diff -ruNp linux-3.7.5/arch/x86/ia32/ia32_signal.c linux-3.7.5-cher1/arch/x86/ia32/ia32_signal.c
--- linux-3.7.5/arch/x86/ia32/ia32_signal.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/arch/x86/ia32/ia32_signal.c	2013-01-30 00:02:13.444795781 +0400
@@ -144,6 +144,9 @@ asmlinkage long sys32_sigaltstack(const
 	int ret, err = 0;
 	mm_segment_t seg;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (uss_ptr) {
 		u32 ptr;
 
diff -ruNp linux-3.7.5/arch/x86/ia32/ipc32.c linux-3.7.5-cher1/arch/x86/ia32/ipc32.c
--- linux-3.7.5/arch/x86/ia32/ipc32.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/arch/x86/ia32/ipc32.c	2013-01-30 00:02:13.152794945 +0400
@@ -15,6 +15,11 @@ asmlinkage long sys32_ipc(u32 call, int
 {
 	int version;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	version = call >> 16; /* hack for backward compatibility */
 	call &= 0xffff;
 
diff -ruNp linux-3.7.5/arch/x86/ia32/sys_ia32.c linux-3.7.5-cher1/arch/x86/ia32/sys_ia32.c
--- linux-3.7.5/arch/x86/ia32/sys_ia32.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/arch/x86/ia32/sys_ia32.c	2013-01-30 00:02:12.799794322 +0400
@@ -95,12 +95,26 @@ static int cp_stat64(struct stat64 __use
 	return 0;
 }
 
+int cher_patch_is_secure_path(const char *);
+
 asmlinkage long sys32_stat64(const char __user *filename,
 			     struct stat64 __user *statbuf)
 {
 	struct kstat stat;
-	int ret = vfs_stat(filename, &stat);
+	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
+        ret = vfs_stat(filename, &stat);
 	if (!ret)
 		ret = cp_stat64(statbuf, &stat);
 	return ret;
@@ -110,7 +124,20 @@ asmlinkage long sys32_lstat64(const char
 			      struct stat64 __user *statbuf)
 {
 	struct kstat stat;
-	int ret = vfs_lstat(filename, &stat);
+	int ret;
+
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
+        ret = vfs_lstat(filename, &stat);
 	if (!ret)
 		ret = cp_stat64(statbuf, &stat);
 	return ret;
@@ -424,6 +451,11 @@ long sys32_vm86_warning(void)
 	struct task_struct *me = current;
 	static char lastcomm[sizeof(me->comm)];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (strncmp(lastcomm, me->comm, sizeof(lastcomm))) {
 		compat_printk(KERN_INFO
 			      "%s: vm86 mode not supported on 64 bit kernel\n",
diff -ruNp linux-3.7.5/arch/x86/kernel/ioport.c linux-3.7.5-cher1/arch/x86/kernel/ioport.c
--- linux-3.7.5/arch/x86/kernel/ioport.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/arch/x86/kernel/ioport.c	2013-01-30 00:02:13.724796513 +0400
@@ -26,6 +26,11 @@ asmlinkage long sys_ioperm(unsigned long
 	struct tss_struct *tss;
 	unsigned int i, max_long, bytes, bytes_updated;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
 		return -EINVAL;
 	if (turn_on && !capable(CAP_SYS_RAWIO))
@@ -98,6 +103,11 @@ long sys_iopl(unsigned int level, struct
 	unsigned int old = (regs->flags >> 12) & 3;
 	struct thread_struct *t = &current->thread;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (level > 3)
 		return -EINVAL;
 	/* Trying to gain more privileges? */
diff -ruNp linux-3.7.5/arch/x86/kernel/ldt.c linux-3.7.5-cher1/arch/x86/kernel/ldt.c
--- linux-3.7.5/arch/x86/kernel/ldt.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/arch/x86/kernel/ldt.c	2013-01-30 00:02:14.010797187 +0400
@@ -249,6 +249,11 @@ asmlinkage int sys_modify_ldt(int func,
 {
 	int ret = -ENOSYS;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	switch (func) {
 	case 0:
 		ret = read_ldt(ptr, bytecount);
diff -ruNp linux-3.7.5/arch/x86/kernel/signal.c linux-3.7.5-cher1/arch/x86/kernel/signal.c
--- linux-3.7.5/arch/x86/kernel/signal.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/arch/x86/kernel/signal.c	2013-01-30 00:02:14.301797887 +0400
@@ -606,6 +606,9 @@ long
 sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
 		struct pt_regs *regs)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_sigaltstack(uss, uoss, regs->sp);
 }
 
diff -ruNp linux-3.7.5/arch/x86/kernel/vm86_32.c linux-3.7.5-cher1/arch/x86/kernel/vm86_32.c
--- linux-3.7.5/arch/x86/kernel/vm86_32.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/arch/x86/kernel/vm86_32.c	2013-01-30 00:02:14.601798596 +0400
@@ -212,6 +212,11 @@ int sys_vm86old(struct vm86_struct __use
 	struct task_struct *tsk;
 	int tmp, ret = -EPERM;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	tsk = current;
 	if (tsk->thread.saved_sp0)
 		goto out;
@@ -242,6 +247,11 @@ int sys_vm86(unsigned long cmd, unsigned
 	int tmp, ret;
 	struct vm86plus_struct __user *v86;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	tsk = current;
 	switch (cmd) {
 	case VM86_REQUEST_IRQ:
diff -ruNp linux-3.7.5/fs/aio.c linux-3.7.5-cher1/fs/aio.c
--- linux-3.7.5/fs/aio.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/aio.c	2013-01-30 00:02:14.920799362 +0400
@@ -1234,6 +1234,9 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_e
 	unsigned long ctx;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = get_user(ctx, ctxp);
 	if (unlikely(ret))
 		goto out;
@@ -1266,7 +1269,12 @@ out:
  */
 SYSCALL_DEFINE1(io_destroy, aio_context_t, ctx)
 {
-	struct kioctx *ioctx = lookup_ioctx(ctx);
+	struct kioctx *ioctx;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        ioctx = lookup_ioctx(ctx);
 	if (likely(NULL != ioctx)) {
 		io_destroy(ioctx);
 		put_ioctx(ioctx);
@@ -1679,6 +1687,9 @@ long do_io_submit(aio_context_t ctx_id,
 SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr,
 		struct iocb __user * __user *, iocbpp)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_io_submit(ctx_id, nr, iocbpp, 0);
 }
 
@@ -1720,6 +1731,9 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t
 	u32 key;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = get_user(key, &iocb->aio_key);
 	if (unlikely(ret))
 		return -EFAULT;
@@ -1780,9 +1794,13 @@ SYSCALL_DEFINE5(io_getevents, aio_contex
 		struct io_event __user *, events,
 		struct timespec __user *, timeout)
 {
-	struct kioctx *ioctx = lookup_ioctx(ctx_id);
+	struct kioctx *ioctx;
 	long ret = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        ioctx = lookup_ioctx(ctx_id);
 	if (likely(ioctx)) {
 		if (likely(min_nr <= nr && min_nr >= 0))
 			ret = read_events(ioctx, min_nr, nr, events, timeout);
diff -ruNp linux-3.7.5/fs/buffer.c linux-3.7.5-cher1/fs/buffer.c
--- linux-3.7.5/fs/buffer.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/buffer.c	2013-01-30 00:02:15.219800079 +0400
@@ -3206,6 +3206,9 @@ SYSCALL_DEFINE2(bdflush, int, func, long
 {
 	static int msg_count;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
diff -ruNp linux-3.7.5/fs/compat.c linux-3.7.5-cher1/fs/compat.c
--- linux-3.7.5/fs/compat.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/compat.c	2013-01-30 00:02:12.497793610 +0400
@@ -79,6 +79,11 @@ asmlinkage long compat_sys_utime(const c
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (t) {
 		if (get_user(tv[0].tv_sec, &t->actime) ||
 		    get_user(tv[1].tv_sec, &t->modtime))
@@ -93,6 +98,11 @@ asmlinkage long compat_sys_utimensat(uns
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if  (t) {
 		if (get_compat_timespec(&tv[0], &t[0]) ||
 		    get_compat_timespec(&tv[1], &t[1]))
@@ -108,6 +118,11 @@ asmlinkage long compat_sys_futimesat(uns
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (t) {
 		if (get_user(tv[0].tv_sec, &t[0].tv_sec) ||
 		    get_user(tv[0].tv_nsec, &t[0].tv_usec) ||
@@ -161,12 +176,25 @@ static int cp_compat_stat(struct kstat *
 	return copy_to_user(ubuf, &tmp, sizeof(tmp)) ? -EFAULT : 0;
 }
 
+int cher_patch_is_secure_path(const char*);
+
 asmlinkage long compat_sys_newstat(const char __user * filename,
 		struct compat_stat __user *statbuf)
 {
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
 	error = vfs_stat(filename, &stat);
 	if (error)
 		return error;
@@ -179,6 +207,17 @@ asmlinkage long compat_sys_newlstat(cons
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                char *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
 	error = vfs_lstat(filename, &stat);
 	if (error)
 		return error;
@@ -193,6 +232,9 @@ asmlinkage long compat_sys_newfstatat(un
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = vfs_fstatat(dfd, filename, &stat, flag);
 	if (error)
 		return error;
@@ -252,7 +294,12 @@ static int put_compat_statfs(struct comp
 asmlinkage long compat_sys_statfs(const char __user *pathname, struct compat_statfs __user *buf)
 {
 	struct kstatfs tmp;
-	int error = user_statfs(pathname, &tmp);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        error = user_statfs(pathname, &tmp);
 	if (!error)
 		error = put_compat_statfs(buf, &tmp);
 	return error;
@@ -261,7 +308,12 @@ asmlinkage long compat_sys_statfs(const
 asmlinkage long compat_sys_fstatfs(unsigned int fd, struct compat_statfs __user *buf)
 {
 	struct kstatfs tmp;
-	int error = fd_statfs(fd, &tmp);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        error = fd_statfs(fd, &tmp);
 	if (!error)
 		error = put_compat_statfs(buf, &tmp);
 	return error;
@@ -305,6 +357,9 @@ asmlinkage long compat_sys_statfs64(cons
 	struct kstatfs tmp;
 	int error;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -319,6 +374,9 @@ asmlinkage long compat_sys_fstatfs64(uns
 	struct kstatfs tmp;
 	int error;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -337,7 +395,12 @@ asmlinkage long compat_sys_ustat(unsigne
 {
 	struct compat_ustat tmp;
 	struct kstatfs sbuf;
-	int err = vfs_ustat(new_decode_dev(dev), &sbuf);
+	int err;
+
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        err = vfs_ustat(new_decode_dev(dev), &sbuf);
 	if (err)
 		return err;
 
@@ -408,6 +471,9 @@ asmlinkage long compat_sys_fcntl64(unsig
 	struct flock f;
 	long ret;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	switch (cmd) {
 	case F_GETLK:
 	case F_SETLK:
@@ -485,6 +551,10 @@ compat_sys_io_setup(unsigned nr_reqs, u3
 	aio_context_t ctx64;
 
 	mm_segment_t oldfs = get_fs();
+
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (unlikely(get_user(ctx64, ctx32p)))
 		return -EFAULT;
 
@@ -509,6 +579,9 @@ compat_sys_io_getevents(aio_context_t ct
 	struct timespec t;
 	struct timespec __user *ut = NULL;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = -EFAULT;
 	if (unlikely(!access_ok(VERIFY_WRITE, events, 
 				nr * sizeof(struct io_event))))
@@ -621,6 +694,9 @@ compat_sys_io_submit(aio_context_t ctx_i
 	struct iocb __user * __user *iocb64; 
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (unlikely(nr < 0))
 		return -EINVAL;
 
@@ -779,6 +855,11 @@ asmlinkage long compat_sys_mount(const c
 	struct filename *dir;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	retval = copy_mount_string(type, &kernel_type);
 	if (retval < 0)
 		goto out;
@@ -873,6 +954,9 @@ asmlinkage long compat_sys_old_readdir(u
 	struct fd f = fdget(fd);
 	struct compat_readdir_callback buf;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!f.file)
 		return -EBADF;
 
@@ -952,6 +1036,9 @@ asmlinkage long compat_sys_getdents(unsi
 	struct compat_getdents_callback buf;
 	int error;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		return -EFAULT;
 
@@ -1037,6 +1124,9 @@ asmlinkage long compat_sys_getdents64(un
 	struct compat_getdents_callback64 buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                 return -EPERM;
+
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		return -EFAULT;
 
@@ -1168,6 +1258,9 @@ compat_sys_preadv64(unsigned long fd, co
 	struct fd f;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 	f = fdget(fd);
@@ -1234,6 +1327,9 @@ compat_sys_pwritev64(unsigned long fd, c
 	struct fd f;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 	f = fdget(fd);
@@ -1260,6 +1356,12 @@ compat_sys_vmsplice(int fd, const struct
 {
 	unsigned i;
 	struct iovec __user *iov;
+
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (nr_segs > UIO_MAXIOV)
 		return -EINVAL;
 	iov = compat_alloc_user_space(nr_segs * sizeof(struct iovec));
@@ -1291,6 +1393,10 @@ compat_sys_open(const char __user *filen
 asmlinkage long
 compat_sys_openat(unsigned int dfd, const char __user *filename, int flags, umode_t mode)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
 	return do_sys_open(dfd, filename, flags, mode);
 }
 
@@ -1673,6 +1779,9 @@ asmlinkage long compat_sys_epoll_pwait(i
 	compat_sigset_t csigmask;
 	sigset_t ksigmask, sigsaved;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/*
 	 * If the caller wants a certain signal mask to be set during the wait,
 	 * we apply it here.
@@ -1719,6 +1828,9 @@ asmlinkage long compat_sys_signalfd4(int
 	sigset_t tmp;
 	sigset_t __user *ksigmask;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sigsetsize != sizeof(compat_sigset_t))
 		return -EINVAL;
 	if (copy_from_user(&ss32, sigmask, sizeof(ss32)))
@@ -1749,6 +1861,9 @@ asmlinkage long compat_sys_timerfd_setti
 	struct itimerspec t;
 	struct itimerspec __user *ut;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (get_compat_itimerspec(&t, utmr))
 		return -EFAULT;
 	ut = compat_alloc_user_space(2 * sizeof(struct itimerspec));
@@ -1769,6 +1884,9 @@ asmlinkage long compat_sys_timerfd_getti
 	struct itimerspec t;
 	struct itimerspec __user *ut;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ut = compat_alloc_user_space(sizeof(struct itimerspec));
 	error = sys_timerfd_gettime(ufd, ut);
 	if (!error)
@@ -1789,6 +1907,9 @@ asmlinkage long
 compat_sys_open_by_handle_at(int mountdirfd,
 			     struct file_handle __user *handle, int flags)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_handle_open(mountdirfd, handle, flags);
 }
 #endif
diff -ruNp linux-3.7.5/fs/compat_ioctl.c linux-3.7.5-cher1/fs/compat_ioctl.c
--- linux-3.7.5/fs/compat_ioctl.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/compat_ioctl.c	2013-01-30 00:02:12.207792916 +0400
@@ -1546,6 +1546,9 @@ asmlinkage long compat_sys_ioctl(unsigne
 	if (!f.file)
 		goto out;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* RED-PEN how should LSM module know it's handling 32bit? */
 	error = security_file_ioctl(f.file, cmd, arg);
 	if (error)
diff -ruNp linux-3.7.5/fs/dcache.c linux-3.7.5-cher1/fs/dcache.c
--- linux-3.7.5/fs/dcache.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/dcache.c	2013-01-30 00:02:15.491800703 +0400
@@ -2894,8 +2894,14 @@ SYSCALL_DEFINE2(getcwd, char __user *, b
 {
 	int error;
 	struct path pwd, root;
-	char *page = (char *) __get_free_page(GFP_USER);
+	char *page;
 
+        if (SBOX_IS_RESTRICTED()) {
+                copy_to_user(buf, "/SANDBOX", 9);
+                return 9;
+        }
+
+        page = (char *) __get_free_page(GFP_USER);
 	if (!page)
 		return -ENOMEM;
 
diff -ruNp linux-3.7.5/fs/dcookies.c linux-3.7.5-cher1/fs/dcookies.c
--- linux-3.7.5/fs/dcookies.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/dcookies.c	2013-01-30 00:02:15.786801406 +0400
@@ -154,6 +154,11 @@ SYSCALL_DEFINE(lookup_dcookie)(u64 cooki
 	size_t pathlen;
 	struct dcookie_struct * dcs;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* we could leak path information to users
 	 * without dir read permission without this
 	 */
diff -ruNp linux-3.7.5/fs/eventfd.c linux-3.7.5-cher1/fs/eventfd.c
--- linux-3.7.5/fs/eventfd.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/eventfd.c	2013-01-30 00:02:16.106802167 +0400
@@ -408,6 +408,9 @@ SYSCALL_DEFINE2(eventfd2, unsigned int,
 	int fd, error;
 	struct file *file;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = get_unused_fd_flags(flags & EFD_SHARED_FCNTL_FLAGS);
 	if (error < 0)
 		return error;
diff -ruNp linux-3.7.5/fs/eventpoll.c linux-3.7.5-cher1/fs/eventpoll.c
--- linux-3.7.5/fs/eventpoll.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/eventpoll.c	2013-01-30 00:02:11.903792195 +0400
@@ -1648,6 +1648,9 @@ SYSCALL_DEFINE1(epoll_create1, int, flag
 	struct eventpoll *ep = NULL;
 	struct file *file;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the EPOLL_* constant for consistency.  */
 	BUILD_BUG_ON(EPOLL_CLOEXEC != O_CLOEXEC);
 
@@ -1708,6 +1711,9 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, in
 	struct epitem *epi;
 	struct epoll_event epds;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EFAULT;
 	if (ep_op_has_event(op) &&
 	    copy_from_user(&epds, event, sizeof(struct epoll_event)))
@@ -1833,6 +1839,9 @@ SYSCALL_DEFINE4(epoll_wait, int, epfd, s
 	struct fd f;
 	struct eventpoll *ep;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* The maximum number of event must be greater than zero */
 	if (maxevents <= 0 || maxevents > EP_MAX_EVENTS)
 		return -EINVAL;
@@ -1879,6 +1888,9 @@ SYSCALL_DEFINE6(epoll_pwait, int, epfd,
 	int error;
 	sigset_t ksigmask, sigsaved;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/*
 	 * If the caller wants a certain signal mask to be set during the wait,
 	 * we apply it here.
diff -ruNp linux-3.7.5/fs/exec.c linux-3.7.5-cher1/fs/exec.c
--- linux-3.7.5/fs/exec.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/exec.c	2013-01-30 00:01:11.582649064 +0400
@@ -116,6 +116,11 @@ SYSCALL_DEFINE1(uselib, const char __use
 	if (IS_ERR(tmp))
 		goto out;
 
+        if (SBOX_IS_RESTRICTED()) {
+                putname(tmp);
+                return -EPERM;
+        }
+
 	file = do_filp_open(AT_FDCWD, tmp, &uselib_flags, LOOKUP_FOLLOW);
 	putname(tmp);
 	error = PTR_ERR(file);
@@ -1681,10 +1686,22 @@ SYSCALL_DEFINE3(execve,
 		const char __user *const __user *, argv,
 		const char __user *const __user *, envp)
 {
-	struct filename *path = getname(filename);
-	int error = PTR_ERR(path);
+        struct filename *path = NULL;
+	int error = 0;
+
+        if ((current->sbox_flags & SBOX_NO_EXEC)) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+        path = getname(filename);
+        error = PTR_ERR(path);
 	if (!IS_ERR(path)) {
 		error = do_execve(path->name, argv, envp, current_pt_regs());
+                if (!error) {
+                        if ((current->sbox_flags & SBOX_NO_SYSCALLS))
+                        current->sbox_flags |= SBOX_NO_EXEC;
+                }
 		putname(path);
 	}
 	return error;
@@ -1694,11 +1711,23 @@ asmlinkage long compat_sys_execve(const
 	const compat_uptr_t __user * argv,
 	const compat_uptr_t __user * envp)
 {
-	struct filename *path = getname(filename);
-	int error = PTR_ERR(path);
+	struct filename *path = NULL;
+	int error = 0;
+
+        if ((current->sbox_flags & SBOX_NO_EXEC)) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+        path = getname(filename);
+        error = PTR_ERR(path);
 	if (!IS_ERR(path)) {
 		error = compat_do_execve(path->name, argv, envp,
 							current_pt_regs());
+                if (!error) {
+                        if ((current->sbox_flags & SBOX_NO_SYSCALLS))
+                        current->sbox_flags |= SBOX_NO_EXEC;
+                }
 		putname(path);
 	}
 	return error;
diff -ruNp linux-3.7.5/fs/fcntl.c linux-3.7.5-cher1/fs/fcntl.c
--- linux-3.7.5/fs/fcntl.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/fcntl.c	2013-01-30 00:02:11.600791470 +0400
@@ -351,6 +351,9 @@ SYSCALL_DEFINE3(fcntl, unsigned int, fd,
 	struct fd f = fdget_raw(fd);
 	long err = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!f.file)
 		goto out;
 
@@ -376,6 +379,9 @@ SYSCALL_DEFINE3(fcntl64, unsigned int, f
 	struct fd f = fdget_raw(fd);
 	long err = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!f.file)
 		goto out;
 
diff -ruNp linux-3.7.5/fs/fhandle.c linux-3.7.5-cher1/fs/fhandle.c
--- linux-3.7.5/fs/fhandle.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/fhandle.c	2013-01-30 00:02:16.446802972 +0400
@@ -97,6 +97,11 @@ SYSCALL_DEFINE5(name_to_handle_at, int,
 	int lookup_flags;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
 		return -EINVAL;
 
@@ -257,6 +262,11 @@ SYSCALL_DEFINE3(open_by_handle_at, int,
 {
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (force_o_largefile())
 		flags |= O_LARGEFILE;
 
diff -ruNp linux-3.7.5/fs/filesystems.c linux-3.7.5-cher1/fs/filesystems.c
--- linux-3.7.5/fs/filesystems.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/filesystems.c	2013-01-30 00:02:11.301790771 +0400
@@ -184,6 +184,9 @@ SYSCALL_DEFINE3(sysfs, int, option, unsi
 {
 	int retval = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	switch (option) {
 		case 1:
 			retval = fs_index((const char __user *) arg1);
diff -ruNp linux-3.7.5/fs/ioctl.c linux-3.7.5-cher1/fs/ioctl.c
--- linux-3.7.5/fs/ioctl.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/ioctl.c	2013-01-30 00:02:11.021790101 +0400
@@ -606,6 +606,9 @@ SYSCALL_DEFINE3(ioctl, unsigned int, fd,
 	int error;
 	struct fd f = fdget(fd);
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!f.file)
 		return -EBADF;
 	error = security_file_ioctl(f.file, cmd, arg);
diff -ruNp linux-3.7.5/fs/ioprio.c linux-3.7.5-cher1/fs/ioprio.c
--- linux-3.7.5/fs/ioprio.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/ioprio.c	2013-01-30 00:02:10.711789366 +0400
@@ -68,6 +68,9 @@ SYSCALL_DEFINE3(ioprio_set, int, which,
 	kuid_t uid;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	switch (class) {
 		case IOPRIO_CLASS_RT:
 			if (!capable(CAP_SYS_ADMIN))
@@ -182,6 +185,9 @@ SYSCALL_DEFINE2(ioprio_get, int, which,
 	int ret = -ESRCH;
 	int tmpio;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	rcu_read_lock();
 	switch (which) {
 		case IOPRIO_WHO_PROCESS:
diff -ruNp linux-3.7.5/fs/locks.c linux-3.7.5-cher1/fs/locks.c
--- linux-3.7.5/fs/locks.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/locks.c	2013-01-30 00:02:10.430788692 +0400
@@ -1630,6 +1630,9 @@ SYSCALL_DEFINE2(flock, unsigned int, fd,
 	int can_sleep, unlock;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EBADF;
 	if (!f.file)
 		goto out;
diff -ruNp linux-3.7.5/fs/namei.c linux-3.7.5-cher1/fs/namei.c
--- linux-3.7.5/fs/namei.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/namei.c	2013-01-30 00:02:10.130787988 +0400
@@ -3176,6 +3176,11 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = may_mknod(mode);
 	if (error)
 		return error;
@@ -3242,6 +3247,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	dentry = user_path_create(dfd, pathname, &path, 1);
 	if (IS_ERR(dentry))
 		return PTR_ERR(dentry);
@@ -3375,6 +3385,9 @@ exit1:
 
 SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_rmdir(AT_FDCWD, pathname);
 }
 
@@ -3472,6 +3485,11 @@ slashes:
 
 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((flag & ~AT_REMOVEDIR) != 0)
 		return -EINVAL;
 
@@ -3483,6 +3501,9 @@ SYSCALL_DEFINE3(unlinkat, int, dfd, cons
 
 SYSCALL_DEFINE1(unlink, const char __user *, pathname)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_unlinkat(AT_FDCWD, pathname);
 }
 
@@ -3514,6 +3535,9 @@ SYSCALL_DEFINE3(symlinkat, const char __
 	struct dentry *dentry;
 	struct path path;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	from = getname(oldname);
 	if (IS_ERR(from))
 		return PTR_ERR(from);
@@ -3598,6 +3622,9 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
 	int how = 0;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
 		return -EINVAL;
 	/*
@@ -3809,6 +3836,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
 	struct filename *to;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	from = user_path_parent(olddfd, oldname, &oldnd);
 	if (IS_ERR(from)) {
 		error = PTR_ERR(from);
diff -ruNp linux-3.7.5/fs/namespace.c linux-3.7.5-cher1/fs/namespace.c
--- linux-3.7.5/fs/namespace.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/namespace.c	2013-01-30 00:02:16.761803730 +0400
@@ -1249,6 +1249,11 @@ SYSCALL_DEFINE2(umount, char __user *, n
 	int retval;
 	int lookup_flags = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
 		return -EINVAL;
 
@@ -2412,6 +2417,11 @@ SYSCALL_DEFINE5(mount, char __user *, de
 	char *kernel_dev;
 	unsigned long data_page;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ret = copy_mount_string(type, &kernel_type);
 	if (ret < 0)
 		goto out_type;
@@ -2501,6 +2511,11 @@ SYSCALL_DEFINE2(pivot_root, const char _
 	struct mount *new_mnt, *root_mnt;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
diff -ruNp linux-3.7.5/fs/notify/fanotify/fanotify_user.c linux-3.7.5-cher1/fs/notify/fanotify/fanotify_user.c
--- linux-3.7.5/fs/notify/fanotify/fanotify_user.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/notify/fanotify/fanotify_user.c	2013-01-30 00:02:09.824787260 +0400
@@ -658,6 +658,9 @@ SYSCALL_DEFINE2(fanotify_init, unsigned
 	int f_flags, fd;
 	struct user_struct *user;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	pr_debug("%s: flags=%d event_f_flags=%d\n",
 		__func__, flags, event_f_flags);
 
@@ -751,6 +754,9 @@ SYSCALL_DEFINE(fanotify_mark)(int fanoti
 	struct path path;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	pr_debug("%s: fanotify_fd=%d flags=%x dfd=%d pathname=%p mask=%llx\n",
 		 __func__, fanotify_fd, flags, dfd, pathname, mask);
 
diff -ruNp linux-3.7.5/fs/notify/inotify/inotify_user.c linux-3.7.5-cher1/fs/notify/inotify/inotify_user.c
--- linux-3.7.5/fs/notify/inotify/inotify_user.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/notify/inotify/inotify_user.c	2013-01-30 00:02:09.478786443 +0400
@@ -726,6 +726,9 @@ SYSCALL_DEFINE1(inotify_init1, int, flag
 	struct fsnotify_group *group;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the IN_* constants for consistency.  */
 	BUILD_BUG_ON(IN_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(IN_NONBLOCK != O_NONBLOCK);
@@ -761,6 +764,9 @@ SYSCALL_DEFINE3(inotify_add_watch, int,
 	int ret;
 	unsigned flags = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	f = fdget(fd);
 	if (unlikely(!f.file))
 		return -EBADF;
@@ -799,6 +805,9 @@ SYSCALL_DEFINE2(inotify_rm_watch, int, f
 	struct fd f;
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	f = fdget(fd);
 	if (unlikely(!f.file))
 		return -EBADF;
diff -ruNp linux-3.7.5/fs/open.c linux-3.7.5-cher1/fs/open.c
--- linux-3.7.5/fs/open.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/open.c	2013-01-31 00:38:44.212124451 +0400
@@ -127,6 +127,8 @@ out:
 
 SYSCALL_DEFINE2(truncate, const char __user *, path, long, length)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 	return do_sys_truncate(path, length);
 }
 
@@ -189,11 +191,15 @@ SYSCALL_DEFINE2(ftruncate, unsigned int,
 #if BITS_PER_LONG == 32
 SYSCALL_DEFINE(truncate64)(const char __user * path, loff_t length)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 	return do_sys_truncate(path, length);
 }
 #ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
 asmlinkage long SyS_truncate64(long path, loff_t length)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 	return SYSC_truncate64((const char __user *) path, length);
 }
 SYSCALL_ALIAS(sys_truncate64, SyS_truncate64);
@@ -294,6 +300,8 @@ asmlinkage long SyS_fallocate(long fd, l
 SYSCALL_ALIAS(sys_fallocate, SyS_fallocate);
 #endif
 
+int cher_patch_is_secure_path(const char*);
+
 /*
  * access() needs to use the real uid/gid, not the effective uid/gid.
  * We do this by temporarily clearing all FS-related capabilities and
@@ -307,6 +315,19 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
 	struct inode *inode;
 	int res;
 
+        if (SBOX_IS_RESTRICTED()) {
+                struct filename *tmp;
+                if (dfd != AT_FDCWD) return -EPERM;
+                tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp->name) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp("/SANDBOX/", tmp->name, 9)) filename += 9;
+                putname(tmp);
+        }
+
 	if (mode & ~S_IRWXO)	/* where's F_OK, X_OK, W_OK, R_OK? */
 		return -EINVAL;
 
@@ -380,6 +401,11 @@ SYSCALL_DEFINE1(chdir, const char __user
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_dir(filename, &path);
 	if (error)
 		goto out;
@@ -402,6 +428,11 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
 	struct inode *inode;
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = -EBADF;
 	if (!f.file)
 		goto out;
@@ -426,6 +457,11 @@ SYSCALL_DEFINE1(chroot, const char __use
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_dir(filename, &path);
 	if (error)
 		goto out;
@@ -476,6 +512,9 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
 	struct file * file;
 	int err = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	file = fget(fd);
 	if (file) {
 		audit_inode(NULL, file->f_path.dentry, 0);
@@ -490,6 +529,9 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = user_path_at(dfd, filename, LOOKUP_FOLLOW, &path);
 	if (!error) {
 		error = chmod_common(&path, mode);
@@ -546,6 +588,11 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
 	int error = -EINVAL;
 	int lookup_flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
 		goto out;
 
@@ -582,6 +629,11 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
 	struct fd f = fdget(fd);
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!f.file)
 		goto out;
 
@@ -908,13 +960,61 @@ struct file *file_open_root(struct dentr
 }
 EXPORT_SYMBOL(file_open_root);
 
+static const char * const secure_paths[] =
+{
+        "/lib/", "/lib32/", "/lib64/",
+        "/usr/lib/", "/usr/lib32/", "/usr/lib64/",
+        "/usr/include/", "/usr/libexec/",
+        "/usr/local/lib/", "/usr/local/lib32/", "/usr/local/lib64/",
+        "/usr/local/include/", "/usr/local/libexec/",
+        "/bin/", "/usr/bin/", "/usr/local/bin/",
+        "/usr/share/", "/usr/local/share/",
+        "/SANDBOX/",
+        NULL
+};
+
+int cher_patch_is_secure_path(const char *path)
+{
+        const char *s;
+        int i;
+
+        if (strstr(path, ".."))
+                return -1;
+        for (i = 0; secure_paths[i] && strncmp(path, secure_paths[i], strlen(secure_paths[i])); ++i);
+        if (secure_paths[i]) {
+                return 0;
+        }
+
+        if (!strncmp(path, "/SANDBOX/", 9)) path += 9;
+        s = path;
+        while (s[0] == '.' && s[1] == '/') s += 2;
+        for (; *s && *s != '/'; s++);
+        if (*s == '/') return -1;
+        return 0;
+}
+
 long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
 {
 	struct open_flags op;
-	int lookup = build_open_flags(flags, mode, &op);
+	int lookup;
 	struct filename *tmp = getname(filename);
-	int fd = PTR_ERR(tmp);
+	int fd = -1;
+
+        if (!IS_ERR(tmp) && SBOX_IS_RESTRICTED()) {
+                if (cher_patch_is_secure_path(tmp->name) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp->name, "/SANDBOX/", 9)) {
+                        putname(tmp);
+                        filename += 9;
+                        tmp = getname(filename);
+                }
+                flags &= ~(O_CREAT | O_EXCL);
+        }
 
+        lookup = build_open_flags(flags, mode, &op);
+        fd = PTR_ERR(tmp);
 	if (!IS_ERR(tmp)) {
 		fd = get_unused_fd_flags(flags);
 		if (fd >= 0) {
@@ -950,6 +1050,11 @@ SYSCALL_DEFINE4(openat, int, dfd, const
 {
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (force_o_largefile())
 		flags |= O_LARGEFILE;
 
@@ -1024,6 +1129,10 @@ EXPORT_SYMBOL(sys_close);
  */
 SYSCALL_DEFINE0(vhangup)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
 	if (capable(CAP_SYS_TTY_CONFIG)) {
 		tty_vhangup_self();
 		return 0;
diff -ruNp linux-3.7.5/fs/pipe.c linux-3.7.5-cher1/fs/pipe.c
--- linux-3.7.5/fs/pipe.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/pipe.c	2013-01-30 00:02:08.909785093 +0400
@@ -1120,6 +1120,11 @@ SYSCALL_DEFINE2(pipe2, int __user *, fil
 	int fd[2];
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = __do_pipe_flags(fd, files, flags);
 	if (!error) {
 		if (unlikely(copy_to_user(fildes, fd, sizeof(fd)))) {
diff -ruNp linux-3.7.5/fs/quota/compat.c linux-3.7.5-cher1/fs/quota/compat.c
--- linux-3.7.5/fs/quota/compat.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/quota/compat.c	2013-01-30 00:02:17.059804419 +0400
@@ -52,6 +52,11 @@ asmlinkage long sys32_quotactl(unsigned
 	u16 xdata;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	cmds = cmd >> SUBCMDSHIFT;
 
 	switch (cmds) {
diff -ruNp linux-3.7.5/fs/quota/quota.c linux-3.7.5-cher1/fs/quota/quota.c
--- linux-3.7.5/fs/quota/quota.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/quota/quota.c	2013-01-30 00:02:08.596784347 +0400
@@ -367,6 +367,11 @@ SYSCALL_DEFINE4(quotactl, unsigned int,
 	struct path path, *pathp = NULL;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	cmds = cmd >> SUBCMDSHIFT;
 	type = cmd & SUBCMDMASK;
 
diff -ruNp linux-3.7.5/fs/readdir.c linux-3.7.5-cher1/fs/readdir.c
--- linux-3.7.5/fs/readdir.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/readdir.c	2013-01-30 00:02:08.306783657 +0400
@@ -109,6 +109,9 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
 	struct fd f = fdget(fd);
 	struct readdir_callback buf;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!f.file)
 		return -EBADF;
 
@@ -194,6 +197,9 @@ SYSCALL_DEFINE3(getdents, unsigned int,
 	struct getdents_callback buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		return -EFAULT;
 
@@ -274,6 +280,9 @@ SYSCALL_DEFINE3(getdents64, unsigned int
 	struct getdents_callback64 buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		return -EFAULT;
 
diff -ruNp linux-3.7.5/fs/read_write.c linux-3.7.5-cher1/fs/read_write.c
--- linux-3.7.5/fs/read_write.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/read_write.c	2013-01-30 00:02:08.016782976 +0400
@@ -486,6 +486,9 @@ SYSCALL_DEFINE(pread64)(unsigned int fd,
 	struct fd f;
 	ssize_t ret = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -514,6 +517,9 @@ SYSCALL_DEFINE(pwrite64)(unsigned int fd
 	struct fd f;
 	ssize_t ret = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -821,6 +827,9 @@ SYSCALL_DEFINE5(preadv, unsigned long, f
 	struct fd f;
 	ssize_t ret = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -845,6 +854,9 @@ SYSCALL_DEFINE5(pwritev, unsigned long,
 	struct fd f;
 	ssize_t ret = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
diff -ruNp linux-3.7.5/fs/signalfd.c linux-3.7.5-cher1/fs/signalfd.c
--- linux-3.7.5/fs/signalfd.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/signalfd.c	2013-01-30 00:02:07.731782292 +0400
@@ -240,6 +240,9 @@ SYSCALL_DEFINE4(signalfd4, int, ufd, sig
 	sigset_t sigmask;
 	struct signalfd_ctx *ctx;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the SFD_* constants for consistency.  */
 	BUILD_BUG_ON(SFD_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(SFD_NONBLOCK != O_NONBLOCK);
diff -ruNp linux-3.7.5/fs/splice.c linux-3.7.5-cher1/fs/splice.c
--- linux-3.7.5/fs/splice.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/splice.c	2013-01-30 00:02:07.443781610 +0400
@@ -1671,6 +1671,11 @@ SYSCALL_DEFINE4(vmsplice, int, fd, const
 	struct fd f;
 	long error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (unlikely(nr_segs > UIO_MAXIOV))
 		return -EINVAL;
 	else if (unlikely(!nr_segs))
@@ -1697,6 +1702,11 @@ SYSCALL_DEFINE6(splice, int, fd_in, loff
 	struct fd in, out;
 	long error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (unlikely(!len))
 		return 0;
 
@@ -2028,6 +2038,11 @@ SYSCALL_DEFINE4(tee, int, fdin, int, fdo
 	struct fd in;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (unlikely(!len))
 		return 0;
 
diff -ruNp linux-3.7.5/fs/stat.c linux-3.7.5-cher1/fs/stat.c
--- linux-3.7.5/fs/stat.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/stat.c	2013-01-31 00:40:53.844267230 +0400
@@ -152,12 +152,25 @@ static int cp_old_stat(struct kstat *sta
 	return copy_to_user(statbuf,&tmp,sizeof(tmp)) ? -EFAULT : 0;
 }
 
+int cher_patch_is_secure_path(const char *);
+
 SYSCALL_DEFINE2(stat, const char __user *, filename,
 		struct __old_kernel_stat __user *, statbuf)
 {
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                struct filename *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp->name) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp->name, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
 	error = vfs_stat(filename, &stat);
 	if (error)
 		return error;
@@ -171,6 +184,17 @@ SYSCALL_DEFINE2(lstat, const char __user
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                struct filename *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp->name) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp->name, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
 	error = vfs_lstat(filename, &stat);
 	if (error)
 		return error;
@@ -245,8 +269,20 @@ SYSCALL_DEFINE2(newstat, const char __us
 		struct stat __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_stat(filename, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED()) {
+                struct filename *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp->name) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp->name, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
 
+        error = vfs_stat(filename, &stat);
 	if (error)
 		return error;
 	return cp_new_stat(&stat, statbuf);
@@ -258,6 +294,17 @@ SYSCALL_DEFINE2(newlstat, const char __u
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                struct filename *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp->name) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp->name, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
 	error = vfs_lstat(filename, &stat);
 	if (error)
 		return error;
@@ -272,6 +319,9 @@ SYSCALL_DEFINE4(newfstatat, int, dfd, co
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = vfs_fstatat(dfd, filename, &stat, flag);
 	if (error)
 		return error;
@@ -297,6 +347,9 @@ SYSCALL_DEFINE4(readlinkat, int, dfd, co
 	int error;
 	int empty = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (bufsiz <= 0)
 		return -EINVAL;
 
@@ -373,8 +426,20 @@ SYSCALL_DEFINE2(stat64, const char __use
 		struct stat64 __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_stat(filename, &stat);
+	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                struct filename *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp->name) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp->name, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
+        error = vfs_stat(filename, &stat);
 	if (!error)
 		error = cp_new_stat64(&stat, statbuf);
 
@@ -385,8 +450,20 @@ SYSCALL_DEFINE2(lstat64, const char __us
 		struct stat64 __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_lstat(filename, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED()) {
+                struct filename *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp->name) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp->name, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
 
+        error = vfs_lstat(filename, &stat);
 	if (!error)
 		error = cp_new_stat64(&stat, statbuf);
 
diff -ruNp linux-3.7.5/fs/statfs.c linux-3.7.5-cher1/fs/statfs.c
--- linux-3.7.5/fs/statfs.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/statfs.c	2013-01-30 00:02:07.144780953 +0400
@@ -165,7 +165,12 @@ static int do_statfs64(struct kstatfs *s
 SYSCALL_DEFINE2(statfs, const char __user *, pathname, struct statfs __user *, buf)
 {
 	struct kstatfs st;
-	int error = user_statfs(pathname, &st);
+	int error = 0;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	error = user_statfs(pathname, &st);
 	if (!error)
 		error = do_statfs_native(&st, buf);
 	return error;
@@ -175,6 +180,10 @@ SYSCALL_DEFINE3(statfs64, const char __u
 {
 	struct kstatfs st;
 	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 	error = user_statfs(pathname, &st);
@@ -186,7 +195,12 @@ SYSCALL_DEFINE3(statfs64, const char __u
 SYSCALL_DEFINE2(fstatfs, unsigned int, fd, struct statfs __user *, buf)
 {
 	struct kstatfs st;
-	int error = fd_statfs(fd, &st);
+	int error = 0;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	error = fd_statfs(fd, &st);
 	if (!error)
 		error = do_statfs_native(&st, buf);
 	return error;
@@ -197,6 +211,9 @@ SYSCALL_DEFINE3(fstatfs64, unsigned int,
 	struct kstatfs st;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -222,7 +239,12 @@ SYSCALL_DEFINE2(ustat, unsigned, dev, st
 {
 	struct ustat tmp;
 	struct kstatfs sbuf;
-	int err = vfs_ustat(new_decode_dev(dev), &sbuf);
+	int err = 0;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	err = vfs_ustat(new_decode_dev(dev), &sbuf);
 	if (err)
 		return err;
 
diff -ruNp linux-3.7.5/fs/sync.c linux-3.7.5-cher1/fs/sync.c
--- linux-3.7.5/fs/sync.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/sync.c	2013-01-30 00:02:06.864780243 +0400
@@ -103,6 +103,9 @@ SYSCALL_DEFINE0(sync)
 {
 	int nowait = 0, wait = 1;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	wakeup_flusher_threads(0, WB_REASON_SYNC);
 	iterate_supers(sync_inodes_one_sb, NULL);
 	iterate_supers(sync_fs_one_sb, &nowait);
@@ -152,6 +155,9 @@ SYSCALL_DEFINE1(syncfs, int, fd)
 	struct super_block *sb;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!f.file)
 		return -EBADF;
 	sb = f.file->f_dentry->d_sb;
@@ -211,11 +217,17 @@ static int do_fsync(unsigned int fd, int
 
 SYSCALL_DEFINE1(fsync, unsigned int, fd)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_fsync(fd, 0);
 }
 
 SYSCALL_DEFINE1(fdatasync, unsigned int, fd)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_fsync(fd, 1);
 }
 
@@ -292,6 +304,9 @@ SYSCALL_DEFINE(sync_file_range)(int fd,
 	loff_t endbyte;			/* inclusive */
 	umode_t i_mode;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = -EINVAL;
 	if (flags & ~VALID_FLAGS)
 		goto out;
diff -ruNp linux-3.7.5/fs/timerfd.c linux-3.7.5-cher1/fs/timerfd.c
--- linux-3.7.5/fs/timerfd.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/timerfd.c	2013-01-30 00:02:06.577779552 +0400
@@ -252,6 +252,9 @@ SYSCALL_DEFINE2(timerfd_create, int, clo
 	int ufd;
 	struct timerfd_ctx *ctx;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the TFD_* constants for consistency.  */
 	BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(TFD_NONBLOCK != O_NONBLOCK);
@@ -287,6 +290,9 @@ SYSCALL_DEFINE4(timerfd_settime, int, uf
 	struct itimerspec ktmr, kotmr;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (copy_from_user(&ktmr, utmr, sizeof(ktmr)))
 		return -EFAULT;
 
@@ -344,7 +350,12 @@ SYSCALL_DEFINE2(timerfd_gettime, int, uf
 	struct fd f;
 	struct timerfd_ctx *ctx;
 	struct itimerspec kotmr;
-	int ret = timerfd_fget(ufd, &f);
+        int ret;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	ret = timerfd_fget(ufd, &f);
 	if (ret)
 		return ret;
 	ctx = f.file->private_data;
diff -ruNp linux-3.7.5/fs/utimes.c linux-3.7.5-cher1/fs/utimes.c
--- linux-3.7.5/fs/utimes.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/utimes.c	2013-01-30 00:02:17.673805882 +0400
@@ -28,6 +28,9 @@ SYSCALL_DEFINE2(utime, char __user *, fi
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (times) {
 		if (get_user(tv[0].tv_sec, &times->actime) ||
 		    get_user(tv[1].tv_sec, &times->modtime))
@@ -176,6 +179,9 @@ SYSCALL_DEFINE4(utimensat, int, dfd, con
 {
 	struct timespec tstimes[2];
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (utimes) {
 		if (copy_from_user(&tstimes, utimes, sizeof(tstimes)))
 			return -EFAULT;
@@ -195,6 +201,9 @@ SYSCALL_DEFINE3(futimesat, int, dfd, con
 	struct timeval times[2];
 	struct timespec tstimes[2];
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (utimes) {
 		if (copy_from_user(&times, utimes, sizeof(times)))
 			return -EFAULT;
diff -ruNp linux-3.7.5/fs/xattr.c linux-3.7.5-cher1/fs/xattr.c
--- linux-3.7.5/fs/xattr.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/fs/xattr.c	2013-01-30 00:02:06.270778829 +0400
@@ -371,6 +371,11 @@ SYSCALL_DEFINE5(setxattr, const char __u
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path(pathname, &path);
 	if (error)
 		return error;
@@ -390,6 +395,11 @@ SYSCALL_DEFINE5(lsetxattr, const char __
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_lpath(pathname, &path);
 	if (error)
 		return error;
@@ -409,6 +419,11 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
 	struct dentry *dentry;
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!f.file)
 		return error;
 	dentry = f.file->f_path.dentry;
@@ -477,6 +492,11 @@ SYSCALL_DEFINE4(getxattr, const char __u
 	struct path path;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path(pathname, &path);
 	if (error)
 		return error;
@@ -491,6 +511,11 @@ SYSCALL_DEFINE4(lgetxattr, const char __
 	struct path path;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_lpath(pathname, &path);
 	if (error)
 		return error;
@@ -505,6 +530,11 @@ SYSCALL_DEFINE4(fgetxattr, int, fd, cons
 	struct fd f = fdget(fd);
 	ssize_t error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!f.file)
 		return error;
 	audit_inode(NULL, f.file->f_path.dentry, 0);
@@ -557,6 +587,11 @@ SYSCALL_DEFINE3(listxattr, const char __
 	struct path path;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path(pathname, &path);
 	if (error)
 		return error;
@@ -571,6 +606,11 @@ SYSCALL_DEFINE3(llistxattr, const char _
 	struct path path;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_lpath(pathname, &path);
 	if (error)
 		return error;
@@ -584,6 +624,11 @@ SYSCALL_DEFINE3(flistxattr, int, fd, cha
 	struct fd f = fdget(fd);
 	ssize_t error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!f.file)
 		return error;
 	audit_inode(NULL, f.file->f_path.dentry, 0);
@@ -616,6 +661,11 @@ SYSCALL_DEFINE2(removexattr, const char
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path(pathname, &path);
 	if (error)
 		return error;
@@ -634,6 +684,11 @@ SYSCALL_DEFINE2(lremovexattr, const char
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_lpath(pathname, &path);
 	if (error)
 		return error;
@@ -652,6 +707,11 @@ SYSCALL_DEFINE2(fremovexattr, int, fd, c
 	struct dentry *dentry;
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!f.file)
 		return error;
 	dentry = f.file->f_path.dentry;
diff -ruNp linux-3.7.5/include/linux/sched.h linux-3.7.5-cher1/include/linux/sched.h
--- linux-3.7.5/include/linux/sched.h	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/include/linux/sched.h	2013-01-30 00:02:05.684777447 +0400
@@ -1187,6 +1187,17 @@ enum perf_event_task_context {
 	perf_nr_task_contexts,
 };
 
+/* sandbox flags */
+enum {
+	SBOX_NO_SYSCALLS  = 1,   /* disable most "dangerous" syscalls */
+	SBOX_NO_EXEC      = 2,   /* disable exec syscall */
+	SBOX_MEMLIMITON   = 4,   /* enable memory limit check */
+	SBOX_WAS_MEMLIMIT = 8,   /* memory limit happened?  */
+	SBOX_WAS_SECURITY = 16,  /* was security violation? */
+	SBOX_TLON         = 32,  /* enable kernel time limit check */
+	SBOX_WAS_TL       = 64   /* was time limit? */
+};
+
 struct task_struct {
 	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
 	void *stack;
@@ -1548,8 +1559,19 @@ struct task_struct {
 #ifdef CONFIG_UPROBES
 	struct uprobe_task *utask;
 #endif
+
+	/* sandbox flags */
+	int sbox_flags;
 };
 
+#define SBOX_IS_RESTRICTED() unlikely(current->sbox_flags & SBOX_NO_SYSCALLS)
+#define SBOX_SET_SECURITY_ERR() do { current->sbox_flags |= SBOX_WAS_SECURITY; printk(KERN_ERR "%s: %s: %d: security violation\n", __FUNCTION__, __FILE__, __LINE__); } while (0)
+#define SBOX_SET_TL_ERR() (current->sbox_flags |= SBOX_WAS_TL)
+
+#define SBOX_IS_MEMLIMIT_ERR(p) (p->sbox_flags & SBOX_WAS_MEMLIMIT)
+#define SBOX_IS_SECURITY_ERR(p) (p->sbox_flags & SBOX_WAS_SECURITY)
+#define SBOX_IS_TL_ERR(p) (p->sbox_flags & SBOX_WAS_TL)
+
 /* Future-safe accessor for struct task_struct's cpus_allowed. */
 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
 
diff -ruNp linux-3.7.5/include/uapi/linux/ptrace.h linux-3.7.5-cher1/include/uapi/linux/ptrace.h
--- linux-3.7.5/include/uapi/linux/ptrace.h	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/include/uapi/linux/ptrace.h	2013-01-30 00:02:05.972778122 +0400
@@ -48,6 +48,10 @@
 #define PTRACE_GETREGSET	0x4204
 #define PTRACE_SETREGSET	0x4205
 
+#define PTRACE_MEMLIMIT         0x4280
+#define PTRACE_NO_SYSCALLS      0x4281
+#define PTRACE_TIMELIMIT        0x4282
+
 #define PTRACE_SEIZE		0x4206
 #define PTRACE_INTERRUPT	0x4207
 #define PTRACE_LISTEN		0x4208
diff -ruNp linux-3.7.5/ipc/mqueue.c linux-3.7.5-cher1/ipc/mqueue.c
--- linux-3.7.5/ipc/mqueue.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/ipc/mqueue.c	2013-01-30 00:02:05.430776836 +0400
@@ -780,6 +780,11 @@ SYSCALL_DEFINE4(mq_open, const char __us
 	struct dentry *root = mnt->mnt_root;
 	int ro;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_attr && copy_from_user(&attr, u_attr, sizeof(struct mq_attr)))
 		return -EFAULT;
 
@@ -855,6 +860,11 @@ SYSCALL_DEFINE1(mq_unlink, const char __
 	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
 	struct vfsmount *mnt = ipc_ns->mq_mnt;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	name = getname(u_name);
 	if (IS_ERR(name))
 		return PTR_ERR(name);
@@ -955,6 +965,11 @@ SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqd
 	struct posix_msg_tree_node *new_leaf = NULL;
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_abs_timeout) {
 		int res = prepare_timeout(u_abs_timeout, &expires, &ts);
 		if (res)
@@ -1074,6 +1089,11 @@ SYSCALL_DEFINE5(mq_timedreceive, mqd_t,
 	struct timespec ts;
 	struct posix_msg_tree_node *new_leaf = NULL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_abs_timeout) {
 		int res = prepare_timeout(u_abs_timeout, &expires, &ts);
 		if (res)
@@ -1179,6 +1199,11 @@ SYSCALL_DEFINE2(mq_notify, mqd_t, mqdes,
 	struct mqueue_inode_info *info;
 	struct sk_buff *nc;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_notification) {
 		if (copy_from_user(&notification, u_notification,
 					sizeof(struct sigevent)))
@@ -1310,6 +1335,11 @@ SYSCALL_DEFINE3(mq_getsetattr, mqd_t, mq
 	struct inode *inode;
 	struct mqueue_inode_info *info;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_mqstat != NULL) {
 		if (copy_from_user(&mqstat, u_mqstat, sizeof(struct mq_attr)))
 			return -EFAULT;
diff -ruNp linux-3.7.5/ipc/msg.c linux-3.7.5-cher1/ipc/msg.c
--- linux-3.7.5/ipc/msg.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/ipc/msg.c	2013-01-30 00:02:18.001806657 +0400
@@ -315,6 +315,11 @@ SYSCALL_DEFINE2(msgget, key_t, key, int,
 	struct ipc_ops msg_ops;
 	struct ipc_params msg_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	msg_ops.getnew = newque;
@@ -475,6 +480,11 @@ SYSCALL_DEFINE3(msgctl, int, msqid, int,
 	int err, version;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (msqid < 0 || cmd < 0)
 		return -EINVAL;
 
@@ -731,6 +741,11 @@ SYSCALL_DEFINE4(msgsnd, int, msqid, stru
 {
 	long mtype;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(mtype, &msgp->mtype))
 		return -EFAULT;
 	return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
@@ -912,6 +927,11 @@ SYSCALL_DEFINE5(msgrcv, int, msqid, stru
 {
 	long err, mtype;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err =  do_msgrcv(msqid, &mtype, msgp->mtext, msgsz, msgtyp, msgflg);
 	if (err < 0)
 		goto out;
diff -ruNp linux-3.7.5/ipc/sem.c linux-3.7.5-cher1/ipc/sem.c
--- linux-3.7.5/ipc/sem.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/ipc/sem.c	2013-01-30 00:02:18.340807480 +0400
@@ -370,6 +370,11 @@ SYSCALL_DEFINE3(semget, key_t, key, int,
 	struct ipc_ops sem_ops;
 	struct ipc_params sem_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	if (nsems < 0 || nsems > ns->sc_semmsl)
@@ -1126,6 +1131,11 @@ SYSCALL_DEFINE(semctl)(int semid, int se
 	int version;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (semid < 0)
 		return -EINVAL;
 
@@ -1343,6 +1353,11 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
 	struct ipc_namespace *ns;
 	struct list_head tasks;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	if (nsops < 1 || semid < 0)
diff -ruNp linux-3.7.5/ipc/shm.c linux-3.7.5-cher1/ipc/shm.c
--- linux-3.7.5/ipc/shm.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/ipc/shm.c	2013-01-30 00:02:05.130776127 +0400
@@ -577,6 +577,11 @@ SYSCALL_DEFINE3(shmget, key_t, key, size
 	struct ipc_ops shm_ops;
 	struct ipc_params shm_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	shm_ops.getnew = newseg;
@@ -779,6 +784,11 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int,
 	int err, version;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (cmd < 0 || shmid < 0) {
 		err = -EINVAL;
 		goto out;
@@ -1110,6 +1120,11 @@ SYSCALL_DEFINE3(shmat, int, shmid, char
 	unsigned long ret;
 	long err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = do_shmat(shmid, shmaddr, shmflg, &ret, SHMLBA);
 	if (err)
 		return err;
@@ -1132,6 +1147,11 @@ SYSCALL_DEFINE1(shmdt, char __user *, sh
 	struct vm_area_struct *next;
 #endif
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (addr & ~PAGE_MASK)
 		return retval;
 
diff -ruNp linux-3.7.5/ipc/syscall.c linux-3.7.5-cher1/ipc/syscall.c
--- linux-3.7.5/ipc/syscall.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/ipc/syscall.c	2013-01-30 00:02:18.650808198 +0400
@@ -18,6 +18,11 @@ SYSCALL_DEFINE6(ipc, unsigned int, call,
 {
 	int version, ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	version = call >> 16; /* hack for backward compatibility */
 	call &= 0xffff;
 
diff -ruNp linux-3.7.5/kernel/acct.c linux-3.7.5-cher1/kernel/acct.c
--- linux-3.7.5/kernel/acct.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/acct.c	2013-01-30 00:02:18.973808972 +0400
@@ -256,6 +256,11 @@ SYSCALL_DEFINE1(acct, const char __user
 {
 	int error = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_PACCT))
 		return -EPERM;
 
diff -ruNp linux-3.7.5/kernel/capability.c linux-3.7.5-cher1/kernel/capability.c
--- linux-3.7.5/kernel/capability.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/capability.c	2013-01-30 00:02:19.280809697 +0400
@@ -238,6 +238,11 @@ SYSCALL_DEFINE2(capset, cap_user_header_
 	int ret;
 	pid_t pid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ret = cap_validate_magic(header, &tocopy);
 	if (ret != 0)
 		return ret;
diff -ruNp linux-3.7.5/kernel/compat.c linux-3.7.5-cher1/kernel/compat.c
--- linux-3.7.5/kernel/compat.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/compat.c	2013-01-30 00:02:04.847775440 +0400
@@ -133,6 +133,11 @@ asmlinkage long compat_sys_settimeofday(
 	struct timespec kts;
 	struct timezone ktz;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (tv) {
 		if (compat_get_timeval_convert(&kts, tv))
 			return -EFAULT;
@@ -429,6 +434,11 @@ asmlinkage long compat_sys_setrlimit(uns
 {
 	struct rlimit r;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!access_ok(VERIFY_READ, rlim, sizeof(*rlim)) ||
 	    __get_user(r.rlim_cur, &rlim->rlim_cur) ||
 	    __get_user(r.rlim_max, &rlim->rlim_max))
@@ -615,6 +625,11 @@ asmlinkage long compat_sys_sched_setaffi
 	cpumask_var_t new_mask;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!alloc_cpumask_var(&new_mask, GFP_KERNEL))
 		return -ENOMEM;
 
@@ -1045,6 +1060,11 @@ asmlinkage long compat_sys_stime(compat_
 	struct timespec tv;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(tv.tv_sec, tptr))
 		return -EFAULT;
 
@@ -1082,6 +1102,11 @@ asmlinkage long compat_sys_adjtimex(stru
 	struct timex txc;
 	int err, ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = compat_get_timex(&txc, utp);
 	if (err)
 		return err;
@@ -1105,6 +1130,11 @@ asmlinkage long compat_sys_move_pages(pi
 	const void __user * __user *pages;
 	int i;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	pages = compat_alloc_user_space(nr_pages * sizeof(void *));
 	for (i = 0; i < nr_pages; i++) {
 		compat_uptr_t p;
diff -ruNp linux-3.7.5/kernel/events/core.c linux-3.7.5-cher1/kernel/events/core.c
--- linux-3.7.5/kernel/events/core.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/events/core.c	2013-01-30 00:02:04.608774888 +0400
@@ -6446,6 +6446,11 @@ SYSCALL_DEFINE5(perf_event_open,
 	int move_group = 0;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* for future expandability... */
 	if (flags & ~PERF_FLAG_ALL)
 		return -EINVAL;
diff -ruNp linux-3.7.5/kernel/exec_domain.c linux-3.7.5-cher1/kernel/exec_domain.c
--- linux-3.7.5/kernel/exec_domain.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/exec_domain.c	2013-01-30 00:02:04.329774225 +0400
@@ -183,6 +183,9 @@ SYSCALL_DEFINE1(personality, unsigned in
 {
 	unsigned int old = current->personality;
 
+        if (SBOX_IS_RESTRICTED())
+                return old;
+
 	if (personality != 0xffffffff)
 		set_personality(personality);
 
diff -ruNp linux-3.7.5/kernel/exit.c linux-3.7.5-cher1/kernel/exit.c
--- linux-3.7.5/kernel/exit.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/exit.c	2013-01-30 00:02:04.103773686 +0400
@@ -1130,6 +1130,7 @@ static int wait_task_zombie(struct wait_
 	pid_t pid = task_pid_vnr(p);
 	uid_t uid = from_kuid_munged(current_user_ns(), task_uid(p));
 	struct siginfo __user *infop;
+        int status2;
 
 	if (!likely(wo->wo_flags & WEXITED))
 		return 0;
@@ -1147,6 +1148,12 @@ static int wait_task_zombie(struct wait_
 			why = (exit_code & 0x80) ? CLD_DUMPED : CLD_KILLED;
 			status = exit_code & 0x7f;
 		}
+                if (SBOX_IS_MEMLIMIT_ERR(p))
+                        status |= 0x10000;
+                if (SBOX_IS_SECURITY_ERR(p))
+                        status |= 0x20000;
+                if (SBOX_IS_TL_ERR(p))
+                        status |= 0x40000;
 		return wait_noreap_copyout(wo, p, pid, uid, why, status);
 	}
 
@@ -1229,8 +1236,16 @@ static int wait_task_zombie(struct wait_
 		? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
 	status = (p->signal->flags & SIGNAL_GROUP_EXIT)
 		? p->signal->group_exit_code : p->exit_code;
-	if (!retval && wo->wo_stat)
-		retval = put_user(status, wo->wo_stat);
+	if (!retval && wo->wo_stat) {
+                status2 = status;
+                if (SBOX_IS_MEMLIMIT_ERR(p))
+                        status2 |= 0x10000;
+                if (SBOX_IS_SECURITY_ERR(p))
+                        status2 |= 0x20000;
+                if (SBOX_IS_TL_ERR(p))
+                        status2 |= 0x40000;
+		retval = put_user(status2, wo->wo_stat);
+        }
 
 	infop = wo->wo_info;
 	if (!retval && infop)
@@ -1364,8 +1379,16 @@ unlock_sig:
 
 	retval = wo->wo_rusage
 		? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
-	if (!retval && wo->wo_stat)
-		retval = put_user((exit_code << 8) | 0x7f, wo->wo_stat);
+	if (!retval && wo->wo_stat) {
+                int status = (exit_code << 8) | 0x7f;
+                if (SBOX_IS_MEMLIMIT_ERR(p))
+                        status |= 0x10000;
+                if (SBOX_IS_SECURITY_ERR(p))
+                        status |= 0x20000;
+                if (SBOX_IS_TL_ERR(p))
+                        status |= 0x40000;
+		retval = put_user(status, wo->wo_stat);
+        }
 
 	infop = wo->wo_info;
 	if (!retval && infop)
diff -ruNp linux-3.7.5/kernel/fork.c linux-3.7.5-cher1/kernel/fork.c
--- linux-3.7.5/kernel/fork.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/fork.c	2013-01-30 00:02:19.614810482 +0400
@@ -1556,6 +1556,11 @@ long do_fork(unsigned long clone_flags,
 	int trace = 0;
 	long nr;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/*
 	 * Do some preliminary argument and permissions checking before we
 	 * actually start allocating stuff
@@ -1758,6 +1763,11 @@ SYSCALL_DEFINE1(unshare, unsigned long,
 	int do_sysvsem = 0;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = check_unshare_flags(unshare_flags);
 	if (err)
 		goto bad_unshare_out;
diff -ruNp linux-3.7.5/kernel/groups.c linux-3.7.5-cher1/kernel/groups.c
--- linux-3.7.5/kernel/groups.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/groups.c	2013-01-30 00:02:19.900811169 +0400
@@ -233,6 +233,11 @@ SYSCALL_DEFINE2(setgroups, int, gidsetsi
 	struct group_info *group_info;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!nsown_capable(CAP_SETGID))
 		return -EPERM;
 	if ((unsigned)gidsetsize > NGROUPS_MAX)
diff -ruNp linux-3.7.5/kernel/kcmp.c linux-3.7.5-cher1/kernel/kcmp.c
--- linux-3.7.5/kernel/kcmp.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/kcmp.c	2013-01-30 10:13:54.686691699 +0400
@@ -98,6 +98,11 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t
 	struct task_struct *task1, *task2;
 	int ret;
 
+        if ((current->sbox_flags & SBOX_NO_EXEC)) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	rcu_read_lock();
 
 	/*
diff -ruNp linux-3.7.5/kernel/kexec.c linux-3.7.5-cher1/kernel/kexec.c
--- linux-3.7.5/kernel/kexec.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/kexec.c	2013-01-30 00:02:20.197811877 +0400
@@ -942,6 +942,11 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
 	struct kimage **dest_image, *image;
 	int result;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* We only trust the superuser with rebooting the system. */
 	if (!capable(CAP_SYS_BOOT))
 		return -EPERM;
diff -ruNp linux-3.7.5/kernel/module.c linux-3.7.5-cher1/kernel/module.c
--- linux-3.7.5/kernel/module.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/module.c	2013-01-30 00:02:20.498812585 +0400
@@ -826,6 +826,11 @@ SYSCALL_DEFINE2(delete_module, const cha
 	char name[MODULE_NAME_LEN];
 	int ret, forced = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_MODULE) || modules_disabled)
 		return -EPERM;
 
@@ -3142,6 +3147,11 @@ SYSCALL_DEFINE3(init_module, void __user
 	struct module *mod;
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Must have permission */
 	if (!capable(CAP_SYS_MODULE) || modules_disabled)
 		return -EPERM;
diff -ruNp linux-3.7.5/kernel/nsproxy.c linux-3.7.5-cher1/kernel/nsproxy.c
--- linux-3.7.5/kernel/nsproxy.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/nsproxy.c	2013-01-30 00:02:20.802813313 +0400
@@ -241,6 +241,11 @@ SYSCALL_DEFINE2(setns, int, fd, int, nst
 	struct file *file;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
diff -ruNp linux-3.7.5/kernel/posix-cpu-timers.c linux-3.7.5-cher1/kernel/posix-cpu-timers.c
--- linux-3.7.5/kernel/posix-cpu-timers.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/posix-cpu-timers.c	2013-01-30 00:02:21.105814022 +0400
@@ -956,6 +956,8 @@ static void check_thread_timers(struct t
 			 * At the hard limit, we just die.
 			 * No need to calculate anything else now.
 			 */
+                        if ((tsk->sbox_flags & SBOX_TLON))
+                                tsk->sbox_flags |= SBOX_WAS_TL;
 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
 			return;
 		}
@@ -1116,6 +1118,8 @@ static void check_process_timers(struct
 			 * At the hard limit, we just die.
 			 * No need to calculate anything else now.
 			 */
+                        if ((tsk->sbox_flags & SBOX_TLON))
+                                tsk->sbox_flags |= SBOX_WAS_TL;
 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
 			return;
 		}
diff -ruNp linux-3.7.5/kernel/printk.c linux-3.7.5-cher1/kernel/printk.c
--- linux-3.7.5/kernel/printk.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/printk.c	2013-01-30 00:02:21.451814845 +0400
@@ -1230,6 +1230,9 @@ out:
 
 SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_syslog(type, buf, len, SYSLOG_FROM_CALL);
 }
 
diff -ruNp linux-3.7.5/kernel/ptrace.c linux-3.7.5-cher1/kernel/ptrace.c
--- linux-3.7.5/kernel/ptrace.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/ptrace.c	2013-01-30 00:02:21.732815503 +0400
@@ -900,6 +900,24 @@ SYSCALL_DEFINE4(ptrace, long, request, l
 	struct task_struct *child;
 	long ret;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
+	if (request == PTRACE_MEMLIMIT) {
+		current->sbox_flags |= SBOX_MEMLIMITON;
+		return 0;
+	}
+	if (request == PTRACE_NO_SYSCALLS) {
+		current->sbox_flags |= SBOX_NO_SYSCALLS;
+		return 0;
+	}
+	if (request == PTRACE_TIMELIMIT) {
+		current->sbox_flags |= SBOX_TLON;
+		return 0;
+	}
+
 	if (request == PTRACE_TRACEME) {
 		ret = ptrace_traceme();
 		if (!ret)
@@ -1047,6 +1065,24 @@ asmlinkage long compat_sys_ptrace(compat
 	struct task_struct *child;
 	long ret;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
+	if (request == PTRACE_MEMLIMIT) {
+		current->sbox_flags |= SBOX_MEMLIMITON;
+		return 0;
+	}
+	if (request == PTRACE_NO_SYSCALLS) {
+		current->sbox_flags |= SBOX_NO_SYSCALLS;
+		return 0;
+	}
+	if (request == PTRACE_TIMELIMIT) {
+		current->sbox_flags |= SBOX_TLON;
+		return 0;
+	}
+
 	if (request == PTRACE_TRACEME) {
 		ret = ptrace_traceme();
 		goto out;
diff -ruNp linux-3.7.5/kernel/sched/core.c linux-3.7.5-cher1/kernel/sched/core.c
--- linux-3.7.5/kernel/sched/core.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/sched/core.c	2013-01-30 00:02:22.040816266 +0400
@@ -3580,6 +3580,9 @@ SYSCALL_DEFINE1(nice, int, increment)
 {
 	long nice, retval;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/*
 	 * Setpriority might change our priority at the same moment.
 	 * We don't have to worry. Conceptually one call occurs first
@@ -3920,6 +3923,11 @@ do_sched_setscheduler(pid_t pid, int pol
 SYSCALL_DEFINE3(sched_setscheduler, pid_t, pid, int, policy,
 		struct sched_param __user *, param)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* negative values for policy are not valid */
 	if (policy < 0)
 		return -EINVAL;
@@ -3934,6 +3942,11 @@ SYSCALL_DEFINE3(sched_setscheduler, pid_
  */
 SYSCALL_DEFINE2(sched_setparam, pid_t, pid, struct sched_param __user *, param)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_sched_setscheduler(pid, -1, param);
 }
 
@@ -4087,6 +4100,11 @@ SYSCALL_DEFINE3(sched_setaffinity, pid_t
 	cpumask_var_t new_mask;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!alloc_cpumask_var(&new_mask, GFP_KERNEL))
 		return -ENOMEM;
 
diff -ruNp linux-3.7.5/kernel/signal.c linux-3.7.5-cher1/kernel/signal.c
--- linux-3.7.5/kernel/signal.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/signal.c	2013-01-30 00:02:03.624772553 +0400
@@ -1430,6 +1430,14 @@ static int kill_something_info(int sig,
 {
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                if (!pid) pid = current->pid;
+                if (pid != current->pid) {
+                        SBOX_SET_SECURITY_ERR();
+                        return -EPERM;
+                }
+        }
+
 	if (pid > 0) {
 		rcu_read_lock();
 		ret = kill_pid_info(sig, info, find_vpid(pid));
@@ -2915,6 +2923,11 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
 	if (pid <= 0 || tgid <= 0)
 		return -EINVAL;
 
+        if (SBOX_IS_RESTRICTED() && current->pid != tgid) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_tkill(tgid, pid, sig);
 }
 
@@ -2931,6 +2944,11 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int,
 	if (pid <= 0)
 		return -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_tkill(0, pid, sig);
 }
 
diff -ruNp linux-3.7.5/kernel/sys.c linux-3.7.5-cher1/kernel/sys.c
--- linux-3.7.5/kernel/sys.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/sys.c	2013-01-30 00:02:03.596772487 +0400
@@ -178,6 +178,11 @@ SYSCALL_DEFINE3(setpriority, int, which,
 	struct pid *pgrp;
 	kuid_t uid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (which > PRIO_USER || which < PRIO_PROCESS)
 		goto out;
 
@@ -436,6 +441,11 @@ SYSCALL_DEFINE4(reboot, int, magic1, int
 	char buffer[256];
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* We only trust the superuser with rebooting the system. */
 	if (!capable(CAP_SYS_BOOT))
 		return -EPERM;
@@ -563,6 +573,11 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
 	int retval;
 	kgid_t krgid, kegid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	krgid = make_kgid(ns, rgid);
 	kegid = make_kgid(ns, egid);
 
@@ -620,6 +635,11 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
 	int retval;
 	kgid_t kgid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	kgid = make_kgid(ns, gid);
 	if (!gid_valid(kgid))
 		return -EINVAL;
@@ -696,6 +716,11 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
 	int retval;
 	kuid_t kruid, keuid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	kruid = make_kuid(ns, ruid);
 	keuid = make_kuid(ns, euid);
 
@@ -767,6 +792,11 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
 	int retval;
 	kuid_t kuid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	kuid = make_kuid(ns, uid);
 	if (!uid_valid(kuid))
 		return -EINVAL;
@@ -814,6 +844,11 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
 	int retval;
 	kuid_t kruid, keuid, ksuid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	kruid = make_kuid(ns, ruid);
 	keuid = make_kuid(ns, euid);
 	ksuid = make_kuid(ns, suid);
@@ -899,6 +934,11 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
 	int retval;
 	kgid_t krgid, kegid, ksgid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	krgid = make_kgid(ns, rgid);
 	kegid = make_kgid(ns, egid);
 	ksgid = make_kgid(ns, sgid);
@@ -974,6 +1014,11 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
 	uid_t old_fsuid;
 	kuid_t kuid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	old = current_cred();
 	old_fsuid = from_kuid_munged(old->user_ns, old->fsuid);
 
@@ -1013,6 +1058,11 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
 	gid_t old_fsgid;
 	kgid_t kgid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	old = current_cred();
 	old_fsgid = from_kgid_munged(old->user_ns, old->fsgid);
 
@@ -1088,6 +1138,11 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid
 	struct pid *pgrp;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!pid)
 		pid = task_pid_vnr(group_leader);
 	if (!pgid)
@@ -1229,6 +1284,11 @@ SYSCALL_DEFINE0(setsid)
 	if (group_leader->signal->leader)
 		goto out;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                goto out;
+        }
+
 	/* Fail if a process group id already exists that equals the
 	 * proposed session id.
 	 */
@@ -1370,6 +1430,11 @@ SYSCALL_DEFINE2(sethostname, char __user
 	int errno;
 	char tmp[__NEW_UTS_LEN];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!ns_capable(current->nsproxy->uts_ns->user_ns, CAP_SYS_ADMIN))
 		return -EPERM;
 
@@ -1421,6 +1486,11 @@ SYSCALL_DEFINE2(setdomainname, char __us
 	int errno;
 	char tmp[__NEW_UTS_LEN];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!ns_capable(current->nsproxy->uts_ns->user_ns, CAP_SYS_ADMIN))
 		return -EPERM;
 	if (len < 0 || len > __NEW_UTS_LEN)
@@ -1608,6 +1678,11 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, u
 	struct task_struct *tsk;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (new_rlim) {
 		if (copy_from_user(&new64, new_rlim, sizeof(new64)))
 			return -EFAULT;
@@ -1645,6 +1720,11 @@ SYSCALL_DEFINE2(setrlimit, unsigned int,
 {
 	struct rlimit new_rlim;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_from_user(&new_rlim, rlim, sizeof(*rlim)))
 		return -EFAULT;
 	return do_prlimit(current, resource, &new_rlim, NULL);
@@ -1784,6 +1864,9 @@ SYSCALL_DEFINE2(getrusage, int, who, str
 
 SYSCALL_DEFINE1(umask, int, mask)
 {
+        if (SBOX_IS_RESTRICTED())
+                return current->fs->umask;
+
 	mask = xchg(&current->fs->umask, mask & S_IRWXUGO);
 	return mask;
 }
@@ -2006,6 +2089,11 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
 	unsigned char comm[sizeof(me->comm)];
 	long error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = security_task_prctl(option, arg2, arg3, arg4, arg5);
 	if (error != -ENOSYS)
 		return error;
diff -ruNp linux-3.7.5/kernel/sysctl_binary.c linux-3.7.5-cher1/kernel/sysctl_binary.c
--- linux-3.7.5/kernel/sysctl_binary.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/sysctl_binary.c	2013-01-30 00:02:22.329816939 +0400
@@ -1447,6 +1447,11 @@ SYSCALL_DEFINE1(sysctl, struct __sysctl_
 	size_t oldlen = 0;
 	ssize_t result;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_from_user(&tmp, args, sizeof(tmp)))
 		return -EFAULT;
 
@@ -1491,6 +1496,11 @@ asmlinkage long compat_sys_sysctl(struct
 	size_t oldlen = 0;
 	ssize_t result;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_from_user(&tmp, args, sizeof(tmp)))
 		return -EFAULT;
 
diff -ruNp linux-3.7.5/kernel/time.c linux-3.7.5-cher1/kernel/time.c
--- linux-3.7.5/kernel/time.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/time.c	2013-01-30 00:02:22.653817700 +0400
@@ -83,6 +83,11 @@ SYSCALL_DEFINE1(stime, time_t __user *,
 	struct timespec tv;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(tv.tv_sec, tptr))
 		return -EFAULT;
 
@@ -183,6 +188,11 @@ SYSCALL_DEFINE2(settimeofday, struct tim
 	struct timespec	new_ts;
 	struct timezone new_tz;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (tv) {
 		if (copy_from_user(&user_tv, tv, sizeof(*tv)))
 			return -EFAULT;
@@ -202,6 +212,11 @@ SYSCALL_DEFINE1(adjtimex, struct timex _
 	struct timex txc;		/* Local copy of parameter */
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Copy the user data space into the kernel copy
 	 * structure. But bear in mind that the structures
 	 * may change
diff -ruNp linux-3.7.5/kernel/uid16.c linux-3.7.5-cher1/kernel/uid16.c
--- linux-3.7.5/kernel/uid16.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/kernel/uid16.c	2013-01-30 00:02:02.907770846 +0400
@@ -209,6 +209,11 @@ SYSCALL_DEFINE2(setgroups16, int, gidset
 	struct group_info *group_info;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_IS_RESTRICTED();
+                return -EPERM;
+        }
+
 	if (!nsown_capable(CAP_SETGID))
 		return -EPERM;
 	if ((unsigned)gidsetsize > NGROUPS_MAX)
diff -ruNp linux-3.7.5/Makefile linux-3.7.5-cher1/Makefile
--- linux-3.7.5/Makefile	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/Makefile	2013-01-30 00:02:02.657770260 +0400
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 7
 SUBLEVEL = 5
-EXTRAVERSION =
+EXTRAVERSION = -cher1
 NAME = Terrified Chipmunk
 
 # *DOCUMENTATION*
diff -ruNp linux-3.7.5/mm/fadvise.c linux-3.7.5-cher1/mm/fadvise.c
--- linux-3.7.5/mm/fadvise.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/fadvise.c	2013-01-30 00:02:02.418769678 +0400
@@ -35,6 +35,9 @@ SYSCALL_DEFINE(fadvise64_64)(int fd, lof
 	unsigned long nrpages;
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!f.file)
 		return -EBADF;
 
diff -ruNp linux-3.7.5/mm/fremap.c linux-3.7.5-cher1/mm/fremap.c
--- linux-3.7.5/mm/fremap.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/fremap.c	2013-01-30 00:02:22.957818403 +0400
@@ -130,6 +130,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
 	int err = -EINVAL;
 	int has_write_lock = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (prot)
 		return err;
 	/*
diff -ruNp linux-3.7.5/mm/madvise.c linux-3.7.5-cher1/mm/madvise.c
--- linux-3.7.5/mm/madvise.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/madvise.c	2013-01-30 00:02:23.274819170 +0400
@@ -372,6 +372,9 @@ SYSCALL_DEFINE3(madvise, unsigned long,
 	int write;
 	size_t len;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 #ifdef CONFIG_MEMORY_FAILURE
 	if (behavior == MADV_HWPOISON || behavior == MADV_SOFT_OFFLINE)
 		return madvise_hwpoison(behavior, start, start+len_in);
diff -ruNp linux-3.7.5/mm/mempolicy.c linux-3.7.5-cher1/mm/mempolicy.c
--- linux-3.7.5/mm/mempolicy.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/mempolicy.c	2013-01-30 00:02:23.587819910 +0400
@@ -1293,6 +1293,11 @@ SYSCALL_DEFINE6(mbind, unsigned long, st
 	int err;
 	unsigned short mode_flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	mode_flags = mode & MPOL_MODE_FLAGS;
 	mode &= ~MPOL_MODE_FLAGS;
 	if (mode >= MPOL_MAX)
@@ -1314,6 +1319,11 @@ SYSCALL_DEFINE3(set_mempolicy, int, mode
 	nodemask_t nodes;
 	unsigned short flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	flags = mode & MPOL_MODE_FLAGS;
 	mode &= ~MPOL_MODE_FLAGS;
 	if ((unsigned int)mode >= MPOL_MAX)
@@ -1339,6 +1349,11 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
 	nodemask_t *new;
 	NODEMASK_SCRATCH(scratch);
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!scratch)
 		return -ENOMEM;
 
@@ -1430,6 +1445,11 @@ SYSCALL_DEFINE5(get_mempolicy, int __use
 	int uninitialized_var(pval);
 	nodemask_t nodes;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (nmask != NULL && maxnode < MAX_NUMNODES)
 		return -EINVAL;
 
@@ -1459,6 +1479,11 @@ asmlinkage long compat_sys_get_mempolicy
 	unsigned long nr_bits, alloc_size;
 	DECLARE_BITMAP(bm, MAX_NUMNODES);
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
diff -ruNp linux-3.7.5/mm/migrate.c linux-3.7.5-cher1/mm/migrate.c
--- linux-3.7.5/mm/migrate.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/migrate.c	2013-01-30 00:02:23.936820745 +0400
@@ -1326,6 +1326,11 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
 	int err;
 	nodemask_t task_nodes;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Check flags */
 	if (flags & ~(MPOL_MF_MOVE|MPOL_MF_MOVE_ALL))
 		return -EINVAL;
diff -ruNp linux-3.7.5/mm/mincore.c linux-3.7.5-cher1/mm/mincore.c
--- linux-3.7.5/mm/mincore.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/mincore.c	2013-01-30 00:02:24.244821476 +0400
@@ -270,6 +270,11 @@ SYSCALL_DEFINE3(mincore, unsigned long,
 	unsigned long pages;
 	unsigned char *tmp;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Check the start address: needs to be page-aligned.. */
  	if (start & ~PAGE_CACHE_MASK)
 		return -EINVAL;
diff -ruNp linux-3.7.5/mm/mlock.c linux-3.7.5-cher1/mm/mlock.c
--- linux-3.7.5/mm/mlock.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/mlock.c	2013-01-30 00:02:24.601822323 +0400
@@ -478,6 +478,11 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
 	unsigned long lock_limit;
 	int error = -ENOMEM;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!can_do_mlock())
 		return -EPERM;
 
@@ -506,6 +511,11 @@ SYSCALL_DEFINE2(munlock, unsigned long,
 {
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	down_write(&current->mm->mmap_sem);
 	len = PAGE_ALIGN(len + (start & ~PAGE_MASK));
 	start &= PAGE_MASK;
@@ -544,6 +554,11 @@ SYSCALL_DEFINE1(mlockall, int, flags)
 	unsigned long lock_limit;
 	int ret = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!flags || (flags & ~(MCL_CURRENT | MCL_FUTURE)))
 		goto out;
 
@@ -576,6 +591,11 @@ SYSCALL_DEFINE0(munlockall)
 {
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	down_write(&current->mm->mmap_sem);
 	ret = do_mlockall(0);
 	up_write(&current->mm->mmap_sem);
diff -ruNp linux-3.7.5/mm/mmap.c linux-3.7.5-cher1/mm/mmap.c
--- linux-3.7.5/mm/mmap.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/mmap.c	2013-01-30 00:02:24.944823138 +0400
@@ -1262,8 +1262,12 @@ munmap_back:
 	}
 
 	/* Check against address space limit. */
-	if (!may_expand_vm(mm, len >> PAGE_SHIFT))
+	if (!may_expand_vm(mm, len >> PAGE_SHIFT)) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+		}
 		return -ENOMEM;
+	}
 
 	/*
 	 * Set 'VM_NORESERVE' if we should not account for the
@@ -1697,12 +1701,20 @@ static int acct_stack_growth(struct vm_a
 	unsigned long new_start;
 
 	/* address space limit tests */
-	if (!may_expand_vm(mm, grow))
+	if (!may_expand_vm(mm, grow)) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+		}
 		return -ENOMEM;
+	}
 
 	/* Stack limit test */
-	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur)) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+		}
 		return -ENOMEM;
+	}
 
 	/* mlock limit tests */
 	if (vma->vm_flags & VM_LOCKED) {
@@ -2229,8 +2241,12 @@ static unsigned long do_brk(unsigned lon
 	}
 
 	/* Check against address space limits *after* clearing old maps... */
-	if (!may_expand_vm(mm, len >> PAGE_SHIFT))
+	if (!may_expand_vm(mm, len >> PAGE_SHIFT)) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+		}
 		return -ENOMEM;
+	}
 
 	if (mm->map_count > sysctl_max_map_count)
 		return -ENOMEM;
diff -ruNp linux-3.7.5/mm/mprotect.c linux-3.7.5-cher1/mm/mprotect.c
--- linux-3.7.5/mm/mprotect.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/mprotect.c	2013-01-30 00:02:25.264823893 +0400
@@ -240,6 +240,13 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
 	if (grows == (PROT_GROWSDOWN|PROT_GROWSUP)) /* can't be both */
 		return -EINVAL;
 
+        /* --- enabled for php
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+        */
+
 	if (start & ~PAGE_MASK)
 		return -EINVAL;
 	if (!len)
diff -ruNp linux-3.7.5/mm/mremap.c linux-3.7.5-cher1/mm/mremap.c
--- linux-3.7.5/mm/mremap.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/mremap.c	2013-01-30 00:02:25.556824586 +0400
@@ -344,8 +344,12 @@ static struct vm_area_struct *vma_to_res
 			goto Eagain;
 	}
 
-	if (!may_expand_vm(mm, (new_len - old_len) >> PAGE_SHIFT))
+	if (!may_expand_vm(mm, (new_len - old_len) >> PAGE_SHIFT)) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+		}
 		goto Enomem;
+	}
 
 	if (vma->vm_flags & VM_ACCOUNT) {
 		unsigned long charged = (new_len - old_len) >> PAGE_SHIFT;
diff -ruNp linux-3.7.5/mm/msync.c linux-3.7.5-cher1/mm/msync.c
--- linux-3.7.5/mm/msync.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/msync.c	2013-01-30 00:02:25.874825341 +0400
@@ -36,6 +36,9 @@ SYSCALL_DEFINE3(msync, unsigned long, st
 	int unmapped_error = 0;
 	int error = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (flags & ~(MS_ASYNC | MS_INVALIDATE | MS_SYNC))
 		goto out;
 	if (start & ~PAGE_MASK)
diff -ruNp linux-3.7.5/mm/process_vm_access.c linux-3.7.5-cher1/mm/process_vm_access.c
--- linux-3.7.5/mm/process_vm_access.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/process_vm_access.c	2013-01-30 00:02:26.178826062 +0400
@@ -399,6 +399,11 @@ SYSCALL_DEFINE6(process_vm_readv, pid_t,
 		unsigned long, liovcnt, const struct iovec __user *, rvec,
 		unsigned long, riovcnt,	unsigned long, flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 0);
 }
 
@@ -407,6 +412,11 @@ SYSCALL_DEFINE6(process_vm_writev, pid_t
 		unsigned long, liovcnt, const struct iovec __user *, rvec,
 		unsigned long, riovcnt,	unsigned long, flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 1);
 }
 
@@ -472,6 +482,11 @@ compat_sys_process_vm_readv(compat_pid_t
 			    unsigned long riovcnt,
 			    unsigned long flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
 				    riovcnt, flags, 0);
 }
@@ -484,6 +499,11 @@ compat_sys_process_vm_writev(compat_pid_
 			     unsigned long riovcnt,
 			     unsigned long flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
 				    riovcnt, flags, 1);
 }
diff -ruNp linux-3.7.5/mm/readahead.c linux-3.7.5-cher1/mm/readahead.c
--- linux-3.7.5/mm/readahead.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/readahead.c	2013-01-30 00:02:01.962768617 +0400
@@ -581,6 +581,9 @@ SYSCALL_DEFINE(readahead)(int fd, loff_t
 	ssize_t ret;
 	struct fd f;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = -EBADF;
 	f = fdget(fd);
 	if (f.file) {
diff -ruNp linux-3.7.5/mm/swapfile.c linux-3.7.5-cher1/mm/swapfile.c
--- linux-3.7.5/mm/swapfile.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/mm/swapfile.c	2013-01-30 00:02:01.652767860 +0400
@@ -1488,6 +1488,11 @@ SYSCALL_DEFINE1(swapoff, const char __us
 	int i, type, prev;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
@@ -1950,6 +1955,11 @@ SYSCALL_DEFINE2(swapon, const char __use
 	struct page *page = NULL;
 	struct inode *inode = NULL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (swap_flags & ~SWAP_FLAGS_VALID)
 		return -EINVAL;
 
diff -ruNp linux-3.7.5/net/compat.c linux-3.7.5-cher1/net/compat.c
--- linux-3.7.5/net/compat.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/net/compat.c	2013-01-30 00:02:01.242766935 +0400
@@ -768,6 +768,11 @@ asmlinkage long compat_sys_recvmmsg(int
 	int datagrams;
 	struct timespec ktspec;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (COMPAT_USE_64BIT_TIME)
 		return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
 				      flags | MSG_CMSG_COMPAT,
@@ -794,6 +799,11 @@ asmlinkage long compat_sys_socketcall(in
 	u32 a[6];
 	u32 a0, a1;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (call < SYS_SOCKET || call > SYS_SENDMMSG)
 		return -EINVAL;
 	if (copy_from_user(a, args, nas[call]))
diff -ruNp linux-3.7.5/net/socket.c linux-3.7.5-cher1/net/socket.c
--- linux-3.7.5/net/socket.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/net/socket.c	2013-01-30 00:02:26.499826826 +0400
@@ -1393,6 +1393,11 @@ SYSCALL_DEFINE3(socket, int, family, int
 	struct socket *sock;
 	int flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Check the SOCK_* constants for consistency.  */
 	BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
@@ -1436,6 +1441,11 @@ SYSCALL_DEFINE4(socketpair, int, family,
 	struct file *newfile1, *newfile2;
 	int flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	flags = type & ~SOCK_TYPE_MASK;
 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
 		return -EINVAL;
@@ -1530,6 +1540,11 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
 	struct sockaddr_storage address;
 	int err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock) {
 		err = move_addr_to_kernel(umyaddr, addrlen, &address);
@@ -1559,6 +1574,11 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
 	int err, fput_needed;
 	int somaxconn;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock) {
 		somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
@@ -1594,6 +1614,11 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
 	int err, len, newfd, fput_needed;
 	struct sockaddr_storage address;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
 		return -EINVAL;
 
@@ -1692,6 +1717,11 @@ SYSCALL_DEFINE3(connect, int, fd, struct
 	struct sockaddr_storage address;
 	int err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1724,6 +1754,11 @@ SYSCALL_DEFINE3(getsockname, int, fd, st
 	struct sockaddr_storage address;
 	int len, err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1755,6 +1790,11 @@ SYSCALL_DEFINE3(getpeername, int, fd, st
 	struct sockaddr_storage address;
 	int len, err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_getpeername(sock);
@@ -1791,6 +1831,11 @@ SYSCALL_DEFINE6(sendto, int, fd, void __
 	struct iovec iov;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (len > INT_MAX)
 		len = INT_MAX;
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
@@ -1850,6 +1895,11 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void
 	int err, err2;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (size > INT_MAX)
 		size = INT_MAX;
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
@@ -1901,6 +1951,11 @@ SYSCALL_DEFINE5(setsockopt, int, fd, int
 	int err, fput_needed;
 	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (optlen < 0)
 		return -EINVAL;
 
@@ -1935,6 +1990,11 @@ SYSCALL_DEFINE5(getsockopt, int, fd, int
 	int err, fput_needed;
 	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_getsockopt(sock, level, optname);
@@ -1964,6 +2024,11 @@ SYSCALL_DEFINE2(shutdown, int, fd, int,
 	int err, fput_needed;
 	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_shutdown(sock, how);
@@ -2107,6 +2172,11 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct
 	struct msghdr msg_sys;
 	struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!sock)
 		goto out;
 
@@ -2179,6 +2249,11 @@ int __sys_sendmmsg(int fd, struct mmsghd
 SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
 		unsigned int, vlen, unsigned int, flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return __sys_sendmmsg(fd, mmsg, vlen, flags);
 }
 
@@ -2281,6 +2356,11 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct
 	struct msghdr msg_sys;
 	struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!sock)
 		goto out;
 
@@ -2405,6 +2485,11 @@ SYSCALL_DEFINE5(recvmmsg, int, fd, struc
 	int datagrams;
 	struct timespec timeout_sys;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!timeout)
 		return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
 
@@ -2447,6 +2532,11 @@ SYSCALL_DEFINE2(socketcall, int, call, u
 	int err;
 	unsigned int len;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (call < 1 || call > SYS_SENDMMSG)
 		return -EINVAL;
 
diff -ruNp linux-3.7.5/security/keys/keyctl.c linux-3.7.5-cher1/security/keys/keyctl.c
--- linux-3.7.5/security/keys/keyctl.c	2013-01-28 08:50:55.000000000 +0400
+++ linux-3.7.5-cher1/security/keys/keyctl.c	2013-01-30 00:01:58.245759768 +0400
@@ -66,6 +66,11 @@ SYSCALL_DEFINE5(add_key, const char __us
 	long ret;
 	bool vm;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ret = -EINVAL;
 	if (plen > 1024 * 1024 - 1)
 		goto error;
@@ -166,6 +171,11 @@ SYSCALL_DEFINE4(request_key, const char
 	char type[32], *description, *callout_info;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* pull the type into kernel space */
 	ret = key_get_type_from_user(type, _type, sizeof(type));
 	if (ret < 0)
@@ -1568,6 +1578,11 @@ error_keyring:
 SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
 		unsigned long, arg4, unsigned long, arg5)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	switch (option) {
 	case KEYCTL_GET_KEYRING_ID:
 		return keyctl_get_keyring_ID((key_serial_t) arg2,
