_DEFINE(pwrite64)(unsigned int fd
 	ssize_t ret = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -841,6 +847,9 @@ SYSCALL_DEFINE5(preadv, unsigned long, f
 	ssize_t ret = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -866,6 +875,9 @@ SYSCALL_DEFINE5(pwritev, unsigned long, 
 	ssize_t ret = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
diff -ruNp linux-3.4.10/fs/signalfd.c linux-3.4.10-cher1/fs/signalfd.c
--- linux-3.4.10/fs/signalfd.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/signalfd.c	2012-09-01 20:32:46.096304155 +0400
@@ -240,6 +240,9 @@ SYSCALL_DEFINE4(signalfd4, int, ufd, sig
 	sigset_t sigmask;
 	struct signalfd_ctx *ctx;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the SFD_* constants for consistency.  */
 	BUILD_BUG_ON(SFD_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(SFD_NONBLOCK != O_NONBLOCK);
diff -ruNp linux-3.4.10/fs/splice.c linux-3.4.10-cher1/fs/splice.c
--- linux-3.4.10/fs/splice.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/splice.c	2012-09-01 20:32:46.098304189 +0400
@@ -1665,6 +1665,11 @@ SYSCALL_DEFINE4(vmsplice, int, fd, const
 	long error;
 	int fput;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (unlikely(nr_segs > UIO_MAXIOV))
 		return -EINVAL;
 	else if (unlikely(!nr_segs))
@@ -1692,6 +1697,11 @@ SYSCALL_DEFINE6(splice, int, fd_in, loff
 	struct file *in, *out;
 	int fput_in, fput_out;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (unlikely(!len))
 		return 0;
 
@@ -2025,6 +2035,11 @@ SYSCALL_DEFINE4(tee, int, fdin, int, fdo
 	struct file *in;
 	int error, fput_in;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (unlikely(!len))
 		return 0;
 
diff -ruNp linux-3.4.10/fs/stat.c linux-3.4.10-cher1/fs/stat.c
--- linux-3.4.10/fs/stat.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/stat.c	2012-09-01 20:32:46.100304225 +0400
@@ -151,12 +151,25 @@ static int cp_old_stat(struct kstat *sta
 	return copy_to_user(statbuf,&tmp,sizeof(tmp)) ? -EFAULT : 0;
 }
 
+int cher_patch_is_secure_path(const char *);
+
 SYSCALL_DEFINE2(stat, const char __user *, filename,
 		struct __old_kernel_stat __user *, statbuf)
 {
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
 	error = vfs_stat(filename, &stat);
 	if (error)
 		return error;
@@ -170,6 +183,17 @@ SYSCALL_DEFINE2(lstat, const char __user
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
 	error = vfs_lstat(filename, &stat);
 	if (error)
 		return error;
@@ -244,8 +268,20 @@ SYSCALL_DEFINE2(newstat, const char __us
 		struct stat __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_stat(filename, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
 
+        error = vfs_stat(filename, &stat);
 	if (error)
 		return error;
 	return cp_new_stat(&stat, statbuf);
@@ -257,6 +293,17 @@ SYSCALL_DEFINE2(newlstat, const char __u
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
 	error = vfs_lstat(filename, &stat);
 	if (error)
 		return error;
@@ -271,6 +318,9 @@ SYSCALL_DEFINE4(newfstatat, int, dfd, co
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = vfs_fstatat(dfd, filename, &stat, flag);
 	if (error)
 		return error;
@@ -296,6 +346,9 @@ SYSCALL_DEFINE4(readlinkat, int, dfd, co
 	int error;
 	int empty = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (bufsiz <= 0)
 		return -EINVAL;
 
@@ -368,8 +421,20 @@ SYSCALL_DEFINE2(stat64, const char __use
 		struct stat64 __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_stat(filename, &stat);
+	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
+        error = vfs_stat(filename, &stat);
 	if (!error)
 		error = cp_new_stat64(&stat, statbuf);
 
@@ -380,8 +445,20 @@ SYSCALL_DEFINE2(lstat64, const char __us
 		struct stat64 __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_lstat(filename, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
 
+        error = vfs_lstat(filename, &stat);
 	if (!error)
 		error = cp_new_stat64(&stat, statbuf);
 
diff -ruNp linux-3.4.10/fs/statfs.c linux-3.4.10-cher1/fs/statfs.c
--- linux-3.4.10/fs/statfs.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/statfs.c	2012-09-01 20:32:46.101304243 +0400
@@ -165,7 +165,12 @@ static int do_statfs64(struct kstatfs *s
 SYSCALL_DEFINE2(statfs, const char __user *, pathname, struct statfs __user *, buf)
 {
 	struct kstatfs st;
-	int error = user_statfs(pathname, &st);
+	int error = 0;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	error = user_statfs(pathname, &st);
 	if (!error)
 		error = do_statfs_native(&st, buf);
 	return error;
@@ -175,6 +180,10 @@ SYSCALL_DEFINE3(statfs64, const char __u
 {
 	struct kstatfs st;
 	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 	error = user_statfs(pathname, &st);
@@ -186,7 +195,12 @@ SYSCALL_DEFINE3(statfs64, const char __u
 SYSCALL_DEFINE2(fstatfs, unsigned int, fd, struct statfs __user *, buf)
 {
 	struct kstatfs st;
-	int error = fd_statfs(fd, &st);
+	int error = 0;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	error = fd_statfs(fd, &st);
 	if (!error)
 		error = do_statfs_native(&st, buf);
 	return error;
@@ -197,6 +211,9 @@ SYSCALL_DEFINE3(fstatfs64, unsigned int,
 	struct kstatfs st;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -222,7 +239,12 @@ SYSCALL_DEFINE2(ustat, unsigned, dev, st
 {
 	struct ustat tmp;
 	struct kstatfs sbuf;
-	int err = vfs_ustat(new_decode_dev(dev), &sbuf);
+	int err = 0;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	err = vfs_ustat(new_decode_dev(dev), &sbuf);
 	if (err)
 		return err;
 
diff -ruNp linux-3.4.10/fs/sync.c linux-3.4.10-cher1/fs/sync.c
--- linux-3.4.10/fs/sync.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/sync.c	2012-09-01 20:32:46.103304279 +0400
@@ -97,6 +97,9 @@ static void sync_filesystems(int wait)
  */
 SYSCALL_DEFINE0(sync)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	wakeup_flusher_threads(0, WB_REASON_SYNC);
 	sync_filesystems(0);
 	sync_filesystems(1);
@@ -138,6 +141,9 @@ SYSCALL_DEFINE1(syncfs, int, fd)
 	int ret;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	file = fget_light(fd, &fput_needed);
 	if (!file)
 		return -EBADF;
@@ -199,11 +205,17 @@ static int do_fsync(unsigned int fd, int
 
 SYSCALL_DEFINE1(fsync, unsigned int, fd)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_fsync(fd, 0);
 }
 
 SYSCALL_DEFINE1(fdatasync, unsigned int, fd)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_fsync(fd, 1);
 }
 
@@ -281,6 +293,9 @@ SYSCALL_DEFINE(sync_file_range)(int fd, 
 	int fput_needed;
 	umode_t i_mode;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = -EINVAL;
 	if (flags & ~VALID_FLAGS)
 		goto out;
diff -ruNp linux-3.4.10/fs/timerfd.c linux-3.4.10-cher1/fs/timerfd.c
--- linux-3.4.10/fs/timerfd.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/timerfd.c	2012-09-01 20:32:46.104304297 +0400
@@ -254,6 +254,9 @@ SYSCALL_DEFINE2(timerfd_create, int, clo
 	int ufd;
 	struct timerfd_ctx *ctx;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the TFD_* constants for consistency.  */
 	BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(TFD_NONBLOCK != O_NONBLOCK);
@@ -289,6 +292,9 @@ SYSCALL_DEFINE4(timerfd_settime, int, uf
 	struct itimerspec ktmr, kotmr;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (copy_from_user(&ktmr, utmr, sizeof(ktmr)))
 		return -EFAULT;
 
@@ -347,6 +353,9 @@ SYSCALL_DEFINE2(timerfd_gettime, int, uf
 	struct timerfd_ctx *ctx;
 	struct itimerspec kotmr;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	file = timerfd_fget(ufd);
 	if (IS_ERR(file))
 		return PTR_ERR(file);
diff -ruNp linux-3.4.10/fs/utimes.c linux-3.4.10-cher1/fs/utimes.c
--- linux-3.4.10/fs/utimes.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/utimes.c	2012-09-01 20:32:46.105304314 +0400
@@ -28,6 +28,9 @@ SYSCALL_DEFINE2(utime, char __user *, fi
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (times) {
 		if (get_user(tv[0].tv_sec, &times->actime) ||
 		    get_user(tv[1].tv_sec, &times->modtime))
@@ -176,6 +179,9 @@ SYSCALL_DEFINE4(utimensat, int, dfd, con
 {
 	struct timespec tstimes[2];
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (utimes) {
 		if (copy_from_user(&tstimes, utimes, sizeof(tstimes)))
 			return -EFAULT;
@@ -195,6 +201,9 @@ SYSCALL_DEFINE3(futimesat, int, dfd, con
 	struct timeval times[2];
 	struct timespec tstimes[2];
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (utimes) {
 		if (copy_from_user(&times, utimes, sizeof(times)))
 			return -EFAULT;
diff -ruNp linux-3.4.10/fs/xattr.c linux-3.4.10-cher1/fs/xattr.c
--- linux-3.4.10/fs/xattr.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/fs/xattr.c	2012-09-01 20:32:46.106304331 +0400
@@ -365,6 +365,11 @@ SYSCALL_DEFINE5(setxattr, const char __u
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path(pathname, &path);
 	if (error)
 		return error;
@@ -384,6 +389,11 @@ SYSCALL_DEFINE5(lsetxattr, const char __
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_lpath(pathname, &path);
 	if (error)
 		return error;
@@ -403,6 +413,11 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
 	struct dentry *dentry;
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	f = fget(fd);
 	if (!f)
 		return error;
@@ -461,6 +476,11 @@ SYSCALL_DEFINE4(getxattr, const char __u
 	struct path path;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path(pathname, &path);
 	if (error)
 		return error;
@@ -475,6 +495,11 @@ SYSCALL_DEFINE4(lgetxattr, const char __
 	struct path path;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_lpath(pathname, &path);
 	if (error)
 		return error;
@@ -489,6 +514,11 @@ SYSCALL_DEFINE4(fgetxattr, int, fd, cons
 	struct file *f;
 	ssize_t error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	f = fget(fd);
 	if (!f)
 		return error;
@@ -542,6 +572,11 @@ SYSCALL_DEFINE3(listxattr, const char __
 	struct path path;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path(pathname, &path);
 	if (error)
 		return error;
@@ -556,6 +591,11 @@ SYSCALL_DEFINE3(llistxattr, const char _
 	struct path path;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_lpath(pathname, &path);
 	if (error)
 		return error;
@@ -569,6 +609,11 @@ SYSCALL_DEFINE3(flistxattr, int, fd, cha
 	struct file *f;
 	ssize_t error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	f = fget(fd);
 	if (!f)
 		return error;
@@ -602,6 +647,11 @@ SYSCALL_DEFINE2(removexattr, const char 
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path(pathname, &path);
 	if (error)
 		return error;
@@ -620,6 +670,11 @@ SYSCALL_DEFINE2(lremovexattr, const char
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_lpath(pathname, &path);
 	if (error)
 		return error;
@@ -638,6 +693,11 @@ SYSCALL_DEFINE2(fremovexattr, int, fd, c
 	struct dentry *dentry;
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	f = fget(fd);
 	if (!f)
 		return error;
diff -ruNp linux-3.4.10/include/linux/ptrace.h linux-3.4.10-cher1/include/linux/ptrace.h
--- linux-3.4.10/include/linux/ptrace.h	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/include/linux/ptrace.h	2012-09-01 20:32:46.108304365 +0400
@@ -47,6 +47,10 @@
 #define PTRACE_GETREGSET	0x4204
 #define PTRACE_SETREGSET	0x4205
 
+#define PTRACE_MEMLIMIT         0x4280
+#define PTRACE_NO_SYSCALLS      0x4281
+#define PTRACE_TIMELIMIT        0x4282
+
 #define PTRACE_SEIZE		0x4206
 #define PTRACE_INTERRUPT	0x4207
 #define PTRACE_LISTEN		0x4208
diff -ruNp linux-3.4.10/include/linux/sched.h linux-3.4.10-cher1/include/linux/sched.h
--- linux-3.4.10/include/linux/sched.h	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/include/linux/sched.h	2012-09-01 20:32:46.110304399 +0400
@@ -1261,6 +1261,17 @@ enum perf_event_task_context {
 	perf_nr_task_contexts,
 };
 
+/* sandbox flags */
+enum {
+	SBOX_NO_SYSCALLS  = 1,   /* disable most "dangerous" syscalls */
+	SBOX_NO_EXEC      = 2,   /* disable exec syscall */
+	SBOX_MEMLIMITON   = 4,   /* enable memory limit check */
+	SBOX_WAS_MEMLIMIT = 8,   /* memory limit happened?  */
+	SBOX_WAS_SECURITY = 16,  /* was security violation? */
+	SBOX_TLON         = 32,  /* enable kernel time limit check */
+	SBOX_WAS_TL       = 64   /* was time limit? */
+};
+
 struct task_struct {
 	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
 	void *stack;
@@ -1617,8 +1628,19 @@ struct task_struct {
 #ifdef CONFIG_HAVE_HW_BREAKPOINT
 	atomic_t ptrace_bp_refcnt;
 #endif
+
+	/* sandbox flags */
+	int sbox_flags;
 };
 
+#define SBOX_IS_RESTRICTED() unlikely(current->sbox_flags & SBOX_NO_SYSCALLS)
+#define SBOX_SET_SECURITY_ERR() do { current->sbox_flags |= SBOX_WAS_SECURITY; printk(KERN_ERR "%s: %s: %d: security violation\n", __FUNCTION__, __FILE__, __LINE__); } while (0)
+#define SBOX_SET_TL_ERR() (current->sbox_flags |= SBOX_WAS_TL)
+
+#define SBOX_IS_MEMLIMIT_ERR(p) (p->sbox_flags & SBOX_WAS_MEMLIMIT)
+#define SBOX_IS_SECURITY_ERR(p) (p->sbox_flags & SBOX_WAS_SECURITY)
+#define SBOX_IS_TL_ERR(p) (p->sbox_flags & SBOX_WAS_TL)
+
 /* Future-safe accessor for struct task_struct's cpus_allowed. */
 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
 
diff -ruNp linux-3.4.10/ipc/mqueue.c linux-3.4.10-cher1/ipc/mqueue.c
--- linux-3.4.10/ipc/mqueue.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/ipc/mqueue.c	2012-09-01 20:32:46.113304450 +0400
@@ -683,6 +683,11 @@ SYSCALL_DEFINE4(mq_open, const char __us
 	int fd, error;
 	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_attr && copy_from_user(&attr, u_attr, sizeof(struct mq_attr)))
 		return -EFAULT;
 
@@ -754,6 +759,11 @@ SYSCALL_DEFINE1(mq_unlink, const char __
 	struct inode *inode = NULL;
 	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	name = getname(u_name);
 	if (IS_ERR(name))
 		return PTR_ERR(name);
@@ -854,6 +864,11 @@ SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqd
 	struct timespec ts;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_abs_timeout) {
 		int res = prepare_timeout(u_abs_timeout, &expires, &ts);
 		if (res)
@@ -947,6 +962,11 @@ SYSCALL_DEFINE5(mq_timedreceive, mqd_t, 
 	ktime_t expires, *timeout = NULL;
 	struct timespec ts;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_abs_timeout) {
 		int res = prepare_timeout(u_abs_timeout, &expires, &ts);
 		if (res)
@@ -1034,6 +1054,11 @@ SYSCALL_DEFINE2(mq_notify, mqd_t, mqdes,
 	struct mqueue_inode_info *info;
 	struct sk_buff *nc;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_notification) {
 		if (copy_from_user(&notification, u_notification,
 					sizeof(struct sigevent)))
@@ -1164,6 +1189,11 @@ SYSCALL_DEFINE3(mq_getsetattr, mqd_t, mq
 	struct inode *inode;
 	struct mqueue_inode_info *info;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_mqstat != NULL) {
 		if (copy_from_user(&mqstat, u_mqstat, sizeof(struct mq_attr)))
 			return -EFAULT;
diff -ruNp linux-3.4.10/ipc/msg.c linux-3.4.10-cher1/ipc/msg.c
--- linux-3.4.10/ipc/msg.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/ipc/msg.c	2012-09-01 20:32:46.114304467 +0400
@@ -315,6 +315,11 @@ SYSCALL_DEFINE2(msgget, key_t, key, int,
 	struct ipc_ops msg_ops;
 	struct ipc_params msg_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	msg_ops.getnew = newque;
@@ -472,6 +477,11 @@ SYSCALL_DEFINE3(msgctl, int, msqid, int,
 	int err, version;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (msqid < 0 || cmd < 0)
 		return -EINVAL;
 
@@ -728,6 +738,11 @@ SYSCALL_DEFINE4(msgsnd, int, msqid, stru
 {
 	long mtype;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(mtype, &msgp->mtype))
 		return -EFAULT;
 	return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
@@ -909,6 +924,11 @@ SYSCALL_DEFINE5(msgrcv, int, msqid, stru
 {
 	long err, mtype;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err =  do_msgrcv(msqid, &mtype, msgp->mtext, msgsz, msgtyp, msgflg);
 	if (err < 0)
 		goto out;
diff -ruNp linux-3.4.10/ipc/sem.c linux-3.4.10-cher1/ipc/sem.c
--- linux-3.4.10/ipc/sem.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/ipc/sem.c	2012-09-01 20:32:46.116304503 +0400
@@ -370,6 +370,11 @@ SYSCALL_DEFINE3(semget, key_t, key, int,
 	struct ipc_ops sem_ops;
 	struct ipc_params sem_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	if (nsems < 0 || nsems > ns->sc_semmsl)
@@ -1124,6 +1129,11 @@ SYSCALL_DEFINE(semctl)(int semid, int se
 	int version;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (semid < 0)
 		return -EINVAL;
 
@@ -1341,6 +1351,11 @@ SYSCALL_DEFINE4(semtimedop, int, semid, 
 	struct ipc_namespace *ns;
 	struct list_head tasks;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	if (nsops < 1 || semid < 0)
diff -ruNp linux-3.4.10/ipc/shm.c linux-3.4.10-cher1/ipc/shm.c
--- linux-3.4.10/ipc/shm.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/ipc/shm.c	2012-09-01 20:32:46.118304539 +0400
@@ -565,6 +565,11 @@ SYSCALL_DEFINE3(shmget, key_t, key, size
 	struct ipc_ops shm_ops;
 	struct ipc_params shm_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	shm_ops.getnew = newseg;
@@ -765,6 +770,11 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int,
 	int err, version;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (cmd < 0 || shmid < 0) {
 		err = -EINVAL;
 		goto out;
@@ -1090,6 +1100,11 @@ SYSCALL_DEFINE3(shmat, int, shmid, char 
 	unsigned long ret;
 	long err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = do_shmat(shmid, shmaddr, shmflg, &ret);
 	if (err)
 		return err;
@@ -1112,6 +1127,11 @@ SYSCALL_DEFINE1(shmdt, char __user *, sh
 	struct vm_area_struct *next;
 #endif
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (addr & ~PAGE_MASK)
 		return retval;
 
diff -ruNp linux-3.4.10/ipc/syscall.c linux-3.4.10-cher1/ipc/syscall.c
--- linux-3.4.10/ipc/syscall.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/ipc/syscall.c	2012-09-01 20:32:46.119304557 +0400
@@ -18,6 +18,11 @@ SYSCALL_DEFINE6(ipc, unsigned int, call,
 {
 	int version, ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	version = call >> 16; /* hack for backward compatibility */
 	call &= 0xffff;
 
diff -ruNp linux-3.4.10/kernel/acct.c linux-3.4.10-cher1/kernel/acct.c
--- linux-3.4.10/kernel/acct.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/acct.c	2012-09-01 20:32:46.121304592 +0400
@@ -256,6 +256,11 @@ SYSCALL_DEFINE1(acct, const char __user 
 {
 	int error = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_PACCT))
 		return -EPERM;
 
diff -ruNp linux-3.4.10/kernel/capability.c linux-3.4.10-cher1/kernel/capability.c
--- linux-3.4.10/kernel/capability.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/capability.c	2012-09-01 20:32:46.122304609 +0400
@@ -238,6 +238,11 @@ SYSCALL_DEFINE2(capset, cap_user_header_
 	int ret;
 	pid_t pid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ret = cap_validate_magic(header, &tocopy);
 	if (ret != 0)
 		return ret;
diff -ruNp linux-3.4.10/kernel/compat.c linux-3.4.10-cher1/kernel/compat.c
--- linux-3.4.10/kernel/compat.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/compat.c	2012-09-01 20:32:46.123304626 +0400
@@ -133,6 +133,11 @@ asmlinkage long compat_sys_settimeofday(
 	struct timespec kts;
 	struct timezone ktz;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (tv) {
 		if (compat_get_timeval_convert(&kts, tv))
 			return -EFAULT;
@@ -429,6 +434,11 @@ asmlinkage long compat_sys_setrlimit(uns
 {
 	struct rlimit r;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!access_ok(VERIFY_READ, rlim, sizeof(*rlim)) ||
 	    __get_user(r.rlim_cur, &rlim->rlim_cur) ||
 	    __get_user(r.rlim_max, &rlim->rlim_max))
@@ -615,6 +625,11 @@ asmlinkage long compat_sys_sched_setaffi
 	cpumask_var_t new_mask;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!alloc_cpumask_var(&new_mask, GFP_KERNEL))
 		return -ENOMEM;
 
@@ -1045,6 +1060,11 @@ asmlinkage long compat_sys_stime(compat_
 	struct timespec tv;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(tv.tv_sec, tptr))
 		return -EFAULT;
 
@@ -1090,6 +1110,11 @@ asmlinkage long compat_sys_adjtimex(stru
 	struct timex txc;
 	int err, ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = compat_get_timex(&txc, utp);
 	if (err)
 		return err;
@@ -1113,6 +1138,11 @@ asmlinkage long compat_sys_move_pages(pi
 	const void __user * __user *pages;
 	int i;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	pages = compat_alloc_user_space(nr_pages * sizeof(void *));
 	for (i = 0; i < nr_pages; i++) {
 		compat_uptr_t p;
diff -ruNp linux-3.4.10/kernel/events/core.c linux-3.4.10-cher1/kernel/events/core.c
--- linux-3.4.10/kernel/events/core.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/events/core.c	2012-09-01 20:32:46.127304694 +0400
@@ -6198,6 +6198,11 @@ SYSCALL_DEFINE5(perf_event_open,
 	int fput_needed = 0;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* for future expandability... */
 	if (flags & ~PERF_FLAG_ALL)
 		return -EINVAL;
diff -ruNp linux-3.4.10/kernel/exec_domain.c linux-3.4.10-cher1/kernel/exec_domain.c
--- linux-3.4.10/kernel/exec_domain.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/exec_domain.c	2012-09-01 20:32:46.130304745 +0400
@@ -183,6 +183,9 @@ SYSCALL_DEFINE1(personality, unsigned in
 {
 	unsigned int old = current->personality;
 
+        if (SBOX_IS_RESTRICTED())
+                return old;
+
 	if (personality != 0xffffffff)
 		set_personality(personality);
 
diff -ruNp linux-3.4.10/kernel/exit.c linux-3.4.10-cher1/kernel/exit.c
--- linux-3.4.10/kernel/exit.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/exit.c	2012-09-01 20:32:46.132304781 +0400
@@ -1217,6 +1217,7 @@ static int wait_task_zombie(struct wait_
 	pid_t pid = task_pid_vnr(p);
 	uid_t uid = __task_cred(p)->uid;
 	struct siginfo __user *infop;
+        int status2;
 
 	if (!likely(wo->wo_flags & WEXITED))
 		return 0;
@@ -1234,6 +1235,12 @@ static int wait_task_zombie(struct wait_
 			why = (exit_code & 0x80) ? CLD_DUMPED : CLD_KILLED;
 			status = exit_code & 0x7f;
 		}
+                if (SBOX_IS_MEMLIMIT_ERR(p))
+                        status |= 0x10000;
+                if (SBOX_IS_SECURITY_ERR(p))
+                        status |= 0x20000;
+                if (SBOX_IS_TL_ERR(p))
+                        status |= 0x40000;
 		return wait_noreap_copyout(wo, p, pid, uid, why, status);
 	}
 
@@ -1316,8 +1323,16 @@ static int wait_task_zombie(struct wait_
 		? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
 	status = (p->signal->flags & SIGNAL_GROUP_EXIT)
 		? p->signal->group_exit_code : p->exit_code;
-	if (!retval && wo->wo_stat)
-		retval = put_user(status, wo->wo_stat);
+	if (!retval && wo->wo_stat) {
+                status2 = status;
+                if (SBOX_IS_MEMLIMIT_ERR(p))
+                        status2 |= 0x10000;
+                if (SBOX_IS_SECURITY_ERR(p))
+                        status2 |= 0x20000;
+                if (SBOX_IS_TL_ERR(p))
+                        status2 |= 0x40000;
+		retval = put_user(status2, wo->wo_stat);
+        }
 
 	infop = wo->wo_info;
 	if (!retval && infop)
@@ -1451,8 +1466,16 @@ unlock_sig:
 
 	retval = wo->wo_rusage
 		? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
-	if (!retval && wo->wo_stat)
-		retval = put_user((exit_code << 8) | 0x7f, wo->wo_stat);
+	if (!retval && wo->wo_stat) {
+                int status = (exit_code << 8) | 0x7f;
+                if (SBOX_IS_MEMLIMIT_ERR(p))
+                        status |= 0x10000;
+                if (SBOX_IS_SECURITY_ERR(p))
+                        status |= 0x20000;
+                if (SBOX_IS_TL_ERR(p))
+                        status |= 0x40000;
+		retval = put_user(status, wo->wo_stat);
+        }
 
 	infop = wo->wo_info;
 	if (!retval && infop)
diff -ruNp linux-3.4.10/kernel/fork.c linux-3.4.10-cher1/kernel/fork.c
--- linux-3.4.10/kernel/fork.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/fork.c	2012-09-01 20:32:46.134304817 +0400
@@ -1553,6 +1553,11 @@ long do_fork(unsigned long clone_flags,
 	int trace = 0;
 	long nr;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/*
 	 * Do some preliminary argument and permissions checking before we
 	 * actually start allocating stuff
@@ -1744,6 +1749,11 @@ SYSCALL_DEFINE1(unshare, unsigned long, 
 	int do_sysvsem = 0;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = check_unshare_flags(unshare_flags);
 	if (err)
 		goto bad_unshare_out;
diff -ruNp linux-3.4.10/kernel/groups.c linux-3.4.10-cher1/kernel/groups.c
--- linux-3.4.10/kernel/groups.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/groups.c	2012-09-01 20:32:46.136304853 +0400
@@ -233,6 +233,11 @@ SYSCALL_DEFINE2(setgroups, int, gidsetsi
 	struct group_info *group_info;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!nsown_capable(CAP_SETGID))
 		return -EPERM;
 	if ((unsigned)gidsetsize > NGROUPS_MAX)
diff -ruNp linux-3.4.10/kernel/kexec.c linux-3.4.10-cher1/kernel/kexec.c
--- linux-3.4.10/kernel/kexec.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/kexec.c	2012-09-01 20:32:46.137304870 +0400
@@ -943,6 +943,11 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
 	struct kimage **dest_image, *image;
 	int result;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* We only trust the superuser with rebooting the system. */
 	if (!capable(CAP_SYS_BOOT))
 		return -EPERM;
diff -ruNp linux-3.4.10/kernel/module.c linux-3.4.10-cher1/kernel/module.c
--- linux-3.4.10/kernel/module.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/module.c	2012-09-01 20:32:46.140304921 +0400
@@ -772,6 +772,11 @@ SYSCALL_DEFINE2(delete_module, const cha
 	char name[MODULE_NAME_LEN];
 	int ret, forced = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_MODULE) || modules_disabled)
 		return -EPERM;
 
@@ -3012,6 +3017,11 @@ SYSCALL_DEFINE3(init_module, void __user
 	struct module *mod;
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Must have permission */
 	if (!capable(CAP_SYS_MODULE) || modules_disabled)
 		return -EPERM;
diff -ruNp linux-3.4.10/kernel/nsproxy.c linux-3.4.10-cher1/kernel/nsproxy.c
--- linux-3.4.10/kernel/nsproxy.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/nsproxy.c	2012-09-01 20:32:46.142304955 +0400
@@ -241,6 +241,11 @@ SYSCALL_DEFINE2(setns, int, fd, int, nst
 	struct file *file;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
diff -ruNp linux-3.4.10/kernel/posix-cpu-timers.c linux-3.4.10-cher1/kernel/posix-cpu-timers.c
--- linux-3.4.10/kernel/posix-cpu-timers.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/posix-cpu-timers.c	2012-09-01 20:32:46.143304972 +0400
@@ -956,6 +956,8 @@ static void check_thread_timers(struct t
 			 * At the hard limit, we just die.
 			 * No need to calculate anything else now.
 			 */
+                        if ((tsk->sbox_flags & SBOX_TLON))
+                                tsk->sbox_flags |= SBOX_WAS_TL;
 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
 			return;
 		}
@@ -1116,6 +1118,8 @@ static void check_process_timers(struct 
 			 * At the hard limit, we just die.
 			 * No need to calculate anything else now.
 			 */
+                        if ((tsk->sbox_flags & SBOX_TLON))
+                                tsk->sbox_flags |= SBOX_WAS_TL;
 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
 			return;
 		}
diff -ruNp linux-3.4.10/kernel/printk.c linux-3.4.10-cher1/kernel/printk.c
--- linux-3.4.10/kernel/printk.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/printk.c	2012-09-01 20:32:46.145305006 +0400
@@ -488,6 +488,9 @@ out:
 
 SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_syslog(type, buf, len, SYSLOG_FROM_CALL);
 }
 
diff -ruNp linux-3.4.10/kernel/ptrace.c linux-3.4.10-cher1/kernel/ptrace.c
--- linux-3.4.10/kernel/ptrace.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/ptrace.c	2012-09-01 20:32:46.147305041 +0400
@@ -861,6 +861,24 @@ SYSCALL_DEFINE4(ptrace, long, request, l
 	struct task_struct *child;
 	long ret;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
+	if (request == PTRACE_MEMLIMIT) {
+		current->sbox_flags |= SBOX_MEMLIMITON;
+		return 0;
+	}
+	if (request == PTRACE_NO_SYSCALLS) {
+		current->sbox_flags |= SBOX_NO_SYSCALLS;
+		return 0;
+	}
+	if (request == PTRACE_TIMELIMIT) {
+		current->sbox_flags |= SBOX_TLON;
+		return 0;
+	}
+
 	if (request == PTRACE_TRACEME) {
 		ret = ptrace_traceme();
 		if (!ret)
@@ -1006,6 +1024,24 @@ asmlinkage long compat_sys_ptrace(compat
 	struct task_struct *child;
 	long ret;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
+	if (request == PTRACE_MEMLIMIT) {
+		current->sbox_flags |= SBOX_MEMLIMITON;
+		return 0;
+	}
+	if (request == PTRACE_NO_SYSCALLS) {
+		current->sbox_flags |= SBOX_NO_SYSCALLS;
+		return 0;
+	}
+	if (request == PTRACE_TIMELIMIT) {
+		current->sbox_flags |= SBOX_TLON;
+		return 0;
+	}
+
 	if (request == PTRACE_TRACEME) {
 		ret = ptrace_traceme();
 		goto out;
diff -ruNp linux-3.4.10/kernel/sched/core.c linux-3.4.10-cher1/kernel/sched/core.c
--- linux-3.4.10/kernel/sched/core.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/sched/core.c	2012-09-01 20:32:46.151305113 +0400
@@ -4055,6 +4055,9 @@ SYSCALL_DEFINE1(nice, int, increment)
 {
 	long nice, retval;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/*
 	 * Setpriority might change our priority at the same moment.
 	 * We don't have to worry. Conceptually one call occurs first
@@ -4400,6 +4403,11 @@ do_sched_setscheduler(pid_t pid, int pol
 SYSCALL_DEFINE3(sched_setscheduler, pid_t, pid, int, policy,
 		struct sched_param __user *, param)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* negative values for policy are not valid */
 	if (policy < 0)
 		return -EINVAL;
@@ -4414,6 +4422,11 @@ SYSCALL_DEFINE3(sched_setscheduler, pid_
  */
 SYSCALL_DEFINE2(sched_setparam, pid_t, pid, struct sched_param __user *, param)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_sched_setscheduler(pid, -1, param);
 }
 
@@ -4567,6 +4580,11 @@ SYSCALL_DEFINE3(sched_setaffinity, pid_t
 	cpumask_var_t new_mask;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!alloc_cpumask_var(&new_mask, GFP_KERNEL))
 		return -ENOMEM;
 
diff -ruNp linux-3.4.10/kernel/signal.c linux-3.4.10-cher1/kernel/signal.c
--- linux-3.4.10/kernel/signal.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/signal.c	2012-09-01 20:32:46.155305182 +0400
@@ -1444,6 +1444,14 @@ static int kill_something_info(int sig, 
 {
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                if (!pid) pid = current->pid;
+                if (pid != current->pid) {
+                        SBOX_SET_SECURITY_ERR();
+                        return -EPERM;
+                }
+        }
+
 	if (pid > 0) {
 		rcu_read_lock();
 		ret = kill_pid_info(sig, info, find_vpid(pid));
@@ -2892,6 +2900,11 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
 	if (pid <= 0 || tgid <= 0)
 		return -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_tkill(tgid, pid, sig);
 }
 
@@ -2908,6 +2921,11 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int, 
 	if (pid <= 0)
 		return -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_tkill(0, pid, sig);
 }
 
diff -ruNp linux-3.4.10/kernel/sys.c linux-3.4.10-cher1/kernel/sys.c
--- linux-3.4.10/kernel/sys.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/sys.c	2012-09-01 20:32:46.158305233 +0400
@@ -178,6 +178,11 @@ SYSCALL_DEFINE3(setpriority, int, which,
 	int error = -EINVAL;
 	struct pid *pgrp;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (which > PRIO_USER || which < PRIO_PROCESS)
 		goto out;
 
@@ -432,6 +437,11 @@ SYSCALL_DEFINE4(reboot, int, magic1, int
 	char buffer[256];
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* We only trust the superuser with rebooting the system. */
 	if (!capable(CAP_SYS_BOOT))
 		return -EPERM;
@@ -557,6 +567,11 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
 	struct cred *new;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return -ENOMEM;
@@ -604,6 +619,11 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
 	struct cred *new;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return -ENOMEM;
@@ -674,6 +694,11 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
 	struct cred *new;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return -ENOMEM;
@@ -735,6 +760,11 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
 	struct cred *new;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return -ENOMEM;
@@ -776,6 +806,11 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, 
 	struct cred *new;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return -ENOMEM;
@@ -841,6 +876,11 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, 
 	struct cred *new;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return -ENOMEM;
@@ -899,6 +939,11 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
 	struct cred *new;
 	uid_t old_fsuid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return current_fsuid();
@@ -932,6 +977,11 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
 	struct cred *new;
 	gid_t old_fsgid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return current_fsgid();
@@ -1002,6 +1052,11 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid
 	struct pid *pgrp;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!pid)
 		pid = task_pid_vnr(group_leader);
 	if (!pgid)
@@ -1143,6 +1198,11 @@ SYSCALL_DEFINE0(setsid)
 	if (group_leader->signal->leader)
 		goto out;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                goto out;
+        }
+
 	/* Fail if a process group id already exists that equals the
 	 * proposed session id.
 	 */
@@ -1282,6 +1342,11 @@ SYSCALL_DEFINE2(sethostname, char __user
 	int errno;
 	char tmp[__NEW_UTS_LEN];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!ns_capable(current->nsproxy->uts_ns->user_ns, CAP_SYS_ADMIN))
 		return -EPERM;
 
@@ -1333,6 +1398,11 @@ SYSCALL_DEFINE2(setdomainname, char __us
 	int errno;
 	char tmp[__NEW_UTS_LEN];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!ns_capable(current->nsproxy->uts_ns->user_ns, CAP_SYS_ADMIN))
 		return -EPERM;
 	if (len < 0 || len > __NEW_UTS_LEN)
@@ -1521,6 +1591,11 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, u
 	struct task_struct *tsk;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (new_rlim) {
 		if (copy_from_user(&new64, new_rlim, sizeof(new64)))
 			return -EFAULT;
@@ -1558,6 +1633,11 @@ SYSCALL_DEFINE2(setrlimit, unsigned int,
 {
 	struct rlimit new_rlim;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_from_user(&new_rlim, rlim, sizeof(*rlim)))
 		return -EFAULT;
 	return do_prlimit(current, resource, &new_rlim, NULL);
@@ -1697,6 +1777,9 @@ SYSCALL_DEFINE2(getrusage, int, who, str
 
 SYSCALL_DEFINE1(umask, int, mask)
 {
+        if (SBOX_IS_RESTRICTED())
+                return current->fs->umask;
+
 	mask = xchg(&current->fs->umask, mask & S_IRWXUGO);
 	return mask;
 }
@@ -1826,6 +1909,11 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
 	unsigned char comm[sizeof(me->comm)];
 	long error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = security_task_prctl(option, arg2, arg3, arg4, arg5);
 	if (error != -ENOSYS)
 		return error;
diff -ruNp linux-3.4.10/kernel/sysctl_binary.c linux-3.4.10-cher1/kernel/sysctl_binary.c
--- linux-3.4.10/kernel/sysctl_binary.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/sysctl_binary.c	2012-09-01 20:32:46.161305284 +0400
@@ -1447,6 +1447,11 @@ SYSCALL_DEFINE1(sysctl, struct __sysctl_
 	size_t oldlen = 0;
 	ssize_t result;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_from_user(&tmp, args, sizeof(tmp)))
 		return -EFAULT;
 
@@ -1491,6 +1496,11 @@ asmlinkage long compat_sys_sysctl(struct
 	size_t oldlen = 0;
 	ssize_t result;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_from_user(&tmp, args, sizeof(tmp)))
 		return -EFAULT;
 
diff -ruNp linux-3.4.10/kernel/time.c linux-3.4.10-cher1/kernel/time.c
--- linux-3.4.10/kernel/time.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/time.c	2012-09-01 20:32:46.162305301 +0400
@@ -83,6 +83,11 @@ SYSCALL_DEFINE1(stime, time_t __user *, 
 	struct timespec tv;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(tv.tv_sec, tptr))
 		return -EFAULT;
 
@@ -183,6 +188,11 @@ SYSCALL_DEFINE2(settimeofday, struct tim
 	struct timespec	new_ts;
 	struct timezone new_tz;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (tv) {
 		if (copy_from_user(&user_tv, tv, sizeof(*tv)))
 			return -EFAULT;
@@ -202,6 +212,11 @@ SYSCALL_DEFINE1(adjtimex, struct timex _
 	struct timex txc;		/* Local copy of parameter */
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Copy the user data space into the kernel copy
 	 * structure. But bear in mind that the structures
 	 * may change
diff -ruNp linux-3.4.10/kernel/uid16.c linux-3.4.10-cher1/kernel/uid16.c
--- linux-3.4.10/kernel/uid16.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/kernel/uid16.c	2012-09-01 20:32:46.164305337 +0400
@@ -189,6 +189,11 @@ SYSCALL_DEFINE2(setgroups16, int, gidset
 	struct group_info *group_info;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_IS_RESTRICTED();
+                return -EPERM;
+        }
+
 	if (!nsown_capable(CAP_SETGID))
 		return -EPERM;
 	if ((unsigned)gidsetsize > NGROUPS_MAX)
diff -ruNp linux-3.4.10/Makefile linux-3.4.10-cher1/Makefile
--- linux-3.4.10/Makefile	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/Makefile	2012-09-01 20:32:58.172513975 +0400
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 4
 SUBLEVEL = 10
-EXTRAVERSION =
+EXTRAVERSION = -cher1
 NAME = Saber-toothed Squirrel
 
 # *DOCUMENTATION*
diff -ruNp linux-3.4.10/mm/fadvise.c linux-3.4.10-cher1/mm/fadvise.c
--- linux-3.4.10/mm/fadvise.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/fadvise.c	2012-09-01 20:32:46.168305409 +0400
@@ -35,6 +35,9 @@ SYSCALL_DEFINE(fadvise64_64)(int fd, lof
 	unsigned long nrpages;
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!file)
 		return -EBADF;
 
diff -ruNp linux-3.4.10/mm/filemap.c linux-3.4.10-cher1/mm/filemap.c
--- linux-3.4.10/mm/filemap.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/filemap.c	2012-09-01 20:32:46.170305443 +0400
@@ -1494,6 +1494,9 @@ SYSCALL_DEFINE(readahead)(int fd, loff_t
 	ssize_t ret;
 	struct file *file;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = -EBADF;
 	file = fget(fd);
 	if (file) {
diff -ruNp linux-3.4.10/mm/fremap.c linux-3.4.10-cher1/mm/fremap.c
--- linux-3.4.10/mm/fremap.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/fremap.c	2012-09-01 20:32:46.172305477 +0400
@@ -128,6 +128,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
 	int err = -EINVAL;
 	int has_write_lock = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (prot)
 		return err;
 	/*
diff -ruNp linux-3.4.10/mm/madvise.c linux-3.4.10-cher1/mm/madvise.c
--- linux-3.4.10/mm/madvise.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/madvise.c	2012-09-01 20:32:46.173305494 +0400
@@ -369,6 +369,9 @@ SYSCALL_DEFINE3(madvise, unsigned long, 
 	int write;
 	size_t len;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 #ifdef CONFIG_MEMORY_FAILURE
 	if (behavior == MADV_HWPOISON || behavior == MADV_SOFT_OFFLINE)
 		return madvise_hwpoison(behavior, start, start+len_in);
diff -ruNp linux-3.4.10/mm/mempolicy.c linux-3.4.10-cher1/mm/mempolicy.c
--- linux-3.4.10/mm/mempolicy.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/mempolicy.c	2012-09-01 20:32:46.175305528 +0400
@@ -1248,6 +1248,11 @@ SYSCALL_DEFINE6(mbind, unsigned long, st
 	int err;
 	unsigned short mode_flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	mode_flags = mode & MPOL_MODE_FLAGS;
 	mode &= ~MPOL_MODE_FLAGS;
 	if (mode >= MPOL_MAX)
@@ -1269,6 +1274,11 @@ SYSCALL_DEFINE3(set_mempolicy, int, mode
 	nodemask_t nodes;
 	unsigned short flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	flags = mode & MPOL_MODE_FLAGS;
 	mode &= ~MPOL_MODE_FLAGS;
 	if ((unsigned int)mode >= MPOL_MAX)
@@ -1294,6 +1304,11 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
 	nodemask_t *new;
 	NODEMASK_SCRATCH(scratch);
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!scratch)
 		return -ENOMEM;
 
@@ -1385,6 +1400,11 @@ SYSCALL_DEFINE5(get_mempolicy, int __use
 	int uninitialized_var(pval);
 	nodemask_t nodes;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (nmask != NULL && maxnode < MAX_NUMNODES)
 		return -EINVAL;
 
@@ -1414,6 +1434,11 @@ asmlinkage long compat_sys_get_mempolicy
 	unsigned long nr_bits, alloc_size;
 	DECLARE_BITMAP(bm, MAX_NUMNODES);
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
diff -ruNp linux-3.4.10/mm/migrate.c linux-3.4.10-cher1/mm/migrate.c
--- linux-3.4.10/mm/migrate.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/migrate.c	2012-09-01 20:32:46.177305562 +0400
@@ -1348,6 +1348,11 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
 	int err;
 	nodemask_t task_nodes;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Check flags */
 	if (flags & ~(MPOL_MF_MOVE|MPOL_MF_MOVE_ALL))
 		return -EINVAL;
diff -ruNp linux-3.4.10/mm/mincore.c linux-3.4.10-cher1/mm/mincore.c
--- linux-3.4.10/mm/mincore.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/mincore.c	2012-09-01 20:32:46.178305579 +0400
@@ -270,6 +270,11 @@ SYSCALL_DEFINE3(mincore, unsigned long, 
 	unsigned long pages;
 	unsigned char *tmp;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Check the start address: needs to be page-aligned.. */
  	if (start & ~PAGE_CACHE_MASK)
 		return -EINVAL;
diff -ruNp linux-3.4.10/mm/mlock.c linux-3.4.10-cher1/mm/mlock.c
--- linux-3.4.10/mm/mlock.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/mlock.c	2012-09-01 20:32:46.180305615 +0400
@@ -485,6 +485,11 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
 	unsigned long lock_limit;
 	int error = -ENOMEM;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!can_do_mlock())
 		return -EPERM;
 
@@ -513,6 +518,11 @@ SYSCALL_DEFINE2(munlock, unsigned long, 
 {
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	down_write(&current->mm->mmap_sem);
 	len = PAGE_ALIGN(len + (start & ~PAGE_MASK));
 	start &= PAGE_MASK;
@@ -551,6 +561,11 @@ SYSCALL_DEFINE1(mlockall, int, flags)
 	unsigned long lock_limit;
 	int ret = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!flags || (flags & ~(MCL_CURRENT | MCL_FUTURE)))
 		goto out;
 
@@ -583,6 +598,11 @@ SYSCALL_DEFINE0(munlockall)
 {
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	down_write(&current->mm->mmap_sem);
 	ret = do_mlockall(0);
 	up_write(&current->mm->mmap_sem);
diff -ruNp linux-3.4.10/mm/mmap.c linux-3.4.10-cher1/mm/mmap.c
--- linux-3.4.10/mm/mmap.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/mmap.c	2012-09-01 20:32:46.182305651 +0400
@@ -1252,8 +1252,12 @@ munmap_back:
 	}
 
 	/* Check against address space limit. */
-	if (!may_expand_vm(mm, len >> PAGE_SHIFT))
+	if (!may_expand_vm(mm, len >> PAGE_SHIFT)) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+		}
 		return -ENOMEM;
+	}
 
 	/*
 	 * Set 'VM_NORESERVE' if we should not account for the
@@ -1684,12 +1688,20 @@ static int acct_stack_growth(struct vm_a
 	unsigned long new_start;
 
 	/* address space limit tests */
-	if (!may_expand_vm(mm, grow))
+	if (!may_expand_vm(mm, grow)) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+		}
 		return -ENOMEM;
+	}
 
 	/* Stack limit test */
-	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur)) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+		}
 		return -ENOMEM;
+	}
 
 	/* mlock limit tests */
 	if (vma->vm_flags & VM_LOCKED) {
@@ -2221,8 +2233,12 @@ static unsigned long do_brk(unsigned lon
 	}
 
 	/* Check against address space limits *after* clearing old maps... */
-	if (!may_expand_vm(mm, len >> PAGE_SHIFT))
+	if (!may_expand_vm(mm, len >> PAGE_SHIFT)) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+		}
 		return -ENOMEM;
+	}
 
 	if (mm->map_count > sysctl_max_map_count)
 		return -ENOMEM;
diff -ruNp linux-3.4.10/mm/mprotect.c linux-3.4.10-cher1/mm/mprotect.c
--- linux-3.4.10/mm/mprotect.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/mprotect.c	2012-09-01 20:32:46.184305687 +0400
@@ -240,6 +240,13 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
 	if (grows == (PROT_GROWSDOWN|PROT_GROWSUP)) /* can't be both */
 		return -EINVAL;
 
+        /* --- enabled for php
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+        */
+
 	if (start & ~PAGE_MASK)
 		return -EINVAL;
 	if (!len)
diff -ruNp linux-3.4.10/mm/mremap.c linux-3.4.10-cher1/mm/mremap.c
--- linux-3.4.10/mm/mremap.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/mremap.c	2012-09-01 20:32:46.185305704 +0400
@@ -324,8 +324,12 @@ static struct vm_area_struct *vma_to_res
 			goto Eagain;
 	}
 
-	if (!may_expand_vm(mm, (new_len - old_len) >> PAGE_SHIFT))
+	if (!may_expand_vm(mm, (new_len - old_len) >> PAGE_SHIFT)) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+		}
 		goto Enomem;
+	}
 
 	if (vma->vm_flags & VM_ACCOUNT) {
 		unsigned long charged = (new_len - old_len) >> PAGE_SHIFT;
diff -ruNp linux-3.4.10/mm/msync.c linux-3.4.10-cher1/mm/msync.c
--- linux-3.4.10/mm/msync.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/msync.c	2012-09-01 20:32:46.186305721 +0400
@@ -36,6 +36,9 @@ SYSCALL_DEFINE3(msync, unsigned long, st
 	int unmapped_error = 0;
 	int error = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (flags & ~(MS_ASYNC | MS_INVALIDATE | MS_SYNC))
 		goto out;
 	if (start & ~PAGE_MASK)
diff -ruNp linux-3.4.10/mm/process_vm_access.c linux-3.4.10-cher1/mm/process_vm_access.c
--- linux-3.4.10/mm/process_vm_access.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/process_vm_access.c	2012-09-01 20:32:46.187305738 +0400
@@ -399,6 +399,11 @@ SYSCALL_DEFINE6(process_vm_readv, pid_t,
 		unsigned long, liovcnt, const struct iovec __user *, rvec,
 		unsigned long, riovcnt,	unsigned long, flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 0);
 }
 
@@ -407,6 +412,11 @@ SYSCALL_DEFINE6(process_vm_writev, pid_t
 		unsigned long, liovcnt, const struct iovec __user *, rvec,
 		unsigned long, riovcnt,	unsigned long, flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 1);
 }
 
@@ -472,6 +482,11 @@ compat_sys_process_vm_readv(compat_pid_t
 			    unsigned long riovcnt,
 			    unsigned long flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
 				    riovcnt, flags, 0);
 }
@@ -484,6 +499,11 @@ compat_sys_process_vm_writev(compat_pid_
 			     unsigned long riovcnt,
 			     unsigned long flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
 				    riovcnt, flags, 1);
 }
diff -ruNp linux-3.4.10/mm/swapfile.c linux-3.4.10-cher1/mm/swapfile.c
--- linux-3.4.10/mm/swapfile.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/mm/swapfile.c	2012-09-01 20:32:46.189305772 +0400
@@ -1558,6 +1558,11 @@ SYSCALL_DEFINE1(swapoff, const char __us
 	int i, type, prev;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
@@ -2018,6 +2023,11 @@ SYSCALL_DEFINE2(swapon, const char __use
 	struct page *page = NULL;
 	struct inode *inode = NULL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (swap_flags & ~SWAP_FLAGS_VALID)
 		return -EINVAL;
 
diff -ruNp linux-3.4.10/net/compat.c linux-3.4.10-cher1/net/compat.c
--- linux-3.4.10/net/compat.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/net/compat.c	2012-09-01 20:32:46.191305806 +0400
@@ -749,6 +749,11 @@ asmlinkage long compat_sys_sendmsg(int f
 asmlinkage long compat_sys_sendmmsg(int fd, struct compat_mmsghdr __user *mmsg,
 				    unsigned vlen, unsigned int flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
 			      flags | MSG_CMSG_COMPAT);
 }
@@ -777,6 +782,11 @@ asmlinkage long compat_sys_recvmmsg(int 
 	int datagrams;
 	struct timespec ktspec;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (COMPAT_USE_64BIT_TIME)
 		return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
 				      flags | MSG_CMSG_COMPAT,
@@ -803,6 +813,11 @@ asmlinkage long compat_sys_socketcall(in
 	u32 a[6];
 	u32 a0, a1;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (call < SYS_SOCKET || call > SYS_SENDMMSG)
 		return -EINVAL;
 	if (copy_from_user(a, args, nas[call]))
diff -ruNp linux-3.4.10/net/socket.c linux-3.4.10-cher1/net/socket.c
--- linux-3.4.10/net/socket.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/net/socket.c	2012-09-01 20:32:46.193305840 +0400
@@ -1328,6 +1328,11 @@ SYSCALL_DEFINE3(socket, int, family, int
 	struct socket *sock;
 	int flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Check the SOCK_* constants for consistency.  */
 	BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
@@ -1371,6 +1376,11 @@ SYSCALL_DEFINE4(socketpair, int, family,
 	struct file *newfile1, *newfile2;
 	int flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	flags = type & ~SOCK_TYPE_MASK;
 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
 		return -EINVAL;
@@ -1450,6 +1460,11 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
 	struct sockaddr_storage address;
 	int err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock) {
 		err = move_addr_to_kernel(umyaddr, addrlen, &address);
@@ -1479,6 +1494,11 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
 	int err, fput_needed;
 	int somaxconn;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock) {
 		somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
@@ -1514,6 +1534,11 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
 	int err, len, newfd, fput_needed;
 	struct sockaddr_storage address;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
 		return -EINVAL;
 
@@ -1605,6 +1630,11 @@ SYSCALL_DEFINE3(connect, int, fd, struct
 	struct sockaddr_storage address;
 	int err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1637,6 +1667,11 @@ SYSCALL_DEFINE3(getsockname, int, fd, st
 	struct sockaddr_storage address;
 	int len, err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1668,6 +1703,11 @@ SYSCALL_DEFINE3(getpeername, int, fd, st
 	struct sockaddr_storage address;
 	int len, err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_getpeername(sock);
@@ -1704,6 +1744,11 @@ SYSCALL_DEFINE6(sendto, int, fd, void __
 	struct iovec iov;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (len > INT_MAX)
 		len = INT_MAX;
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
@@ -1763,6 +1808,11 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void 
 	int err, err2;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (size > INT_MAX)
 		size = INT_MAX;
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
@@ -1814,6 +1864,11 @@ SYSCALL_DEFINE5(setsockopt, int, fd, int
 	int err, fput_needed;
 	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (optlen < 0)
 		return -EINVAL;
 
@@ -1848,6 +1903,11 @@ SYSCALL_DEFINE5(getsockopt, int, fd, int
 	int err, fput_needed;
 	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_getsockopt(sock, level, optname);
@@ -1877,6 +1937,11 @@ SYSCALL_DEFINE2(shutdown, int, fd, int, 
 	int err, fput_needed;
 	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_shutdown(sock, how);
@@ -2023,6 +2088,11 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct
 	struct msghdr msg_sys;
 	struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!sock)
 		goto out;
 
@@ -2095,6 +2165,11 @@ int __sys_sendmmsg(int fd, struct mmsghd
 SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
 		unsigned int, vlen, unsigned int, flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return __sys_sendmmsg(fd, mmsg, vlen, flags);
 }
 
@@ -2199,6 +2274,11 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct
 	struct msghdr msg_sys;
 	struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!sock)
 		goto out;
 
@@ -2323,6 +2403,11 @@ SYSCALL_DEFINE5(recvmmsg, int, fd, struc
 	int datagrams;
 	struct timespec timeout_sys;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!timeout)
 		return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
 
@@ -2365,6 +2450,11 @@ SYSCALL_DEFINE2(socketcall, int, call, u
 	int err;
 	unsigned int len;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (call < 1 || call > SYS_SENDMMSG)
 		return -EINVAL;
 
diff -ruNp linux-3.4.10/security/keys/keyctl.c linux-3.4.10-cher1/security/keys/keyctl.c
--- linux-3.4.10/security/keys/keyctl.c	2012-08-27 02:02:10.000000000 +0400
+++ linux-3.4.10-cher1/security/keys/keyctl.c	2012-09-01 20:32:46.196305893 +0400
@@ -63,6 +63,11 @@ SYSCALL_DEFINE5(add_key, const char __us
 	long ret;
 	bool vm;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ret = -EINVAL;
 	if (plen > 1024 * 1024 - 1)
 		goto error;
@@ -156,6 +161,11 @@ SYSCALL_DEFINE4(request_key, const char 
 	char type[32], *description, *callout_info;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* pull the type into kernel space */
 	ret = key_get_type_from_user(type, _type, sizeof(type));
 	if (ret < 0)
@@ -1528,6 +1538,11 @@ error_keyring:
 SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
 		unsigned long, arg4, unsigned long, arg5)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	switch (option) {
 	case KEYCTL_GET_KEYRING_ID:
 		return keyctl_get_keyring_ID((key_serial_t) arg2,
