diff -ruNp linux-2.6.34.5/arch/x86/ia32/ia32_aout.c linux-2.6.34.5-cher1/arch/x86/ia32/ia32_aout.c
--- linux-2.6.34.5/arch/x86/ia32/ia32_aout.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/arch/x86/ia32/ia32_aout.c	2010-08-26 14:45:12.198043213 +0400
@@ -299,8 +299,12 @@ static int load_aout_binary(struct linux
 	rlim = rlimit(RLIMIT_DATA);
 	if (rlim >= RLIM_INFINITY)
 		rlim = ~0;
-	if (ex.a_data + ex.a_bss > rlim)
+	if (ex.a_data + ex.a_bss > rlim) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+		}
 		return -ENOMEM;
+	}
 
 	/* Flush all traces of the currently running executable */
 	retval = flush_old_exec(bprm);
diff -ruNp linux-2.6.34.5/arch/x86/ia32/ia32_signal.c linux-2.6.34.5-cher1/arch/x86/ia32/ia32_signal.c
--- linux-2.6.34.5/arch/x86/ia32/ia32_signal.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/arch/x86/ia32/ia32_signal.c	2010-08-26 14:45:12.198562841 +0400
@@ -127,6 +127,9 @@ int copy_siginfo_from_user32(siginfo_t *
 
 asmlinkage long sys32_sigsuspend(int history0, int history1, old_sigset_t mask)
 {
+	if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	mask &= _BLOCKABLE;
 	spin_lock_irq(&current->sighand->siglock);
 	current->saved_sigmask = current->blocked;
@@ -148,6 +151,9 @@ asmlinkage long sys32_sigaltstack(const 
 	int ret, err = 0;
 	mm_segment_t seg;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	if (uss_ptr) {
 		u32 ptr;
 
diff -ruNp linux-2.6.34.5/arch/x86/ia32/ipc32.c linux-2.6.34.5-cher1/arch/x86/ia32/ipc32.c
--- linux-2.6.34.5/arch/x86/ia32/ipc32.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/arch/x86/ia32/ipc32.c	2010-08-26 14:45:12.205562524 +0400
@@ -15,6 +15,11 @@ asmlinkage long sys32_ipc(u32 call, int 
 {
 	int version;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	version = call >> 16; /* hack for backward compatibility */
 	call &= 0xffff;
 
diff -ruNp linux-2.6.34.5/arch/x86/ia32/sys_ia32.c linux-2.6.34.5-cher1/arch/x86/ia32/sys_ia32.c
--- linux-2.6.34.5/arch/x86/ia32/sys_ia32.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/arch/x86/ia32/sys_ia32.c	2010-08-26 14:45:12.205562524 +0400
@@ -100,7 +100,12 @@ asmlinkage long sys32_stat64(char __user
 			     struct stat64 __user *statbuf)
 {
 	struct kstat stat;
-	int ret = vfs_stat(filename, &stat);
+        int ret;
+
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
+        ret = vfs_stat(filename, &stat);
 
 	if (!ret)
 		ret = cp_stat64(statbuf, &stat);
@@ -111,7 +116,13 @@ asmlinkage long sys32_lstat64(char __use
 			      struct stat64 __user *statbuf)
 {
 	struct kstat stat;
-	int ret = vfs_lstat(filename, &stat);
+	int ret;
+
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
+        ret = vfs_lstat(filename, &stat);
+
 	if (!ret)
 		ret = cp_stat64(statbuf, &stat);
 	return ret;
@@ -120,7 +131,13 @@ asmlinkage long sys32_lstat64(char __use
 asmlinkage long sys32_fstat64(unsigned int fd, struct stat64 __user *statbuf)
 {
 	struct kstat stat;
-	int ret = vfs_fstat(fd, &stat);
+	int ret;
+
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
+        ret = vfs_fstat(fd, &stat);
+
 	if (!ret)
 		ret = cp_stat64(statbuf, &stat);
 	return ret;
@@ -132,6 +149,9 @@ asmlinkage long sys32_fstatat(unsigned i
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	error = vfs_fstatat(dfd, filename, &stat, flag);
 	if (error)
 		return error;
@@ -181,6 +201,11 @@ asmlinkage long sys32_rt_sigaction(int s
 	int ret;
 	compat_sigset_t set32;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	if (sig == SIGTERM || sig == SIGINT)
+                	return -EPERM;
+        }
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(compat_sigset_t))
 		return -EINVAL;
@@ -255,6 +280,9 @@ asmlinkage long sys32_sigaction(int sig,
 	struct k_sigaction new_ka, old_ka;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	if (act) {
 		compat_old_sigset_t mask;
 		compat_uptr_t handler, restorer;
@@ -295,7 +323,12 @@ asmlinkage long sys32_rt_sigprocmask(int
 	sigset_t s;
 	compat_sigset_t s32;
 	int ret;
-	mm_segment_t old_fs = get_fs();
+	mm_segment_t old_fs;
+
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
+	old_fs = get_fs();
 
 	if (set) {
 		if (copy_from_user(&s32, set, sizeof(compat_sigset_t)))
@@ -330,6 +363,9 @@ asmlinkage long sys32_rt_sigprocmask(int
 
 asmlinkage long sys32_alarm(unsigned int seconds)
 {
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	return alarm_setitimer(seconds);
 }
 
@@ -367,7 +403,12 @@ asmlinkage long sys32_rt_sigpending(comp
 	sigset_t s;
 	compat_sigset_t s32;
 	int ret;
-	mm_segment_t old_fs = get_fs();
+	mm_segment_t old_fs;
+
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
+	old_fs = get_fs();
 
 	set_fs(KERNEL_DS);
 	ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize);
@@ -390,7 +431,12 @@ asmlinkage long sys32_rt_sigqueueinfo(in
 {
 	siginfo_t info;
 	int ret;
-	mm_segment_t old_fs = get_fs();
+	mm_segment_t old_fs;
+
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
+        old_fs = get_fs();
 
 	if (copy_siginfo_from_user32(&info, uinfo))
 		return -EFAULT;
@@ -420,6 +466,9 @@ asmlinkage long sys32_personality(unsign
 {
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+        	personality = current->personality;
+
 	if (personality(current->personality) == PER_LINUX32 &&
 		personality == PER_LINUX)
 		personality = PER_LINUX32;
@@ -432,10 +481,15 @@ asmlinkage long sys32_personality(unsign
 asmlinkage long sys32_sendfile(int out_fd, int in_fd,
 			       compat_off_t __user *offset, s32 count)
 {
-	mm_segment_t old_fs = get_fs();
+	mm_segment_t old_fs;
 	int ret;
 	off_t of;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
+	old_fs = get_fs();
+
 	if (offset && get_user(of, offset))
 		return -EFAULT;
 
@@ -455,11 +509,20 @@ asmlinkage long sys32_execve(char __user
 	long error;
 	char *filename;
 
+        if ((current->sbox_flags & SBOX_NO_EXEC)) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+        }
+
 	filename = getname(name);
 	error = PTR_ERR(filename);
 	if (IS_ERR(filename))
 		return error;
 	error = compat_do_execve(filename, argv, envp, regs);
+        if (!error) {
+        	if ((current->sbox_flags & SBOX_NO_SYSCALLS))
+			current->sbox_flags |= SBOX_NO_EXEC;
+        }
 	putname(filename);
 	return error;
 }
@@ -503,6 +566,11 @@ long sys32_vm86_warning(void)
 	struct task_struct *me = current;
 	static char lastcomm[sizeof(me->comm)];
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+	}
+
 	if (strncmp(lastcomm, me->comm, sizeof(lastcomm))) {
 		compat_printk(KERN_INFO
 			      "%s: vm86 mode not supported on 64 bit kernel\n",
diff -ruNp linux-2.6.34.5/arch/x86/kernel/ioport.c linux-2.6.34.5-cher1/arch/x86/kernel/ioport.c
--- linux-2.6.34.5/arch/x86/kernel/ioport.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/arch/x86/kernel/ioport.c	2010-08-26 14:45:12.214567916 +0400
@@ -39,6 +39,11 @@ asmlinkage long sys_ioperm(unsigned long
 	struct tss_struct *tss;
 	unsigned int i, max_long, bytes, bytes_updated;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+	}
+
 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
 		return -EINVAL;
 	if (turn_on && !capable(CAP_SYS_RAWIO))
@@ -108,6 +113,11 @@ long sys_iopl(unsigned int level, struct
 	unsigned int old = (regs->flags >> 12) & 3;
 	struct thread_struct *t = &current->thread;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+	}
+
 	if (level > 3)
 		return -EINVAL;
 	/* Trying to gain more privileges? */
diff -ruNp linux-2.6.34.5/arch/x86/kernel/ldt.c linux-2.6.34.5-cher1/arch/x86/kernel/ldt.c
--- linux-2.6.34.5/arch/x86/kernel/ldt.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/arch/x86/kernel/ldt.c	2010-08-26 14:45:12.214567916 +0400
@@ -250,6 +250,11 @@ asmlinkage int sys_modify_ldt(int func, 
 {
 	int ret = -ENOSYS;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	switch (func) {
 	case 0:
 		ret = read_ldt(ptr, bytecount);
diff -ruNp linux-2.6.34.5/arch/x86/kernel/process.c linux-2.6.34.5-cher1/arch/x86/kernel/process.c
--- linux-2.6.34.5/arch/x86/kernel/process.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/arch/x86/kernel/process.c	2010-08-26 14:45:12.225557177 +0400
@@ -306,12 +306,22 @@ long sys_execve(char __user *name, char 
 	long error;
 	char *filename;
 
+        if ((current->sbox_flags & SBOX_NO_EXEC)) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	filename = getname(name);
 	error = PTR_ERR(filename);
 	if (IS_ERR(filename))
 		return error;
 	error = do_execve(filename, argv, envp, regs);
 
+        if (error == 0) {
+		if ((current->sbox_flags & SBOX_NO_SYSCALLS))
+                	current->sbox_flags |= SBOX_NO_EXEC;
+	}
+
 #ifdef CONFIG_X86_32
 	if (error == 0) {
 		/* Make sure we don't return using sysenter.. */
diff -ruNp linux-2.6.34.5/arch/x86/kernel/signal.c linux-2.6.34.5-cher1/arch/x86/kernel/signal.c
--- linux-2.6.34.5/arch/x86/kernel/signal.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/arch/x86/kernel/signal.c	2010-08-26 14:45:12.225557177 +0400
@@ -485,6 +485,9 @@ static int __setup_rt_frame(int sig, str
 asmlinkage int
 sys_sigsuspend(int history0, int history1, old_sigset_t mask)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	mask &= _BLOCKABLE;
 	spin_lock_irq(&current->sighand->siglock);
 	current->saved_sigmask = current->blocked;
@@ -506,6 +509,9 @@ sys_sigaction(int sig, const struct old_
 	struct k_sigaction new_ka, old_ka;
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	if (act) {
 		old_sigset_t mask;
 
@@ -549,6 +555,9 @@ long
 sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
 		struct pt_regs *regs)
 {
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	return do_sigaltstack(uss, uoss, regs->sp);
 }
 
diff -ruNp linux-2.6.34.5/arch/x86/kernel/vm86_32.c linux-2.6.34.5-cher1/arch/x86/kernel/vm86_32.c
--- linux-2.6.34.5/arch/x86/kernel/vm86_32.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/arch/x86/kernel/vm86_32.c	2010-08-26 14:45:12.228703714 +0400
@@ -207,6 +207,11 @@ int sys_vm86old(struct vm86_struct __use
 	struct task_struct *tsk;
 	int tmp, ret = -EPERM;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	tsk = current;
 	if (tsk->thread.saved_sp0)
 		goto out;
@@ -237,6 +242,11 @@ int sys_vm86(unsigned long cmd, unsigned
 	int tmp, ret;
 	struct vm86plus_struct __user *v86;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+	}
+
 	tsk = current;
 	switch (cmd) {
 	case VM86_REQUEST_IRQ:
diff -ruNp linux-2.6.34.5/arch/x86/SYSCALLS.i386 linux-2.6.34.5-cher1/arch/x86/SYSCALLS.i386
--- linux-2.6.34.5/arch/x86/SYSCALLS.i386	1970-01-01 03:00:00.000000000 +0300
+++ linux-2.6.34.5-cher1/arch/x86/SYSCALLS.i386	2010-08-26 14:45:12.229578698 +0400
@@ -0,0 +1,346 @@
+sys_exit
+ptregs_fork			
+sys_read
+sys_write
+sys_open			
+sys_close
+sys_waitpid			
+sys_creat			
+sys_link
+sys_unlink
+ptregs_execve
+sys_chdir
+sys_time
+sys_mknod
+sys_chmod
+sys_lchown16
+sys_ni_syscall
+sys_stat
+sys_lseek
+sys_getpid
+sys_mount
+sys_oldumount
+sys_setuid16
+sys_getuid16
+sys_stime
+sys_ptrace
+sys_alarm
+sys_fstat
+sys_pause
+sys_utime
+sys_ni_syscall
+sys_ni_syscall
+sys_access
+sys_nice
+sys_ni_syscall
+sys_sync
+sys_kill
+sys_rename
+sys_mkdir
+sys_rmdir
+sys_dup
+sys_pipe
+sys_times
+sys_ni_syscall
+sys_brk
+sys_setgid16
+sys_getgid16
+sys_signal
+sys_geteuid16
+sys_getegid16
+sys_acct
+sys_umount
+sys_ni_syscall
+sys_ioctl
+sys_fcntl
+sys_ni_syscall
+sys_setpgid
+sys_ni_syscall
+sys_olduname
+sys_umask
+sys_chroot
+sys_ustat
+sys_dup2
+sys_getppid
+sys_getpgrp
+sys_setsid
+sys_sigaction
+sys_sgetmask
+sys_ssetmask
+sys_setreuid16
+sys_setregid16
+sys_sigsuspend
+sys_sigpending
+sys_sethostname
+sys_setrlimit
+sys_old_getrlimit
+sys_getrusage
+sys_gettimeofday
+sys_settimeofday
+sys_getgroups16
+sys_setgroups16
+old_select
+sys_symlink
+sys_lstat
+sys_readlink
+sys_uselib
+sys_swapon
+sys_reboot
+sys_old_readdir
+old_mmap
+sys_munmap
+sys_truncate
+sys_ftruncate
+sys_fchmod
+sys_fchown16
+sys_getpriority
+sys_setpriority
+sys_ni_syscall
+sys_statfs
+sys_fstatfs
+sys_ioperm
+sys_socketcall
+sys_syslog
+sys_setitimer
+sys_getitimer
+sys_newstat
+sys_newlstat
+sys_newfstat
+sys_uname
+ptregs_iopl
+sys_vhangup
+sys_ni_syscall
+ptregs_vm86old
+sys_wait4
+sys_swapoff
+sys_sysinfo
+sys_ipc
+sys_fsync
+ptregs_sigreturn
+ptregs_clone
+sys_setdomainname
+sys_newuname
+sys_modify_ldt
+sys_adjtimex
+sys_mprotect
+sys_sigprocmask
+sys_ni_syscall
+sys_init_module
+sys_delete_module
+sys_ni_syscall
+sys_quotactl
+sys_getpgid
+sys_fchdir
+sys_bdflush
+sys_sysfs
+sys_personality
+sys_ni_syscall
+sys_setfsuid16
+sys_setfsgid16
+sys_llseek
+sys_getdents
+sys_select
+sys_flock
+sys_msync
+sys_readv
+sys_writev
+sys_getsid
+sys_fdatasync
+sys_sysctl
+sys_mlock
+sys_munlock
+sys_mlockall
+sys_munlockall
+sys_sched_setparam
+sys_sched_getparam
+sys_sched_setscheduler
+sys_sched_getscheduler
+sys_sched_yield
+sys_sched_get_priority_max
+sys_sched_get_priority_min
+sys_sched_rr_get_interval
+sys_nanosleep
+sys_mremap
+sys_setresuid16
+sys_getresuid16
+ptregs_vm86
+sys_ni_syscall
+sys_poll
+sys_nfsservctl
+sys_setresgid16
+sys_getresgid16
+sys_prctl
+ptregs_rt_sigreturn
+sys_rt_sigaction
+sys_rt_sigprocmask
+sys_rt_sigpending
+sys_rt_sigtimedwait
+sys_rt_sigqueueinfo
+sys_rt_sigsuspend
+sys_pread64
+sys_pwrite64
+sys_chown16
+sys_getcwd
+sys_capget
+sys_capset
+ptregs_sigaltstack
+sys_sendfile
+sys_ni_syscall
+sys_ni_syscall
+ptregs_vfork
+sys_getrlimit
+sys_mmap2
+sys_truncate64
+sys_ftruncate64
+sys_stat64
+sys_lstat64
+sys_fstat64
+sys_lchown
+sys_getuid
+sys_getgid
+sys_geteuid
+sys_getegid
+sys_setreuid
+sys_setregid
+sys_getgroups
+sys_setgroups
+sys_fchown
+sys_setresuid
+sys_getresuid
+sys_setresgid
+sys_getresgid
+sys_chown
+sys_setuid
+sys_setgid
+sys_setfsuid
+sys_setfsgid
+sys_pivot_root
+sys_mincore
+sys_madvise
+sys_getdents64
+sys_fcntl64
+sys_ni_syscall
+sys_ni_syscall
+sys_gettid
+sys_readahead
+sys_setxattr
+sys_lsetxattr
+sys_fsetxattr
+sys_getxattr
+sys_lgetxattr
+sys_fgetxattr
+sys_listxattr
+sys_llistxattr
+sys_flistxattr
+sys_removexattr
+sys_lremovexattr
+sys_fremovexattr
+sys_tkill
+sys_sendfile64
+sys_futex
+sys_sched_setaffinity
+sys_sched_getaffinity
+sys_set_thread_area
+sys_get_thread_area
+sys_io_setup
+sys_io_destroy
+sys_io_getevents
+sys_io_submit
+sys_io_cancel
+sys_fadvise64
+sys_ni_syscall
+sys_exit_group
+sys_lookup_dcookie
+sys_epoll_create
+sys_epoll_ctl
+sys_epoll_wait
+sys_remap_file_pages
+sys_set_tid_address
+sys_timer_create
+sys_timer_settime
+sys_timer_gettime
+sys_timer_getoverrun
+sys_timer_delete
+sys_clock_settime
+sys_clock_gettime
+sys_clock_getres
+sys_clock_nanosleep
+sys_statfs64
+sys_fstatfs64
+sys_tgkill
+sys_utimes
+sys_fadvise64_64
+sys_ni_syscall
+sys_mbind
+sys_get_mempolicy
+sys_set_mempolicy
+sys_mq_open
+sys_mq_unlink
+sys_mq_timedsend
+sys_mq_timedreceive
+sys_mq_notify
+sys_mq_getsetattr
+sys_kexec_load
+sys_waitid
+sys_ni_syscall
+sys_add_key
+sys_request_key
+sys_keyctl
+sys_ioprio_set
+sys_ioprio_get
+sys_inotify_init
+sys_inotify_add_watch
+sys_inotify_rm_watch
+sys_migrate_pages
+sys_openat
+sys_mkdirat
+sys_mknodat
+sys_fchownat
+sys_futimesat
+sys_fstatat64
+sys_unlinkat
+sys_renameat
+sys_linkat
+sys_symlinkat
+sys_readlinkat
+sys_fchmodat
+sys_faccessat
+sys_pselect6
+sys_ppoll
+sys_unshare
+sys_set_robust_list
+sys_get_robust_list
+sys_splice
+sys_sync_file_range
+sys_tee
+sys_vmsplice
+sys_move_pages
+sys_getcpu
+sys_epoll_pwait
+sys_utimensat
+sys_signalfd
+sys_timerfd_create
+sys_eventfd
+sys_fallocate
+sys_timerfd_settime
+sys_timerfd_gettime
+sys_signalfd4
+sys_eventfd2
+sys_epoll_create1
+sys_dup3
+sys_pipe2
+sys_inotify_init1
+sys_preadv
+sys_pwritev
+sys_rt_tgsigqueueinfo
+sys_perf_event_open
+sys_recvmmsg
+
+Syscall_0:
+sys_restart_syscall
+
+=== END OF SYSCALL TABLE ===
+*) The line number corresponds to syscall number
+**) sys_fork, sys_vfork, sys_clone -> do_fork (kernel/fork.c)
+
+syscall table in arch/x86/kernel/syscall_table_32.S
diff -ruNp linux-2.6.34.5/arch/x86/SYSCALLS.in linux-2.6.34.5-cher1/arch/x86/SYSCALLS.in
--- linux-2.6.34.5/arch/x86/SYSCALLS.in	1970-01-01 03:00:00.000000000 +0300
+++ linux-2.6.34.5-cher1/arch/x86/SYSCALLS.in	2010-08-26 14:45:12.238562018 +0400
@@ -0,0 +1,612 @@
+fs/compat.c:
+	compat_sys_select			allowed
+	compat_sys_pselect6			allowed
+	compat_sys_ppoll			allowed
+	compat_sys_epoll_pwait			allowed
+	compat_sys_utime			secured
+	compat_sys_utimensat			secured
+	compat_sys_futimesat			secured
+	compat_sys_utimes			secured
+	compat_sys_newstat			secured
+	compat_sys_newlstat			secured
+	compat_sys_newfstatat			secured
+	compat_sys_newfstat			secured
+	compat_sys_statfs			secured
+	compat_sys_fstatfs			secured
+	compat_sys_statfs64			secured
+	compat_sys_fstatfs64			secured
+	compat_sys_ustat			secured
+	compat_sys_io_setup			secured
+	compat_sys_io_getevents			secured
+	compat_sys_io_submit			secured
+	compat_sys_mount			secured
+	compat_sys_old_readdir			secured
+	compat_sys_getdents			secured
+	compat_sys_getdents64			secured
+	compat_sys_readv			secured
+	compat_sys_preadv			secured
+	compat_sys_writev			secured
+	compat_sys_pwritev			secured
+	compat_sys_vmsplice			secured
+	compat_sys_openat			secured
+	compat_sys_nfsservctl			secured
+	compat_sys_signalfd4			secured
+	compat_sys_signalfd			secured
+	compat_sys_timerfd_settime		secured
+	compat_sys_timerfd_gettime		secured
+	compat_sys_fcntl64			restricted
+	compat_sys_fcntl			restricted
+	compat_sys_open				restricted
+mm/mmap.c:
+	sys_brk					allowed
+	sys_munmap				allowed
+mm/mempolicy.c:
+	sys_get_mempolicy			allowed
+	compat_sys_get_mempolicy		allowed
+	sys_mbind				restricted
+	sys_set_mempolicy			restricted
+	sys_migrate_pages			restricted
+	compat_sys_set_mempolicy		restricted
+	compat_sys_mbind			restricted
+kernel/time.c:
+	sys_time				allowed
+	sys_gettimeofday			allowed
+	sys_stime				secured
+	sys_settimeofday			secured
+	sys_adjtimex				secured
+security/keys/keyctl.c:
+	sys_add_key				secured
+	sys_request_key				secured
+	sys_keyctl                              secured
+net/socket.c:
+	sys_socket				secured
+	sys_socketpair				secured
+	sys_bind				secured
+	sys_listen				secured
+	sys_accept4				secured
+	sys_accept				secured
+	sys_connect				secured
+	sys_getsockname				secured
+	sys_getpeername				secured
+	sys_sendto				secured
+	sys_send				secured
+	sys_recvfrom				secured
+	sys_recv				secured
+	sys_setsockopt				secured
+	sys_getsockopt				secured
+	sys_shutdown				secured
+	sys_sendmsg				secured
+	sys_recvmsg				secured
+	sys_socketcall				secured
+	sys_recvmmsg				secured
+net/compat.c:
+	compat_sys_setsockopt			secured
+	compat_sys_getsockopt			secured
+	compat_sys_sendmsg			secured
+	compat_sys_recvmsg			secured
+	compat_sys_recv				secured
+	compat_sys_recvfrom			secured
+	compat_sys_socketcall			secured
+	compat_sys_recvmmsg			secured
+mm/swapfile.c:
+	sys_swapoff				secured
+	sys_swapon				secured
+mm/mlock.c:
+	sys_mlock				secured
+	sys_munlock				secured
+	sys_mlockall				secured
+	sys_munlockall				secured
+mm/mincore.c:
+	sys_mincore				secured
+mm/migrate.c:
+	sys_move_pages				secured
+mm/fadvise.c:
+	sys_fadvise64_64			secured
+	sys_fadvise64				secured
+fs/compat_ioctl.c:
+	compat_sys_ioctl			restricted
+fs/dcache.c:
+	sys_getcwd				restricted
+mm/mprotect.c:
+	sys_mprotect				allowed
+mm/madvise.c:
+	sys_madvise				restricted
+mm/filemap.c:
+	sys_readahead				restricted
+kernel/uid16.c:
+        sys_chown16                             redirect        sys_chown
+        sys_lchown16                            redirect        sys_lchown
+        sys_fchown16                            redirect        sys_fchown
+        sys_setregid16                          redirect        sys_setregid
+        sys_setgid16                            redirect        sys_setgid
+        sys_setreuid16                          redirect        sys_setreuid
+        sys_setuid16                            redirect        sys_setuid
+        sys_setresuid16                         redirect        sys_setresuid
+        sys_getresuid16                         allowed
+	sys_setresgid16                         redirect        sys_setresgid
+        sys_getresgid16                         allowed
+        sys_setfsuid16                          redirect        sys_setfsuid
+        sys_setfsgid16                          redirect        sys_setfsgid
+        sys_getgroups16                         allowed
+        sys_setgroups16                         secured
+	sys_getuid16                            allowed
+        sys_geteuid16                           allowed
+        sys_getgid16                            allowed
+        sys_getegid16                           allowed
+kernel/timer.c:
+        sys_alarm                               restricted
+        sys_getpid                              allowed
+        sys_getppid                             allowed
+        sys_getuid                              allowed
+        sys_geteuid                             allowed
+        sys_getgid                              allowed
+        sys_getegid                             allowed
+        sys_gettid                              allowed
+        sys_sysinfo                             allowed
+kernel/sys.c:
+        sys_setpriority                         secured
+        sys_getpriority                         allowed
+        sys_reboot                              secured
+        sys_setregid                            secured
+        sys_setgid                              secured
+        sys_setreuid                            secured
+        sys_setuid                              secured
+        sys_setresuid                           secured
+        sys_getresuid                           allowed
+        sys_setresgid                           secured
+        sys_getresgid                           allowed
+        sys_setfsuid                            secured
+        sys_setfsgid                            secured
+        sys_times                               secured
+        sys_setpgid                             secured
+        sys_getpgid                             allowed
+        sys_getpgrp                             allowed
+        sys_getsid                              allowed
+        sys_setsid                              secured
+        sys_newuname                            allowed
+        sys_sethostname                         secured
+        sys_gethostname                         allowed
+        sys_setdomainname                       secured
+        sys_getrlimit                           allowed
+        sys_old_getrlimit                       allowed
+        sys_setrlimit                           secured
+        sys_getrusage                           allowed
+        sys_umask                               restricted
+        sys_prctl                               secured
+        sys_getcpu                              allowed
+kernel/sysctl_binary.c:
+        sys_sysctl                              secured
+	compat_sys_sysctl			secured
+kernel/sched.c:
+        sys_nice                                secured
+        sys_sched_setscheduler                  secured
+        sys_sched_setparam                      secured
+        sys_sched_getscheduler                  allowed
+        sys_sched_getparam                      allowed
+        sys_sched_setaffinity                   secured
+        sys_sched_getaffinity                   allowed
+        sys_sched_yield                         allowed
+        sys_sched_get_priority_max              allowed
+        sys_sched_get_priority_min              allowed
+        sys_sched_rr_get_interval               allowed
+kernel/ptrace.c:
+        compat_sys_ptrace                       secured
+        sys_ptrace                              secured
+kernel/printk.c:
+        sys_syslog                              restricted
+kernel/posix-timers.c:
+        sys_timer_create                        secured
+        sys_timer_gettime                       secured
+        sys_timer_getoverrun                    secured
+        sys_timer_settime                       secured
+        sys_timer_delete                        secured
+        sys_clock_settime                       secured
+        sys_clock_gettime                       secured
+        sys_clock_getres                        secured
+        sys_clock_nanosleep                     secured
+kernel/signal.c:
+        sys_restart_syscall                     allowed
+        sys_rt_sigprocmask                      restricted
+        sys_rt_sigpending                       restricted
+        sys_rt_sigtimedwait                     restricted
+        sys_kill                                restricted
+        sys_tgkill                              restricted
+        sys_tkill                               restricted
+        sys_rt_sigqueueinfo                     restricted
+        sys_rt_tgsigqueueinfo                   restricted
+        sys_sigpending                          restricted
+        sys_sigprocmask                         restricted
+        sys_rt_sigaction                        restricted
+        sys_sgetmask                            allowed
+        sys_ssetmask                            restricted
+        sys_signal                              restricted
+        sys_pause                               restricted
+        sys_rt_sigsuspend                       restricted
+kernel/module.c:
+        sys_delete_module                       secured
+        sys_init_module                         secured
+kernel/kexec.c:
+        compat_sys_kexec_load                   secured
+        sys_kexec_load                          secured
+fs/dcookies.c:
+        sys_lookup_dcookie                      restricted
+kernel/fork.c:
+        sys_set_tid_address                     allowed
+        sys_unshare                             restricted
+kernel/exit.c:
+        sys_exit                                allowed
+        sys_exit_group                          allowed
+        sys_waitid                              restricted
+        sys_wait4                               restricted
+        sys_waitpid                             redirect        sys_wait4
+kernel/exec_domain.c:
+        sys_personality                         restricted
+kernel/compat.c:
+        compat_sys_gettimeofday                 allowed
+        compat_sys_settimeofday                 secured
+        compat_sys_nanosleep                    secured
+        compat_sys_getitimer                    secured
+        compat_sys_setitimer                    secured
+        compat_sys_times                        secured
+        compat_sys_sigpending                   restricted
+        compat_sys_sigprocmask                  secured
+        compat_sys_setrlimit                    secured
+        compat_sys_old_getrlimit                allowed
+        compat_sys_getrlimit                    allowed
+        compat_sys_getrusage                    allowed
+        compat_sys_wait4                        secured
+        compat_sys_waitid                       secured
+        compat_sys_sched_setaffinity            secured
+        compat_sys_sched_getaffinity            allowed
+        compat_sys_timer_create                 secured
+        compat_sys_timer_settime                secured
+        compat_sys_timer_gettime                secured
+        compat_sys_clock_settime                secured
+        compat_sys_clock_gettime                secured
+        compat_sys_clock_getres                 secured
+        compat_sys_clock_nanosleep              secured
+        compat_sys_rt_sigtimedwait              secured
+        compat_sys_rt_tgsigqueueinfo            secured
+        compat_sys_time                         allowed
+        compat_sys_stime                        secured
+        compat_sys_rt_sigsuspend                secured
+        compat_sys_adjtimex                     secured
+        compat_sys_move_pages                   secured
+        compat_sys_migrate_pages                secured
+        compat_sys_sysinfo                      allowed
+kernel/capability.c:
+        sys_capget                              secured
+        sys_capset                              secured
+fs/utimes.c:
+        sys_utime                               secured
+        sys_utimensat                           secured
+        sys_futimesat                           secured
+        sys_utimes                              redirect        sys_futimesat
+kernel/acct.c:
+        sys_acct                                secured
+ipc/shm.c:
+        sys_shmget                              secured
+        sys_shmctl                              secured
+        sys_shmat                               secured
+        sys_shmdt                               secured
+ipc/sem.c:
+        sys_semget                              secured
+        sys_semctl                              secured
+        sys_semtimedop                          secured
+        sys_semop                               redirect        sys_semtimedop
+ipc/msg.c:
+        sys_msgget                              secured
+        sys_msgctl                              secured
+        sys_msgsnd                              secured
+        sys_msgrcv                              secured
+ipc/mqueue.c:
+        sys_mq_open                             secured
+        sys_mq_unlink                           secured
+        sys_mq_timedsend                        secured
+        sys_mq_timedreceive                     secured
+        sys_mq_notify                           secured
+        sys_mq_getsetattr                       secured
+fs/xattr.c:
+        sys_setxattr                            secured
+        sys_lsetxattr                           secured
+        sys_fsetxattr                           secured
+        sys_getxattr                            secured
+        sys_lgetxattr                           secured
+        sys_fgetxattr                           secured
+        sys_listxattr                           secured
+        sys_llistxattr                          secured
+        sys_flistxattr                          secured
+        sys_removexattr                         secured
+        sys_lremovexattr                        secured
+        sys_fremovexattr                        secured
+fs/timerfd.c:
+        sys_timerfd_create                      secured
+        sys_timerfd_settime                     secured
+        sys_timerfd_gettime                     secured
+fs/super.c:
+        sys_ustat                               restricted
+fs/sync.c:
+        sys_sync                                restricted
+        sys_fsync                               restricted
+        sys_fdatasync                           restricted
+        sys_sync_file_range                     restricted
+        sys_sync_file_range2                    restricted
+fs/stat.c:
+        sys_stat                                restricted
+        sys_lstat                               restricted
+        sys_fstat                               allowed
+        sys_newstat                             restricted
+        sys_newlstat                            restricted
+        sys_newfstatat                          restricted
+        sys_newfstat                            allowed
+        sys_readlinkat                          restricted
+        sys_readlink                            redirect        sys_readlinkat
+        sys_stat64                              restricted
+        sys_lstat64                             restricted
+        sys_fstat64                             allowed
+        sys_fstatat64                           restricted
+fs/splice.c:
+        sys_vmsplice                            secured
+        sys_splice                              secured
+        sys_tee                                 secured
+fs/quota/quota.c:
+        sys_quotactl                            secured
+fs/quota/compat.c:
+        sys32_quotactl                          secured
+fs/notify/inotify/inotify_user.c:
+        sys_inotify_init1                       secured
+        sys_inotify_init                        redirect        sys_inotify_init1
+        sys_inotify_add_watch                   secured
+        sys_inotify_rm_watch                    secured
+fs/signalfd.c:
+        sys_signalfd4                           secured
+        sys_signalfd                            redirect        sys_signalfd4
+fs/read_write.c:
+        sys_lseek                               restricted
+        sys_llseek                              restricted
+        sys_read                                allowed
+        sys_write                               allowed
+        sys_pread64                             restricted
+        sys_pwrite64                            restricted
+        sys_readv                               allowed
+        sys_writev                              allowed
+        sys_preadv                              restricted
+        sys_pwritev                             restricted
+        sys_sendfile                            restricted
+        sys_sendfile64                          restricted
+fs/readdir.c:
+        sys_old_readdir                         restricted
+        sys_getdents                            restricted
+        sys_getdents64                          restricted
+fs/pipe.c:
+        sys_pipe2                               secured
+        sys_pipe                                redirect        sys_pipe2
+fs/open.c:
+        sys_statfs                              restricted
+        sys_statfs64                            restricted
+        sys_fstatfs                             restricted
+        sys_fstatfs64                           restricted
+        sys_truncate                            restricted
+        sys_ftruncate                           restricted
+        sys_truncate64                          restricted
+        sys_ftruncate64                         restricted
+        sys_fallocate                           restricted
+        sys_faccessat                           restricted
+        sys_access                              redirect        sys_faccessat
+        sys_chdir                               secured
+        sys_fchdir                              secured
+        sys_chroot                              secured
+        sys_fchmod                              secured
+        sys_fchmodat                            secured
+        sys_chmod                               redirect        sys_fchmodat
+        sys_chown                               secured
+        sys_fchownat                            secured
+        sys_lchown                              secured
+        sys_fchown                              secured
+        sys_open                                restricted
+        sys_openat                              restricted
+        sys_creat                               restricted
+        sys_close                               allowed
+        sys_vhangup                             secured
+fs/nfsctl.c:
+        sys_nfsservctl                          secured
+fs/namespace.c:
+        sys_umount                              secured
+        sys_oldumount                           redirect        sys_umount
+        sys_mount                               secured
+        sys_pivot_root                          secured
+fs/namei.c:
+        sys_mknodat                             secured
+        sys_mknod                               redirect        sys_mknodat
+        sys_mkdirat                             secured
+        sys_mkdir                               redirect        sys_mkdirat
+        sys_rmdir                               secured
+        sys_unlinkat                            secured
+        sys_unlink                              secured
+        sys_symlinkat                           secured
+        sys_symlink                             redirect        sys_symlinkat
+        sys_linkat                              secured
+        sys_link                                redirect        sys_linkat
+        sys_renameat                            secured
+        sys_rename                              redirect        sys_renameat
+fs/locks.c:
+        sys_flock                               secured
+fs/ioprio.c:
+        sys_ioprio_set                          secured
+        sys_ioprio_get                          secured
+fs/ioctl.c:
+        sys_ioctl                               restricted
+fs/filesystems.c:
+        sys_sysfs                               secured
+fs/buffer.c:
+        sys_bdflush                             secured
+fs/eventfd.c:
+        sys_eventfd2                            restricted
+        sys_eventfd                             redirect        sys_eventfd2
+fs/eventpoll.c:
+        sys_epoll_create1                       restricted
+        sys_epoll_create                        restricted
+        sys_epoll_ctl                           restricted
+        sys_epoll_wait                          restricted
+        sys_epoll_pwait                         restricted
+fs/exec.c:
+        sys_uselib                              restricted
+fs/fcntl.c:
+        sys_dup3                                restricted
+        sys_dup2                                restricted
+        sys_dup                                 restricted
+        sys_fcntl                               restricted
+        sys_fcntl64                             restricted
+fs/aio.c:
+        sys_io_setup                            restricted
+        sys_io_destroy                          restricted
+        sys_io_submit                           restricted
+        sys_io_cancel                           restricted
+        sys_io_getevents                        restricted
+arch/x86/kernel/sys_i386_32.c:
+        sys_mmap2                               allowed
+        old_mmap                                allowed
+        old_select                              allowed
+        sys_ipc                                 secured
+        sys_uname                               allowed
+        sys_olduname                            allowed
+arch/x86/kernel/vm86_32.c:
+        sys_vm86old                             secured
+        sys_vm86                                secured
+arch/x86/kernel/signal.c:
+        sys_sigsuspend                          restricted
+        sys_sigaction                           restricted
+        sys_sigaltstack                         restricted
+        sys_sigreturn                           allowed
+        sys_rt_sigreturn                        allowed
+arch/x86/kernel/ldt.c:
+        sys_modify_ldt                          secured
+arch/x86/kernel/process.c:
+        sys_execve                              restricted
+arch/x86/kernel/process_32.c:
+        sys_clone                               restricted
+arch/x86/kernel/process_64.c:
+        sys_clone                               restricted
+        sys_arch_prctl                          allowed
+arch/x86/kernel/process.c:
+        sys_vfork                               restricted
+        sys_fork                                restricted
+arch/x86/kernel/ioport.c:
+        sys_ioperm                              secured
+        sys_iopl                                secured
+arch/x86/ia32/sys_ia32.c:
+        sys32_truncate64                        redirect        sys_truncate
+        sys32_ftruncate64                       redirect        sys_ftruncate
+        sys32_stat64                            restricted
+        sys32_lstat64                           restricted
+        sys32_fstat64                           restricted
+        sys32_fstatat                           restricted
+        sys32_mmap                              allowed
+        sys32_mprotect                          redirect        sys_mprotect
+        sys32_rt_sigaction                      restricted
+        sys32_sigaction                         restricted
+        sys32_rt_sigprocmask                    restricted
+        sys32_alarm                             restricted
+        sys32_old_select                        redirect        compat_sys_select
+        sys32_waitpid                           redirect        compat_sys_wait4
+        sys32_sysfs                             redirect        sys_sysfs
+        sys32_sched_rr_get_interval             redirect        sys_sched_rr_get_interval
+        sys32_rt_sigpending                     restricted
+        sys32_rt_sigqueueinfo                   restricted
+        sys32_sysctl                            restricted
+        sys32_pread                             redirect        sys_pread64
+        sys32_pwrite                            redirect        sys_pwrite64
+        sys32_personality                       restricted
+        sys32_sendfile                          restricted
+        sys32_mmap2                             allowed
+        sys32_olduname                          allowed
+        sys32_uname                             allowed
+        sys32_execve                            restricted
+        sys32_clone                             restricted
+        sys32_lseek                             redirect        sys_lseek
+        sys32_kill                              redirect        sys_kill
+        sys32_fadvise64_64                      redirect        sys_fadvise64_64
+        sys32_vm86_warning                      secured
+        sys32_lookup_dcookie                    redirect        sys_lookup_dcookie
+        sys32_readahead                         redirect        sys_readahead
+        sys32_sync_file_range                   redirect        sys_sync_file_range
+        sys32_fadvise64                         redirect        sys_fadvise64_64
+        sys32_fallocate                         redirect        sys_fallocate
+arch/x86/ia32/ia32_signal.c:
+        sys32_sigsuspend                        restricted
+        sys32_sigaltstack                       restricted
+        sys32_sigreturn                         allowed
+        sys32_rt_sigreturn                      allowed
+arch/x86/ia32/ipc32.c:
+        sys32_ipc                               secured
+arch/x86/ia32/entry_32.S:
+        ptregs_fork                             redirect        sys_fork
+        ptregs_execve                           redirect        sys_execve
+        ptregs_iopl                             redirect        sys_iopl
+        ptregs_vm86old                          redirect        sys_vm86old
+        ptregs_sigreturn                        redirect        sys_sigreturn
+        ptregs_clone                            redirect        sys_clone
+        ptregs_vm86                             redirect        sys_vm86
+        ptregs_rt_sigreturn                     redirect        sys_rt_sigreturn
+        ptregs_sigaltstack                      redirect        sys_sigaltstack
+        ptregs_vfork                            redirect        sys_vfork
+kernel/itimer.c:
+        sys_setitimer                           restricted
+        sys_getitimer                           restricted
+fs/select.c:
+        sys_select                              allowed
+        sys_pselect6                            allowed
+        sys_poll                                allowed
+        sys_ppoll                               allowed
+mm/msync.c:
+        sys_msync                               allowed
+kernel/hrtimer.c:
+        sys_nanosleep                           restricted
+mm/mremap.c:
+        sys_mremap                              restricted
+kernel/groups.c:
+        sys_getgroups                           allowed
+        sys_setgroups                           secured
+kernel/futex.c:
+        sys_set_robust_list                     allowed
+        sys_get_robust_list                     allowed
+        sys_futex                               allowed
+arch/x86/kernel/tls.c:
+        sys_get_thread_area                     allowed
+        sys_set_thread_area                     allowed
+mm/fremap.c:
+        sys_remap_file_pages                    restricted
+kernel/perf_event.c:
+        sys_perf_event_open                     restricted
+arch/x86/kernel/entry_64.S:
+        stub_clone                              redirect        sys_clone
+        stub_fork                               redirect        sys_fork
+        stub_vfork                              redirect        sys_vfork
+        stub_sigaltstack                        redirect        sys_sigaltstack
+        stub_iopl                               redirect        sys_iopl
+        stub_execve                             redirect        sys_execve
+        stub_rt_sigreturn                       redirect        sys_rt_sigreturn
+arch/x86/kernel/sys_x86_64.c:
+        sys_mmap                                allowed
+arch/x86/ia32/ia32entry.S:
+        stub32_rt_sigreturn                     redirect        sys32_rt_sigreturn
+        stub32_sigreturn                        redirect        sys32_sigreturn
+        stub32_sigaltstack                      redirect        sys32_sigaltstack
+        stub32_execve                           redirect        sys32_execve
+	stub32_fork                             redirect        sys_fork
+	stub32_clone                            redirect        sys32_clone
+	stub32_vfork                            redirect        sys_vfork
+	stub32_iopl                             redirect        sys_iopl
+kernel/futex_compat.c:
+        compat_sys_set_robust_list              allowed
+        compat_sys_get_robust_list              allowed
+        compat_sys_futex                        allowed
+ipc/compat_mq.c:
+        compat_sys_mq_open                      secured
+        compat_sys_mq_timedsend                 secured
+        compat_sys_mq_timedreceive              secured
+        compat_sys_mq_notify                    secured
+        compat_sys_mq_getsetattr                secured
+unspecified_file:
+        sys_ni_syscall                          unimpl
+        quiet_ni_syscall                        unimpl
diff -ruNp linux-2.6.34.5/arch/x86/SYSCALLS.x86_32 linux-2.6.34.5-cher1/arch/x86/SYSCALLS.x86_32
--- linux-2.6.34.5/arch/x86/SYSCALLS.x86_32	1970-01-01 03:00:00.000000000 +0300
+++ linux-2.6.34.5-cher1/arch/x86/SYSCALLS.x86_32	2010-08-26 14:45:12.238562018 +0400
@@ -0,0 +1,345 @@
+sys_exit
+stub32_fork
+sys_read
+sys_write
+compat_sys_open
+sys_close
+sys32_waitpid
+sys_creat
+sys_link
+sys_unlink
+stub32_execve
+sys_chdir
+compat_sys_time
+sys_mknod
+sys_chmod
+sys_lchown16
+quiet_ni_syscall
+sys_stat
+sys32_lseek
+sys_getpid
+compat_sys_mount
+sys_oldumount
+sys_setuid16
+sys_getuid16
+compat_sys_stime
+compat_sys_ptrace
+sys_alarm
+sys_fstat
+sys_pause
+compat_sys_utime                	CAP
+quiet_ni_syscall
+quiet_ni_syscall
+sys_access
+sys_nice	
+quiet_ni_syscall
+sys_sync
+sys32_kill
+sys_rename
+sys_mkdir
+sys_rmdir
+sys_dup
+sys_pipe
+compat_sys_times
+quiet_ni_syscall
+sys_brk
+sys_setgid16
+sys_getgid16
+sys_signal
+sys_geteuid16
+sys_getegid16
+sys_acct
+sys_umount
+quiet_ni_syscall
+compat_sys_ioctl
+compat_sys_fcntl64
+quiet_ni_syscall
+sys_setpgid
+quiet_ni_syscall
+sys32_olduname
+sys_umask
+sys_chroot
+compat_sys_ustat
+sys_dup2
+sys_getppid
+sys_getpgrp
+sys_setsid
+sys32_sigaction
+sys_sgetmask
+sys_ssetmask
+sys_setreuid16
+sys_setregid16
+sys32_sigsuspend
+compat_sys_sigpending
+sys_sethostname
+compat_sys_setrlimit
+compat_sys_old_getrlimit
+compat_sys_getrusage
+compat_sys_gettimeofday
+compat_sys_settimeofday
+sys_getgroups16
+sys_setgroups16
+sys32_old_select
+sys_symlink
+sys_lstat
+sys_readlink
+sys_uselib
+sys_swapon
+sys_reboot
+compat_sys_old_readdir
+sys32_mmap
+sys_munmap
+sys_truncate
+sys_ftruncate
+sys_fchmod
+sys_fchown16
+sys_getpriority
+sys_setpriority
+quiet_ni_syscall
+compat_sys_statfs
+compat_sys_fstatfs
+sys_ioperm
+compat_sys_socketcall
+sys_syslog
+compat_sys_setitimer
+compat_sys_getitimer
+compat_sys_newstat
+compat_sys_newlstat
+compat_sys_newfstat
+sys32_uname
+stub32_iopl
+sys_vhangup
+quiet_ni_syscall
+sys32_vm86_warning
+compat_sys_wait4
+sys_swapoff
+compat_sys_sysinfo
+sys32_ipc
+sys_fsync
+stub32_sigreturn
+stub32_clone
+sys_setdomainname
+sys_uname
+sys_modify_ldt
+compat_sys_adjtimex
+sys32_mprotect
+compat_sys_sigprocmask
+quiet_ni_syscall
+sys_init_module
+sys_delete_module
+quiet_ni_syscall
+sys32_quotactl
+sys_getpgid
+sys_fchdir
+quiet_ni_syscall
+sys_sysfs
+sys_personality
+quiet_ni_syscall
+sys_setfsuid16
+sys_setfsgid16
+sys_llseek
+compat_sys_getdents
+compat_sys_select
+sys_flock
+sys_msync
+compat_sys_readv
+compat_sys_writev
+sys_getsid
+sys_fdatasync
+compat_sys_sysctl
+sys_mlock
+sys_munlock
+sys_mlockall
+sys_munlockall
+sys_sched_setparam
+sys_sched_getparam
+sys_sched_setscheduler
+sys_sched_getscheduler
+sys_sched_yield
+sys_sched_get_priority_max
+sys_sched_get_priority_min
+sys32_sched_rr_get_interval
+compat_sys_nanosleep
+sys_mremap
+sys_setresuid16
+sys_getresuid16
+sys32_vm86_warning
+quiet_ni_syscall
+sys_poll
+compat_sys_nfsservctl
+sys_setresgid16
+sys_getresgid16
+sys_prctl
+stub32_rt_sigreturn
+sys32_rt_sigaction
+sys32_rt_sigprocmask
+sys32_rt_sigpending
+compat_sys_rt_sigtimedwait
+sys32_rt_sigqueueinfo
+sys_rt_sigsuspend
+sys32_pread
+sys32_pwrite
+sys_chown16
+sys_getcwd
+sys_capget
+sys_capset
+stub32_sigaltstack
+sys32_sendfile
+quiet_ni_syscall
+quiet_ni_syscall
+stub32_vfork
+compat_sys_getrlimit
+sys32_mmap2
+sys32_truncate64
+sys32_ftruncate64
+sys32_stat64
+sys32_lstat64
+sys32_fstat64
+sys_lchown
+sys_getuid
+sys_getgid
+sys_geteuid
+sys_getegid
+sys_setreuid
+sys_setregid
+sys_getgroups
+sys_setgroups
+sys_fchown
+sys_setresuid
+sys_getresuid
+sys_setresgid
+sys_getresgid
+sys_chown
+sys_setuid
+sys_setgid
+sys_setfsuid
+sys_setfsgid
+sys_pivot_root
+sys_mincore
+sys_madvise
+compat_sys_getdents64
+compat_sys_fcntl64	
+quiet_ni_syscall
+quiet_ni_syscall
+sys_gettid	
+sys32_readahead
+sys_setxattr
+sys_lsetxattr
+sys_fsetxattr
+sys_getxattr
+sys_lgetxattr
+sys_fgetxattr
+sys_listxattr
+sys_llistxattr
+sys_flistxattr
+sys_removexattr
+sys_lremovexattr
+sys_fremovexattr
+sys_tkill
+sys_sendfile64 
+compat_sys_futex
+compat_sys_sched_setaffinity
+compat_sys_sched_getaffinity
+sys_set_thread_area
+sys_get_thread_area
+compat_sys_io_setup
+sys_io_destroy
+compat_sys_io_getevents
+compat_sys_io_submit
+sys_io_cancel
+sys32_fadvise64
+quiet_ni_syscall
+sys_exit_group
+sys32_lookup_dcookie
+sys_epoll_create
+sys_epoll_ctl
+sys_epoll_wait
+sys_remap_file_pages
+sys_set_tid_address
+compat_sys_timer_create
+compat_sys_timer_settime
+compat_sys_timer_gettime
+sys_timer_getoverrun
+sys_timer_delete
+compat_sys_clock_settime
+compat_sys_clock_gettime
+compat_sys_clock_getres
+compat_sys_clock_nanosleep
+compat_sys_statfs64
+compat_sys_fstatfs64
+sys_tgkill
+compat_sys_utimes
+sys32_fadvise64_64
+quiet_ni_syscall
+sys_mbind
+compat_sys_get_mempolicy
+sys_set_mempolicy
+compat_sys_mq_open
+sys_mq_unlink
+compat_sys_mq_timedsend
+compat_sys_mq_timedreceive
+compat_sys_mq_notify
+compat_sys_mq_getsetattr
+compat_sys_kexec_load
+compat_sys_waitid
+quiet_ni_syscall
+sys_add_key
+sys_request_key
+sys_keyctl
+sys_ioprio_set
+sys_ioprio_get
+sys_inotify_init
+sys_inotify_add_watch
+sys_inotify_rm_watch
+sys_migrate_pages
+compat_sys_openat
+sys_mkdirat
+sys_mknodat
+sys_fchownat
+compat_sys_futimesat
+sys32_fstatat
+sys_unlinkat
+sys_renameat
+sys_linkat
+sys_symlinkat
+sys_readlinkat
+sys_fchmodat
+sys_faccessat
+compat_sys_pselect6
+compat_sys_ppoll
+sys_unshare
+compat_sys_set_robust_list
+compat_sys_get_robust_list
+sys_splice
+sys32_sync_file_range
+sys_tee
+compat_sys_vmsplice
+compat_sys_move_pages
+sys_getcpu
+sys_epoll_pwait
+compat_sys_utimensat			CAP
+compat_sys_signalfd
+sys_timerfd_create
+sys_eventfd
+sys32_fallocate
+compat_sys_timerfd_settime
+compat_sys_timerfd_gettime
+compat_sys_signalfd4
+sys_eventfd2
+sys_epoll_create1
+sys_dup3
+sys_pipe2
+sys_inotify_init1
+compat_sys_preadv
+compat_sys_pwritev
+compat_sys_rt_tgsigqueueinfo
+sys_perf_event_open
+compat_sys_recvmmsg
+
+Syscall_0:
+sys_restart_syscall
+
+=== END OF SYSCALL TABLE ===
+*) The line number corresponds to syscall number
+
+syscall table is in arch/x86/ia32/ia32entry.S
diff -ruNp linux-2.6.34.5/arch/x86/SYSCALLS.x86_64 linux-2.6.34.5-cher1/arch/x86/SYSCALLS.x86_64
--- linux-2.6.34.5/arch/x86/SYSCALLS.x86_64	1970-01-01 03:00:00.000000000 +0300
+++ linux-2.6.34.5-cher1/arch/x86/SYSCALLS.x86_64	2010-08-26 14:45:12.246567969 +0400
@@ -0,0 +1,307 @@
+sys_write
+sys_open
+sys_close
+sys_newstat
+sys_newfstat
+sys_newlstat
+sys_poll
+sys_lseek
+sys_mmap
+sys_mprotect
+sys_munmap
+sys_brk
+sys_rt_sigaction
+sys_rt_sigprocmask
+stub_rt_sigreturn
+sys_ioctl
+sys_pread64
+sys_pwrite64
+sys_readv
+sys_writev
+sys_access
+sys_pipe
+sys_select
+sys_sched_yield
+sys_mremap
+sys_msync
+sys_mincore
+sys_madvise
+sys_shmget
+sys_shmat
+sys_shmctl
+sys_dup
+sys_dup2
+sys_pause
+sys_nanosleep
+sys_getitimer
+sys_alarm
+sys_setitimer
+sys_getpid
+sys_sendfile64
+sys_socket
+sys_connect
+sys_accept
+sys_sendto
+sys_recvfrom
+sys_sendmsg
+sys_recvmsg
+sys_shutdown
+sys_bind
+sys_listen
+sys_getsockname
+sys_getpeername
+sys_socketpair
+sys_setsockopt
+sys_getsockopt
+stub_clone
+stub_fork
+stub_vfork
+stub_execve
+sys_exit
+sys_wait4
+sys_kill
+sys_uname
+sys_semget
+sys_semop
+sys_semctl
+sys_shmdt
+sys_msgget
+sys_msgsnd
+sys_msgrcv
+sys_msgctl
+sys_fcntl
+sys_flock
+sys_fsync
+sys_fdatasync
+sys_truncate
+sys_ftruncate
+sys_getdents
+sys_getcwd
+sys_chdir
+sys_fchdir
+sys_rename
+sys_mkdir
+sys_rmdir
+sys_creat
+sys_link
+sys_unlink
+sys_symlink
+sys_readlink
+sys_chmod
+sys_fchmod
+sys_chown
+sys_fchown
+sys_lchown
+sys_umask
+sys_gettimeofday
+sys_getrlimit
+sys_getrusage
+sys_sysinfo
+sys_times
+sys_ptrace
+sys_getuid
+sys_syslog
+sys_getgid
+sys_setuid
+sys_setgid
+sys_geteuid
+sys_getegid
+sys_setpgid
+sys_getppid
+sys_getpgrp
+sys_setsid
+sys_setreuid
+sys_setregid
+sys_getgroups
+sys_setgroups
+sys_setresuid
+sys_getresuid
+sys_setresgid
+sys_getresgid
+sys_getpgid
+sys_setfsuid
+sys_setfsgid
+sys_getsid
+sys_capget
+sys_capset
+sys_rt_sigpending
+sys_rt_sigtimedwait
+sys_rt_sigqueueinfo
+sys_rt_sigsuspend
+stub_sigaltstack
+sys_utime
+sys_mknod
+sys_ni_syscall
+sys_personality
+sys_ustat
+sys_statfs
+sys_fstatfs
+sys_sysfs
+sys_getpriority
+sys_setpriority
+sys_sched_setparam
+sys_sched_getparam
+sys_sched_setscheduler
+sys_sched_getscheduler
+sys_sched_get_priority_max
+sys_sched_get_priority_min
+sys_sched_rr_get_interval
+sys_mlock
+sys_munlock
+sys_mlockall
+sys_munlockall
+sys_vhangup
+sys_modify_ldt
+sys_pivot_root
+sys_sysctl
+sys_prctl
+sys_arch_prctl
+sys_adjtimex
+sys_setrlimit
+sys_chroot
+sys_sync
+sys_acct
+sys_settimeofday
+sys_mount
+sys_umount
+sys_swapon
+sys_swapoff
+sys_reboot
+sys_sethostname
+sys_setdomainname
+stub_iopl
+sys_ioperm
+sys_ni_syscall
+sys_init_module
+sys_delete_module
+sys_ni_syscall
+sys_ni_syscall
+sys_quotactl
+sys_nfsservctl
+sys_ni_syscall
+sys_ni_syscall
+sys_ni_syscall
+sys_ni_syscall
+sys_ni_syscall
+sys_gettid
+sys_readahead
+sys_setxattr
+sys_lsetxattr
+sys_fsetxattr
+sys_getxattr
+sys_lgetxattr
+sys_fgetxattr
+sys_listxattr
+sys_llistxattr
+sys_flistxattr
+sys_removexattr
+sys_lremovexattr
+sys_fremovexattr
+sys_tkill
+sys_time
+sys_futex
+sys_sched_setaffinity
+sys_sched_getaffinity
+sys_ni_syscall
+sys_io_setup
+sys_io_destroy
+sys_io_getevents
+sys_io_submit
+sys_io_cancel
+sys_ni_syscall
+sys_lookup_dcookie
+sys_epoll_create
+sys_ni_syscall
+sys_ni_syscall
+sys_remap_file_pages
+sys_getdents64
+sys_set_tid_address
+sys_restart_syscall
+sys_semtimedop
+sys_fadvise64
+sys_timer_create
+sys_timer_settime
+sys_timer_gettime
+sys_timer_getoverrun
+sys_timer_delete
+sys_clock_settime
+sys_clock_gettime
+sys_clock_getres
+sys_clock_nanosleep
+sys_exit_group
+sys_epoll_wait
+sys_epoll_ctl
+sys_tgkill
+sys_utimes
+sys_ni_syscall
+sys_mbind
+sys_set_mempolicy
+sys_get_mempolicy
+sys_mq_open
+sys_mq_unlink
+sys_mq_timedsend
+sys_mq_timedreceive
+sys_mq_notify
+sys_mq_getsetattr
+sys_kexec_load
+sys_waitid
+sys_add_key
+sys_request_key
+sys_keyctl
+sys_ioprio_set
+sys_ioprio_get
+sys_inotify_init
+sys_inotify_add_watch
+sys_inotify_rm_watch
+sys_migrate_pages
+sys_openat
+sys_mkdirat
+sys_mknodat
+sys_fchownat
+sys_futimesat
+sys_newfstatat
+sys_unlinkat
+sys_renameat
+sys_linkat
+sys_symlinkat
+sys_readlinkat
+sys_fchmodat
+sys_faccessat
+sys_pselect6
+sys_ppoll
+sys_unshare
+sys_set_robust_list
+sys_get_robust_list
+sys_splice
+sys_tee
+sys_sync_file_range
+sys_vmsplice
+sys_move_pages
+sys_utimensat
+sys_epoll_pwait
+sys_signalfd
+sys_timerfd_create
+sys_eventfd
+sys_fallocate
+sys_timerfd_settime
+sys_timerfd_gettime
+sys_accept4
+sys_signalfd4
+sys_eventfd2
+sys_epoll_create1
+sys_dup3
+sys_pipe2
+sys_inotify_init1
+sys_preadv
+sys_pwritev
+sys_rt_tgsigqueueinfo
+sys_perf_event_open
+sys_recvmmsg
+
+Syscall_0:
+sys_read
+
+=== END OF SYSCALL TABLE ===
+*) The line number corresponds to syscall number
+
+syscall table is in include/asm-x86/unistd_64.h
diff -ruNp linux-2.6.34.5/fs/aio.c linux-2.6.34.5-cher1/fs/aio.c
--- linux-2.6.34.5/fs/aio.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/aio.c	2010-08-26 14:45:12.247567342 +0400
@@ -1248,6 +1248,9 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_e
 	unsigned long ctx;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	ret = get_user(ctx, ctxp);
 	if (unlikely(ret))
 		goto out;
@@ -1282,7 +1285,13 @@ out:
  */
 SYSCALL_DEFINE1(io_destroy, aio_context_t, ctx)
 {
-	struct kioctx *ioctx = lookup_ioctx(ctx);
+	struct kioctx *ioctx;
+
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
+	ioctx = lookup_ioctx(ctx);
+
 	if (likely(NULL != ioctx)) {
 		io_destroy(ioctx);
 		return 0;
@@ -1711,6 +1720,9 @@ long do_io_submit(aio_context_t ctx_id, 
 SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr,
 		struct iocb __user * __user *, iocbpp)
 {
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	return do_io_submit(ctx_id, nr, iocbpp, 0);
 }
 
@@ -1752,6 +1764,9 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t
 	u32 key;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	ret = get_user(key, &iocb->aio_key);
 	if (unlikely(ret))
 		return -EFAULT;
@@ -1811,9 +1826,14 @@ SYSCALL_DEFINE5(io_getevents, aio_contex
 		struct io_event __user *, events,
 		struct timespec __user *, timeout)
 {
-	struct kioctx *ioctx = lookup_ioctx(ctx_id);
+	struct kioctx *ioctx;
 	long ret = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
+	ioctx = lookup_ioctx(ctx_id);
+
 	if (likely(ioctx)) {
 		if (likely(min_nr <= nr && min_nr >= 0 && nr >= 0))
 			ret = read_events(ioctx, min_nr, nr, events, timeout);
diff -ruNp linux-2.6.34.5/fs/binfmt_aout.c linux-2.6.34.5-cher1/fs/binfmt_aout.c
--- linux-2.6.34.5/fs/binfmt_aout.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/binfmt_aout.c	2010-08-26 14:45:12.256584401 +0400
@@ -238,8 +238,12 @@ static int load_aout_binary(struct linux
 	rlim = rlimit(RLIMIT_DATA);
 	if (rlim >= RLIM_INFINITY)
 		rlim = ~0;
-	if (ex.a_data + ex.a_bss > rlim)
+	if (ex.a_data + ex.a_bss > rlim) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+		}
 		return -ENOMEM;
+	}
 
 	/* Flush all traces of the currently running executable */
 	retval = flush_old_exec(bprm);
diff -ruNp linux-2.6.34.5/fs/binfmt_flat.c linux-2.6.34.5-cher1/fs/binfmt_flat.c
--- linux-2.6.34.5/fs/binfmt_flat.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/binfmt_flat.c	2010-08-26 14:45:12.257563520 +0400
@@ -505,6 +505,9 @@ static int load_flat_file(struct linux_b
 	if (rlim >= RLIM_INFINITY)
 		rlim = ~0;
 	if (data_len + bss_len > rlim) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+		}
 		ret = -ENOMEM;
 		goto err;
 	}
diff -ruNp linux-2.6.34.5/fs/buffer.c linux-2.6.34.5-cher1/fs/buffer.c
--- linux-2.6.34.5/fs/buffer.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/buffer.c	2010-08-26 14:45:12.260572394 +0400
@@ -3214,6 +3214,11 @@ SYSCALL_DEFINE2(bdflush, int, func, long
 {
 	static int msg_count;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+	}
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
diff -ruNp linux-2.6.34.5/fs/compat.c linux-2.6.34.5-cher1/fs/compat.c
--- linux-2.6.34.5/fs/compat.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/compat.c	2010-08-26 14:45:12.269562073 +0400
@@ -80,6 +80,11 @@ asmlinkage long compat_sys_utime(char __
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (t) {
 		if (get_user(tv[0].tv_sec, &t->actime) ||
 		    get_user(tv[1].tv_sec, &t->modtime))
@@ -94,6 +99,11 @@ asmlinkage long compat_sys_utimensat(uns
 {
 	struct timespec tv[2];
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if  (t) {
 		if (get_compat_timespec(&tv[0], &t[0]) ||
 		    get_compat_timespec(&tv[1], &t[1]))
@@ -109,6 +119,11 @@ asmlinkage long compat_sys_futimesat(uns
 {
 	struct timespec tv[2];
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+	}
+
 	if (t) {
 		if (get_user(tv[0].tv_sec, &t[0].tv_sec) ||
 		    get_user(tv[0].tv_nsec, &t[0].tv_usec) ||
@@ -174,6 +189,9 @@ asmlinkage long compat_sys_newstat(char 
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	error = vfs_stat(filename, &stat);
 	if (error)
 		return error;
@@ -186,6 +204,9 @@ asmlinkage long compat_sys_newlstat(char
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	error = vfs_lstat(filename, &stat);
 	if (error)
 		return error;
@@ -199,6 +220,11 @@ asmlinkage long compat_sys_newfstatat(un
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+	}
+
 	error = vfs_fstatat(dfd, filename, &stat, flag);
 	if (error)
 		return error;
@@ -210,7 +236,14 @@ asmlinkage long compat_sys_newfstat(unsi
 		struct compat_stat __user * statbuf)
 {
 	struct kstat stat;
-	int error = vfs_fstat(fd, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+	}
+
+	error = vfs_fstat(fd, &stat);
 
 	if (!error)
 		error = cp_compat_stat(&stat, statbuf);
@@ -263,6 +296,11 @@ asmlinkage long compat_sys_statfs(const 
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	error = user_path(pathname, &path);
 	if (!error) {
 		struct kstatfs tmp;
@@ -280,6 +318,11 @@ asmlinkage long compat_sys_fstatfs(unsig
 	struct kstatfs tmp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+        }
+
 	error = -EBADF;
 	file = fget(fd);
 	if (!file)
@@ -328,6 +371,11 @@ asmlinkage long compat_sys_statfs64(cons
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -348,6 +396,11 @@ asmlinkage long compat_sys_fstatfs64(uns
 	struct kstatfs tmp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+        }
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -375,6 +428,11 @@ asmlinkage long compat_sys_ustat(unsigne
 	struct kstatfs sbuf;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	sb = user_get_super(new_decode_dev(dev));
 	if (!sb)
 		return -EINVAL;
@@ -450,6 +508,9 @@ asmlinkage long compat_sys_fcntl64(unsig
 	struct flock f;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	switch (cmd) {
 	case F_GETLK:
 	case F_SETLK:
@@ -515,6 +576,9 @@ asmlinkage long compat_sys_fcntl64(unsig
 asmlinkage long compat_sys_fcntl(unsigned int fd, unsigned int cmd,
 		unsigned long arg)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if ((cmd == F_GETLK64) || (cmd == F_SETLK64) || (cmd == F_SETLKW64))
 		return -EINVAL;
 	return compat_sys_fcntl64(fd, cmd, arg);
@@ -525,8 +589,14 @@ compat_sys_io_setup(unsigned nr_reqs, u3
 {
 	long ret;
 	aio_context_t ctx64;
+	mm_segment_t oldfs;
+
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
 
-	mm_segment_t oldfs = get_fs();
+        oldfs = get_fs();
 	if (unlikely(get_user(ctx64, ctx32p)))
 		return -EFAULT;
 
@@ -551,6 +621,11 @@ compat_sys_io_getevents(aio_context_t ct
 	struct timespec t;
 	struct timespec __user *ut = NULL;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+	}
+
 	ret = -EFAULT;
 	if (unlikely(!access_ok(VERIFY_WRITE, events, 
 				nr * sizeof(struct io_event))))
@@ -664,6 +739,11 @@ compat_sys_io_submit(aio_context_t ctx_i
 	struct iocb __user * __user *iocb64; 
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (unlikely(nr < 0))
 		return -EINVAL;
 
@@ -846,6 +926,11 @@ asmlinkage long compat_sys_mount(char __
 	char *dir_page;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+	}
+
 	retval = copy_mount_string(type, &kernel_type);
 	if (retval < 0)
 		goto out;
@@ -944,6 +1029,11 @@ asmlinkage long compat_sys_old_readdir(u
 	struct file *file;
 	struct compat_readdir_callback buf;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+	}
+
 	error = -EBADF;
 	file = fget(fd);
 	if (!file)
@@ -1025,6 +1115,11 @@ asmlinkage long compat_sys_getdents(unsi
 	struct compat_getdents_callback buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	error = -EFAULT;
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		goto out;
@@ -1113,6 +1208,11 @@ asmlinkage long compat_sys_getdents64(un
 	struct compat_getdents_callback64 buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = -EFAULT;
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		goto out;
@@ -1232,6 +1332,11 @@ compat_sys_readv(unsigned long fd, const
 	int fput_needed;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+        }
+
 	file = fget_light(fd, &fput_needed);
 	if (!file)
 		return -EBADF;
@@ -1249,6 +1354,11 @@ compat_sys_preadv(unsigned long fd, cons
 	int fput_needed;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+        }
+
 	if (pos < 0)
 		return -EINVAL;
 	file = fget_light(fd, &fput_needed);
@@ -1289,6 +1399,11 @@ compat_sys_writev(unsigned long fd, cons
 	int fput_needed;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+        }
+
 	file = fget_light(fd, &fput_needed);
 	if (!file)
 		return -EBADF;
@@ -1306,6 +1421,11 @@ compat_sys_pwritev(unsigned long fd, con
 	int fput_needed;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+        }
+
 	if (pos < 0)
 		return -EINVAL;
 	file = fget_light(fd, &fput_needed);
@@ -1322,6 +1442,12 @@ compat_sys_vmsplice(int fd, const struct
 {
 	unsigned i;
 	struct iovec __user *iov;
+
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+        }
+
 	if (nr_segs > UIO_MAXIOV)
 		return -EINVAL;
 	iov = compat_alloc_user_space(nr_segs * sizeof(struct iovec));
@@ -1353,6 +1479,11 @@ compat_sys_open(const char __user *filen
 asmlinkage long
 compat_sys_openat(unsigned int dfd, const char __user *filename, int flags, int mode)
 {
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+        }
+
 	return do_sys_open(dfd, filename, flags, mode);
 }
 
@@ -2146,6 +2277,11 @@ asmlinkage long compat_sys_nfsservctl(in
 	mm_segment_t oldfs;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+        }
+
 	karg = kmalloc(sizeof(*karg), GFP_USER);
 	kres = kmalloc(sizeof(*kres), GFP_USER);
 	if(!karg || !kres) {
@@ -2272,6 +2408,11 @@ asmlinkage long compat_sys_signalfd4(int
 	sigset_t tmp;
 	sigset_t __user *ksigmask;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+        }
+
 	if (sigsetsize != sizeof(compat_sigset_t))
 		return -EINVAL;
 	if (copy_from_user(&ss32, sigmask, sizeof(ss32)))
@@ -2302,6 +2443,11 @@ asmlinkage long compat_sys_timerfd_setti
 	struct itimerspec t;
 	struct itimerspec __user *ut;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+        }
+
 	if (get_compat_itimerspec(&t, utmr))
 		return -EFAULT;
 	ut = compat_alloc_user_space(2 * sizeof(struct itimerspec));
@@ -2322,6 +2468,11 @@ asmlinkage long compat_sys_timerfd_getti
 	struct itimerspec t;
 	struct itimerspec __user *ut;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+        }
+
 	ut = compat_alloc_user_space(sizeof(struct itimerspec));
 	error = sys_timerfd_gettime(ufd, ut);
 	if (!error)
diff -ruNp linux-2.6.34.5/fs/compat_ioctl.c linux-2.6.34.5-cher1/fs/compat_ioctl.c
--- linux-2.6.34.5/fs/compat_ioctl.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/compat_ioctl.c	2010-08-26 14:45:12.276562085 +0400
@@ -1681,6 +1681,9 @@ asmlinkage long compat_sys_ioctl(unsigne
 	int error = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	filp = fget_light(fd, &fput_needed);
 	if (!filp)
 		goto out;
diff -ruNp linux-2.6.34.5/fs/dcache.c linux-2.6.34.5-cher1/fs/dcache.c
--- linux-2.6.34.5/fs/dcache.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/dcache.c	2010-08-26 14:45:12.277567604 +0400
@@ -2106,7 +2106,14 @@ SYSCALL_DEFINE2(getcwd, char __user *, b
 {
 	int error;
 	struct path pwd, root;
-	char *page = (char *) __get_free_page(GFP_USER);
+	char *page;
+
+        if (SBOX_IS_RESTRICTED()) {
+		copy_to_user(buf, "/SANDBOX", 9);
+                return 9;
+	}
+
+        page = (char *) __get_free_page(GFP_USER);
 
 	if (!page)
 		return -ENOMEM;
diff -ruNp linux-2.6.34.5/fs/dcookies.c linux-2.6.34.5-cher1/fs/dcookies.c
--- linux-2.6.34.5/fs/dcookies.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/dcookies.c	2010-08-26 14:45:12.277567604 +0400
@@ -25,6 +25,7 @@
 #include <linux/dcookies.h>
 #include <linux/mutex.h>
 #include <linux/path.h>
+#include <linux/sched.h>
 #include <asm/uaccess.h>
 
 /* The dcookies are allocated from a kmem_cache and
@@ -154,6 +155,9 @@ SYSCALL_DEFINE(lookup_dcookie)(u64 cooki
 	size_t pathlen;
 	struct dcookie_struct * dcs;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	/* we could leak path information to users
 	 * without dir read permission without this
 	 */
diff -ruNp linux-2.6.34.5/fs/eventfd.c linux-2.6.34.5-cher1/fs/eventfd.c
--- linux-2.6.34.5/fs/eventfd.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/eventfd.c	2010-08-26 14:45:12.278567325 +0400
@@ -411,6 +411,9 @@ SYSCALL_DEFINE2(eventfd2, unsigned int, 
 	int fd, error;
 	struct file *file;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	error = get_unused_fd_flags(flags & EFD_SHARED_FCNTL_FLAGS);
 	if (error < 0)
 		return error;
diff -ruNp linux-2.6.34.5/fs/eventpoll.c linux-2.6.34.5-cher1/fs/eventpoll.c
--- linux-2.6.34.5/fs/eventpoll.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/eventpoll.c	2010-08-26 14:45:12.278567325 +0400
@@ -1190,6 +1190,9 @@ SYSCALL_DEFINE1(epoll_create1, int, flag
 	int error;
 	struct eventpoll *ep = NULL;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	/* Check the EPOLL_* constant for consistency.  */
 	BUILD_BUG_ON(EPOLL_CLOEXEC != O_CLOEXEC);
 
@@ -1215,6 +1218,9 @@ SYSCALL_DEFINE1(epoll_create1, int, flag
 
 SYSCALL_DEFINE1(epoll_create, int, size)
 {
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	if (size <= 0)
 		return -EINVAL;
 
@@ -1235,6 +1241,9 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, in
 	struct epitem *epi;
 	struct epoll_event epds;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	error = -EFAULT;
 	if (ep_op_has_event(op) &&
 	    copy_from_user(&epds, event, sizeof(struct epoll_event)))
@@ -1325,6 +1334,9 @@ SYSCALL_DEFINE4(epoll_wait, int, epfd, s
 	struct file *file;
 	struct eventpoll *ep;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	/* The maximum number of event must be greater than zero */
 	if (maxevents <= 0 || maxevents > EP_MAX_EVENTS)
 		return -EINVAL;
@@ -1378,6 +1390,9 @@ SYSCALL_DEFINE6(epoll_pwait, int, epfd, 
 	int error;
 	sigset_t ksigmask, sigsaved;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	/*
 	 * If the caller wants a certain signal mask to be set during the wait,
 	 * we apply it here.
diff -ruNp linux-2.6.34.5/fs/exec.c linux-2.6.34.5-cher1/fs/exec.c
--- linux-2.6.34.5/fs/exec.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/exec.c	2010-08-26 14:45:12.279562788 +0400
@@ -107,8 +107,14 @@ static inline void put_binfmt(struct lin
 SYSCALL_DEFINE1(uselib, const char __user *, library)
 {
 	struct file *file;
-	char *tmp = getname(library);
-	int error = PTR_ERR(tmp);
+	char *tmp = NULL;
+	int error = -EPERM;
+
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
+        tmp = getname(library);
+        error = PTR_ERR(tmp);
 
 	if (IS_ERR(tmp))
 		goto out;
diff -ruNp linux-2.6.34.5/fs/fcntl.c linux-2.6.34.5-cher1/fs/fcntl.c
--- linux-2.6.34.5/fs/fcntl.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/fcntl.c	2010-08-26 14:45:12.280567539 +0400
@@ -56,6 +56,9 @@ SYSCALL_DEFINE3(dup3, unsigned int, oldf
 	struct files_struct * files = current->files;
 	struct fdtable *fdt;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if ((flags & ~O_CLOEXEC) != 0)
 		return -EINVAL;
 
@@ -114,6 +117,9 @@ out_unlock:
 
 SYSCALL_DEFINE2(dup2, unsigned int, oldfd, unsigned int, newfd)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (unlikely(newfd == oldfd)) { /* corner case */
 		struct files_struct *files = current->files;
 		int retval = oldfd;
@@ -130,8 +136,12 @@ SYSCALL_DEFINE2(dup2, unsigned int, oldf
 SYSCALL_DEFINE1(dup, unsigned int, fildes)
 {
 	int ret = -EBADF;
-	struct file *file = fget(fildes);
+	struct file *file = NULL;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
+	file = fget(fildes);
 	if (file) {
 		ret = get_unused_fd();
 		if (ret >= 0)
@@ -423,6 +433,9 @@ SYSCALL_DEFINE3(fcntl, unsigned int, fd,
 	struct file *filp;
 	long err = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	filp = fget(fd);
 	if (!filp)
 		goto out;
@@ -447,6 +460,9 @@ SYSCALL_DEFINE3(fcntl64, unsigned int, f
 	struct file * filp;
 	long err;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	err = -EBADF;
 	filp = fget(fd);
 	if (!filp)
diff -ruNp linux-2.6.34.5/fs/filesystems.c linux-2.6.34.5-cher1/fs/filesystems.c
--- linux-2.6.34.5/fs/filesystems.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/filesystems.c	2010-08-26 14:45:12.280567539 +0400
@@ -14,6 +14,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/sched.h>
 #include <asm/uaccess.h>
 
 /*
@@ -183,6 +184,11 @@ SYSCALL_DEFINE3(sysfs, int, option, unsi
 {
 	int retval = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+	}
+
 	switch (option) {
 		case 1:
 			retval = fs_index((const char __user *) arg1);
diff -ruNp linux-2.6.34.5/fs/ioctl.c linux-2.6.34.5-cher1/fs/ioctl.c
--- linux-2.6.34.5/fs/ioctl.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/ioctl.c	2010-08-26 14:45:12.281562303 +0400
@@ -627,6 +627,9 @@ SYSCALL_DEFINE3(ioctl, unsigned int, fd,
 	int error = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	filp = fget_light(fd, &fput_needed);
 	if (!filp)
 		goto out;
diff -ruNp linux-2.6.34.5/fs/ioprio.c linux-2.6.34.5-cher1/fs/ioprio.c
--- linux-2.6.34.5/fs/ioprio.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/ioprio.c	2010-08-26 14:45:12.281562303 +0400
@@ -82,6 +82,11 @@ SYSCALL_DEFINE3(ioprio_set, int, which, 
 	struct pid *pgrp;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	switch (class) {
 		case IOPRIO_CLASS_RT:
 			if (!capable(CAP_SYS_ADMIN))
@@ -197,6 +202,11 @@ SYSCALL_DEFINE2(ioprio_get, int, which, 
 	int ret = -ESRCH;
 	int tmpio;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	read_lock(&tasklist_lock);
 	switch (which) {
 		case IOPRIO_WHO_PROCESS:
diff -ruNp linux-2.6.34.5/fs/locks.c linux-2.6.34.5-cher1/fs/locks.c
--- linux-2.6.34.5/fs/locks.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/locks.c	2010-08-26 14:45:12.282557206 +0400
@@ -1573,6 +1573,11 @@ SYSCALL_DEFINE2(flock, unsigned int, fd,
 	int can_sleep, unlock;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = -EBADF;
 	filp = fget(fd);
 	if (!filp)
diff -ruNp linux-2.6.34.5/fs/namei.c linux-2.6.34.5-cher1/fs/namei.c
--- linux-2.6.34.5/fs/namei.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/namei.c	2010-08-26 14:45:12.283567544 +0400
@@ -2016,6 +2016,11 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
 	struct dentry *dentry;
 	struct nameidata nd;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (S_ISDIR(mode))
 		return -EPERM;
 
@@ -2096,6 +2101,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
 	struct dentry *dentry;
 	struct nameidata nd;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_parent(dfd, pathname, &nd, &tmp);
 	if (error)
 		goto out_err;
@@ -2242,6 +2252,11 @@ exit1:
 
 SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
 {
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_rmdir(AT_FDCWD, pathname);
 }
 
@@ -2339,6 +2354,11 @@ slashes:
 
 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
 {
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((flag & ~AT_REMOVEDIR) != 0)
 		return -EINVAL;
 
@@ -2350,6 +2370,11 @@ SYSCALL_DEFINE3(unlinkat, int, dfd, cons
 
 SYSCALL_DEFINE1(unlink, const char __user *, pathname)
 {
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_unlinkat(AT_FDCWD, pathname);
 }
 
@@ -2382,6 +2407,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
 	struct dentry *dentry;
 	struct nameidata nd;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	from = getname(oldname);
 	if (IS_ERR(from))
 		return PTR_ERR(from);
@@ -2475,6 +2505,11 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
 	int error;
 	char *to;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((flags & ~AT_SYMLINK_FOLLOW) != 0)
 		return -EINVAL;
 
@@ -2678,6 +2713,11 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
 	char *to;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path_parent(olddfd, oldname, &oldnd, &from);
 	if (error)
 		goto exit;
diff -ruNp linux-2.6.34.5/fs/namespace.c linux-2.6.34.5-cher1/fs/namespace.c
--- linux-2.6.34.5/fs/namespace.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/namespace.c	2010-08-26 14:45:12.290562178 +0400
@@ -1138,6 +1138,11 @@ SYSCALL_DEFINE2(umount, char __user *, n
 	int retval;
 	int lookup_flags = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
 		return -EINVAL;
 
@@ -2136,6 +2141,11 @@ SYSCALL_DEFINE5(mount, char __user *, de
 	char *kernel_dev;
 	unsigned long data_page;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ret = copy_mount_string(type, &kernel_type);
 	if (ret < 0)
 		goto out_type;
@@ -2200,6 +2210,11 @@ SYSCALL_DEFINE2(pivot_root, const char _
 	struct path new, old, parent_path, root_parent, root;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
diff -ruNp linux-2.6.34.5/fs/nfsctl.c linux-2.6.34.5-cher1/fs/nfsctl.c
--- linux-2.6.34.5/fs/nfsctl.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/nfsctl.c	2010-08-26 14:45:12.301724788 +0400
@@ -91,6 +91,11 @@ SYSCALL_DEFINE3(nfsservctl, int, cmd, st
 	int version;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_from_user(&version, &arg->ca_version, sizeof(int)))
 		return -EFAULT;
 
diff -ruNp linux-2.6.34.5/fs/notify/inotify/inotify_user.c linux-2.6.34.5-cher1/fs/notify/inotify/inotify_user.c
--- linux-2.6.34.5/fs/notify/inotify/inotify_user.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/notify/inotify/inotify_user.c	2010-08-26 14:45:12.302567505 +0400
@@ -643,6 +643,11 @@ SYSCALL_DEFINE1(inotify_init1, int, flag
 	struct user_struct *user;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Check the IN_* constants for consistency.  */
 	BUILD_BUG_ON(IN_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(IN_NONBLOCK != O_NONBLOCK);
@@ -692,6 +697,11 @@ SYSCALL_DEFINE3(inotify_add_watch, int, 
 	int ret, fput_needed;
 	unsigned flags = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	filp = fget_light(fd, &fput_needed);
 	if (unlikely(!filp))
 		return -EBADF;
@@ -730,6 +740,11 @@ SYSCALL_DEFINE2(inotify_rm_watch, int, f
 	struct file *filp;
 	int ret = 0, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	filp = fget_light(fd, &fput_needed);
 	if (unlikely(!filp))
 		return -EBADF;
diff -ruNp linux-2.6.34.5/fs/open.c linux-2.6.34.5-cher1/fs/open.c
--- linux-2.6.34.5/fs/open.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/open.c	2010-08-26 14:45:12.303572466 +0400
@@ -130,6 +130,9 @@ SYSCALL_DEFINE2(statfs, const char __use
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	error = user_path(pathname, &path);
 	if (!error) {
 		struct statfs tmp;
@@ -146,6 +149,9 @@ SYSCALL_DEFINE3(statfs64, const char __u
 	struct path path;
 	long error;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 	error = user_path(pathname, &path);
@@ -165,6 +171,9 @@ SYSCALL_DEFINE2(fstatfs, unsigned int, f
 	struct statfs tmp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	error = -EBADF;
 	file = fget(fd);
 	if (!file)
@@ -183,6 +192,9 @@ SYSCALL_DEFINE3(fstatfs64, unsigned int,
 	struct statfs64 tmp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -292,6 +304,9 @@ out:
 
 SYSCALL_DEFINE2(truncate, const char __user *, path, long, length)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	return do_sys_truncate(path, length);
 }
 
@@ -343,7 +358,12 @@ out:
 
 SYSCALL_DEFINE2(ftruncate, unsigned int, fd, unsigned long, length)
 {
-	long ret = do_sys_ftruncate(fd, length, 1);
+        long ret;
+
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
+	ret = do_sys_ftruncate(fd, length, 1);
 	/* avoid REGPARM breakage on x86: */
 	asmlinkage_protect(2, ret, fd, length);
 	return ret;
@@ -353,11 +373,17 @@ SYSCALL_DEFINE2(ftruncate, unsigned int,
 #if BITS_PER_LONG == 32
 SYSCALL_DEFINE(truncate64)(const char __user * path, loff_t length)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	return do_sys_truncate(path, length);
 }
 #ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
 asmlinkage long SyS_truncate64(long path, loff_t length)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	return SYSC_truncate64((const char __user *) path, length);
 }
 SYSCALL_ALIAS(sys_truncate64, SyS_truncate64);
@@ -365,7 +391,12 @@ SYSCALL_ALIAS(sys_truncate64, SyS_trunca
 
 SYSCALL_DEFINE(ftruncate64)(unsigned int fd, loff_t length)
 {
-	long ret = do_sys_ftruncate(fd, length, 0);
+        long ret;
+
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
+	ret = do_sys_ftruncate(fd, length, 0);
 	/* avoid REGPARM breakage on x86: */
 	asmlinkage_protect(2, ret, fd, length);
 	return ret;
@@ -373,6 +404,9 @@ SYSCALL_DEFINE(ftruncate64)(unsigned int
 #ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
 asmlinkage long SyS_ftruncate64(long fd, loff_t length)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	return SYSC_ftruncate64((unsigned int) fd, length);
 }
 SYSCALL_ALIAS(sys_ftruncate64, SyS_ftruncate64);
@@ -427,6 +461,9 @@ SYSCALL_DEFINE(fallocate)(int fd, int mo
 	struct file *file;
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	file = fget(fd);
 	if (file) {
 		error = do_fallocate(file, mode, offset, len);
@@ -439,6 +476,9 @@ SYSCALL_DEFINE(fallocate)(int fd, int mo
 #ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
 asmlinkage long SyS_fallocate(long fd, long mode, loff_t offset, loff_t len)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	return SYSC_fallocate((int)fd, (int)mode, offset, len);
 }
 SYSCALL_ALIAS(sys_fallocate, SyS_fallocate);
@@ -457,6 +497,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
 	struct inode *inode;
 	int res;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (mode & ~S_IRWXO)	/* where's F_OK, X_OK, W_OK, R_OK? */
 		return -EINVAL;
 
@@ -529,6 +572,11 @@ SYSCALL_DEFINE1(chdir, const char __user
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+        	return -EPERM;
+	}
+
 	error = user_path_dir(filename, &path);
 	if (error)
 		goto out;
@@ -551,6 +599,11 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
 	struct inode *inode;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+        	return -EPERM;
+	}
+
 	error = -EBADF;
 	file = fget(fd);
 	if (!file)
@@ -576,6 +629,11 @@ SYSCALL_DEFINE1(chroot, const char __use
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+        	return -EPERM;
+	}
+
 	error = user_path_dir(filename, &path);
 	if (error)
 		goto out;
@@ -607,6 +665,11 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
 	int err = -EBADF;
 	struct iattr newattrs;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+        	return -EPERM;
+	}
+
 	file = fget(fd);
 	if (!file)
 		goto out;
@@ -644,6 +707,11 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
 	int error;
 	struct iattr newattrs;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+        	return -EPERM;
+	}
+
 	error = user_path_at(dfd, filename, LOOKUP_FOLLOW, &path);
 	if (error)
 		goto out;
@@ -707,6 +775,11 @@ SYSCALL_DEFINE3(chown, const char __user
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+        	return -EPERM;
+	}
+
 	error = user_path(filename, &path);
 	if (error)
 		goto out;
@@ -728,6 +801,11 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
 	int error = -EINVAL;
 	int follow;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+        	return -EPERM;
+	}
+
 	if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
 		goto out;
 
@@ -751,6 +829,11 @@ SYSCALL_DEFINE3(lchown, const char __use
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+        	return -EPERM;
+	}
+
 	error = user_lpath(filename, &path);
 	if (error)
 		goto out;
@@ -771,6 +854,11 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
 	int error = -EBADF;
 	struct dentry * dentry;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+        	return -EPERM;
+	}
+
 	file = fget(fd);
 	if (!file)
 		goto out;
@@ -1041,15 +1129,44 @@ void fd_install(unsigned int fd, struct 
 
 EXPORT_SYMBOL(fd_install);
 
+static int is_secure_path(const char *path)
+{
+	const char *s;
+
+	if (!strncmp(path, "/usr/lib/", 9) || !strncmp(path, "/lib/", 5)) {
+		if (strstr(path, ".."))
+			return -1;
+		return 0;
+	}
+
+	if (!strncmp(path, "/SANDBOX/", 9)) path += 9;
+	s = path;
+	while (s[0] == '.' && s[1] == '/') s += 2;
+	for (; *s && *s != '/'; s++);
+	if (*s == '/') return -1;
+	return 0;
+}
+
 long do_sys_open(int dfd, const char __user *filename, int flags, int mode)
 {
 	char *tmp = getname(filename);
-	int fd = PTR_ERR(tmp);
+        char *tmpname = tmp;
+	int fd;
+
+        if (!IS_ERR(tmp) && (current->sbox_flags & SBOX_NO_SYSCALLS)) {
+        	if (is_secure_path(tmp) < 0) {
+                	putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp, "/SANDBOX/", 9)) tmpname += 9;
+                flags &= ~(O_CREAT | O_EXCL);
+	}
 
+        fd = PTR_ERR(tmp);
 	if (!IS_ERR(tmp)) {
 		fd = get_unused_fd_flags(flags);
 		if (fd >= 0) {
-			struct file *f = do_filp_open(dfd, tmp, flags, mode, 0);
+			struct file *f = do_filp_open(dfd, tmpname, flags, mode, 0);
 			if (IS_ERR(f)) {
 				put_unused_fd(fd);
 				fd = PTR_ERR(f);
@@ -1081,6 +1198,9 @@ SYSCALL_DEFINE4(openat, int, dfd, const 
 {
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (force_o_largefile())
 		flags |= O_LARGEFILE;
 
@@ -1173,6 +1293,11 @@ EXPORT_SYMBOL(sys_close);
  */
 SYSCALL_DEFINE0(vhangup)
 {
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (capable(CAP_SYS_TTY_CONFIG)) {
 		tty_vhangup_self();
 		return 0;
diff -ruNp linux-2.6.34.5/fs/pipe.c linux-2.6.34.5-cher1/fs/pipe.c
--- linux-2.6.34.5/fs/pipe.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/pipe.c	2010-08-26 14:45:12.304562480 +0400
@@ -1077,6 +1077,11 @@ SYSCALL_DEFINE2(pipe2, int __user *, fil
 	int fd[2];
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = do_pipe_flags(fd, flags);
 	if (!error) {
 		if (copy_to_user(fildes, fd, sizeof(fd))) {
diff -ruNp linux-2.6.34.5/fs/proc/base.c linux-2.6.34.5-cher1/fs/proc/base.c
--- linux-2.6.34.5/fs/proc/base.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/proc/base.c	2010-08-26 14:45:12.305572540 +0400
@@ -476,6 +476,10 @@ static const struct limit_names lnames[R
 	[RLIMIT_NICE] = {"Max nice priority", NULL},
 	[RLIMIT_RTPRIO] = {"Max realtime priority", NULL},
 	[RLIMIT_RTTIME] = {"Max realtime timeout", "us"},
+        [RLIMIT_FUTURE1] = {"Future use 1", NULL},
+        [RLIMIT_FUTURE2] = {"Future use 2", NULL},
+        [RLIMIT_FUTURE3] = {"Future use 3", NULL},
+        [RLIMIT_MCPU] = { "Max cpu time", "ms" },
 };
 
 /* Display limits for a process */
diff -ruNp linux-2.6.34.5/fs/quota/compat.c linux-2.6.34.5-cher1/fs/quota/compat.c
--- linux-2.6.34.5/fs/quota/compat.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/quota/compat.c	2010-08-26 14:45:12.316557123 +0400
@@ -52,6 +52,11 @@ asmlinkage long sys32_quotactl(unsigned 
 	u16 xdata;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	cmds = cmd >> SUBCMDSHIFT;
 
 	switch (cmds) {
diff -ruNp linux-2.6.34.5/fs/quota/quota.c linux-2.6.34.5-cher1/fs/quota/quota.c
--- linux-2.6.34.5/fs/quota/quota.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/quota/quota.c	2010-08-26 14:45:12.317578007 +0400
@@ -316,6 +316,11 @@ SYSCALL_DEFINE4(quotactl, unsigned int, 
 	struct super_block *sb = NULL;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	cmds = cmd >> SUBCMDSHIFT;
 	type = cmd & SUBCMDMASK;
 
diff -ruNp linux-2.6.34.5/fs/readdir.c linux-2.6.34.5-cher1/fs/readdir.c
--- linux-2.6.34.5/fs/readdir.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/readdir.c	2010-08-26 14:45:12.317578007 +0400
@@ -109,6 +109,9 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
 	struct file * file;
 	struct readdir_callback buf;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	error = -EBADF;
 	file = fget(fd);
 	if (!file)
@@ -196,6 +199,9 @@ SYSCALL_DEFINE3(getdents, unsigned int, 
 	struct getdents_callback buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	error = -EFAULT;
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		goto out;
@@ -278,6 +284,9 @@ SYSCALL_DEFINE3(getdents64, unsigned int
 	struct getdents_callback64 buf;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	error = -EFAULT;
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		goto out;
diff -ruNp linux-2.6.34.5/fs/read_write.c linux-2.6.34.5-cher1/fs/read_write.c
--- linux-2.6.34.5/fs/read_write.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/read_write.c	2010-08-26 14:45:12.318578009 +0400
@@ -153,6 +153,9 @@ SYSCALL_DEFINE3(lseek, unsigned int, fd,
 	struct file * file;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	retval = -EBADF;
 	file = fget_light(fd, &fput_needed);
 	if (!file)
@@ -180,6 +183,9 @@ SYSCALL_DEFINE5(llseek, unsigned int, fd
 	loff_t offset;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	retval = -EBADF;
 	file = fget_light(fd, &fput_needed);
 	if (!file)
@@ -413,6 +419,9 @@ SYSCALL_DEFINE(pread64)(unsigned int fd,
 	ssize_t ret = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -429,6 +438,9 @@ SYSCALL_DEFINE(pread64)(unsigned int fd,
 #ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
 asmlinkage long SyS_pread64(long fd, long buf, long count, loff_t pos)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	return SYSC_pread64((unsigned int) fd, (char __user *) buf,
 			    (size_t) count, pos);
 }
@@ -442,6 +454,9 @@ SYSCALL_DEFINE(pwrite64)(unsigned int fd
 	ssize_t ret = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -458,6 +473,9 @@ SYSCALL_DEFINE(pwrite64)(unsigned int fd
 #ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
 asmlinkage long SyS_pwrite64(long fd, long buf, long count, loff_t pos)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	return SYSC_pwrite64((unsigned int) fd, (const char __user *) buf,
 			     (size_t) count, pos);
 }
@@ -747,6 +765,9 @@ SYSCALL_DEFINE5(preadv, unsigned long, f
 	ssize_t ret = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -772,6 +793,9 @@ SYSCALL_DEFINE5(pwritev, unsigned long, 
 	ssize_t ret = -EBADF;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -883,6 +907,9 @@ SYSCALL_DEFINE4(sendfile, int, out_fd, i
 	off_t off;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (offset) {
 		if (unlikely(get_user(off, offset)))
 			return -EFAULT;
@@ -901,6 +928,9 @@ SYSCALL_DEFINE4(sendfile64, int, out_fd,
 	loff_t pos;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (offset) {
 		if (unlikely(copy_from_user(&pos, offset, sizeof(loff_t))))
 			return -EFAULT;
diff -ruNp linux-2.6.34.5/fs/signalfd.c linux-2.6.34.5-cher1/fs/signalfd.c
--- linux-2.6.34.5/fs/signalfd.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/signalfd.c	2010-08-26 14:45:12.326627887 +0400
@@ -214,6 +214,11 @@ SYSCALL_DEFINE4(signalfd4, int, ufd, sig
 	sigset_t sigmask;
 	struct signalfd_ctx *ctx;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Check the SFD_* constants for consistency.  */
 	BUILD_BUG_ON(SFD_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(SFD_NONBLOCK != O_NONBLOCK);
diff -ruNp linux-2.6.34.5/fs/splice.c linux-2.6.34.5-cher1/fs/splice.c
--- linux-2.6.34.5/fs/splice.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/splice.c	2010-08-26 14:45:12.328562170 +0400
@@ -1627,6 +1627,11 @@ SYSCALL_DEFINE4(vmsplice, int, fd, const
 	long error;
 	int fput;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (unlikely(nr_segs > UIO_MAXIOV))
 		return -EINVAL;
 	else if (unlikely(!nr_segs))
@@ -1654,6 +1659,11 @@ SYSCALL_DEFINE6(splice, int, fd_in, loff
 	struct file *in, *out;
 	int fput_in, fput_out;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (unlikely(!len))
 		return 0;
 
@@ -1994,6 +2004,11 @@ SYSCALL_DEFINE4(tee, int, fdin, int, fdo
 	struct file *in;
 	int error, fput_in;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (unlikely(!len))
 		return 0;
 
diff -ruNp linux-2.6.34.5/fs/stat.c linux-2.6.34.5-cher1/fs/stat.c
--- linux-2.6.34.5/fs/stat.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/stat.c	2010-08-26 14:45:12.328562170 +0400
@@ -147,11 +147,47 @@ static int cp_old_stat(struct kstat *sta
 	return copy_to_user(statbuf,&tmp,sizeof(tmp)) ? -EFAULT : 0;
 }
 
+static int is_secure_path(const char *path)
+{
+	const char *s;
+
+	if (!strncmp(path, "/usr/lib/", 9) || !strncmp(path, "/lib/", 5)) {
+		if (strstr(path, ".."))
+			return -1;
+		return 0;
+	}
+
+	if (!strncmp(path, "/SANDBOX/", 9)) path += 9;
+	s = path;
+	while (s[0] == '.' && s[1] == '/') s += 2;
+	for (; *s && *s != '/'; s++);
+	if (*s == '/') return -1;
+	return 0;
+}
+
+static int is_secure_stat(char __user *filename)
+{
+	if ((current->sbox_flags & SBOX_NO_SYSCALLS)) {
+		char *tmp = getname(filename);
+		if (IS_ERR(tmp)) return -EFAULT;
+		if (is_secure_path(tmp) < 0) {
+			putname(tmp);
+			return -EPERM;
+		}
+		putname(tmp);
+	}
+	return 0;
+}
+
 SYSCALL_DEFINE2(stat, char __user *, filename, struct __old_kernel_stat __user *, statbuf)
 {
 	struct kstat stat;
 	int error;
 
+        error = is_secure_stat(filename);
+        if (error)
+		return error;
+
 	error = vfs_stat(filename, &stat);
 	if (error)
 		return error;
@@ -164,6 +200,10 @@ SYSCALL_DEFINE2(lstat, char __user *, fi
 	struct kstat stat;
 	int error;
 
+        error = is_secure_stat(filename);
+        if (error)
+        	return error;
+
 	error = vfs_lstat(filename, &stat);
 	if (error)
 		return error;
@@ -174,8 +214,12 @@ SYSCALL_DEFINE2(lstat, char __user *, fi
 SYSCALL_DEFINE2(fstat, unsigned int, fd, struct __old_kernel_stat __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_fstat(fd, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
 
+        error = vfs_fstat(fd, &stat);
 	if (!error)
 		error = cp_old_stat(&stat, statbuf);
 
@@ -237,8 +281,13 @@ static int cp_new_stat(struct kstat *sta
 SYSCALL_DEFINE2(newstat, char __user *, filename, struct stat __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_stat(filename, &stat);
+	int error;
+
+        error = is_secure_stat(filename);
+        if (error)
+        	return error;
 
+        error = vfs_stat(filename, &stat);
 	if (error)
 		return error;
 	return cp_new_stat(&stat, statbuf);
@@ -249,6 +298,10 @@ SYSCALL_DEFINE2(newlstat, char __user *,
 	struct kstat stat;
 	int error;
 
+        error = is_secure_stat(filename);
+        if (error)
+        	return error;
+
 	error = vfs_lstat(filename, &stat);
 	if (error)
 		return error;
@@ -263,6 +316,9 @@ SYSCALL_DEFINE4(newfstatat, int, dfd, ch
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	error = vfs_fstatat(dfd, filename, &stat, flag);
 	if (error)
 		return error;
@@ -275,6 +331,9 @@ SYSCALL_DEFINE2(newfstat, unsigned int, 
 	struct kstat stat;
 	int error = vfs_fstat(fd, &stat);
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (!error)
 		error = cp_new_stat(&stat, statbuf);
 
@@ -287,6 +346,9 @@ SYSCALL_DEFINE4(readlinkat, int, dfd, co
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (bufsiz <= 0)
 		return -EINVAL;
 
@@ -358,8 +420,13 @@ static long cp_new_stat64(struct kstat *
 SYSCALL_DEFINE2(stat64, char __user *, filename, struct stat64 __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_stat(filename, &stat);
+	int error;
 
+        error = is_secure_stat(filename);
+        if (error)
+        	return error;
+
+        error = vfs_stat(filename, &stat);
 	if (!error)
 		error = cp_new_stat64(&stat, statbuf);
 
@@ -369,8 +436,13 @@ SYSCALL_DEFINE2(stat64, char __user *, f
 SYSCALL_DEFINE2(lstat64, char __user *, filename, struct stat64 __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_lstat(filename, &stat);
+	int error;
 
+        error = is_secure_stat(filename);
+        if (error)
+        	return error;
+
+        error = vfs_lstat(filename, &stat);
 	if (!error)
 		error = cp_new_stat64(&stat, statbuf);
 
@@ -380,8 +452,12 @@ SYSCALL_DEFINE2(lstat64, char __user *, 
 SYSCALL_DEFINE2(fstat64, unsigned long, fd, struct stat64 __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_fstat(fd, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
 
+        error = vfs_fstat(fd, &stat);
 	if (!error)
 		error = cp_new_stat64(&stat, statbuf);
 
@@ -394,6 +470,9 @@ SYSCALL_DEFINE4(fstatat64, int, dfd, cha
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	error = vfs_fstatat(dfd, filename, &stat, flag);
 	if (error)
 		return error;
diff -ruNp linux-2.6.34.5/fs/super.c linux-2.6.34.5-cher1/fs/super.c
--- linux-2.6.34.5/fs/super.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/super.c	2010-08-26 14:45:12.329557004 +0400
@@ -540,6 +540,9 @@ SYSCALL_DEFINE2(ustat, unsigned, dev, st
         struct kstatfs sbuf;
 	int err = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
         s = user_get_super(new_decode_dev(dev));
         if (s == NULL)
                 goto out;
diff -ruNp linux-2.6.34.5/fs/sync.c linux-2.6.34.5-cher1/fs/sync.c
--- linux-2.6.34.5/fs/sync.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/sync.c	2010-08-26 14:45:12.329557004 +0400
@@ -129,6 +129,9 @@ restart:
  */
 SYSCALL_DEFINE0(sync)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	wakeup_flusher_threads(0);
 	sync_filesystems(0);
 	sync_filesystems(1);
@@ -279,11 +282,17 @@ static int do_fsync(unsigned int fd, int
 
 SYSCALL_DEFINE1(fsync, unsigned int, fd)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	return do_fsync(fd, 0);
 }
 
 SYSCALL_DEFINE1(fdatasync, unsigned int, fd)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	return do_fsync(fd, 1);
 }
 
@@ -362,6 +371,9 @@ SYSCALL_DEFINE(sync_file_range)(int fd, 
 	int fput_needed;
 	umode_t i_mode;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	ret = -EINVAL;
 	if (flags & ~VALID_FLAGS)
 		goto out;
@@ -439,6 +451,9 @@ out:
 asmlinkage long SyS_sync_file_range(long fd, loff_t offset, loff_t nbytes,
 				    long flags)
 {
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	return SYSC_sync_file_range((int) fd, offset, nbytes,
 				    (unsigned int) flags);
 }
diff -ruNp linux-2.6.34.5/fs/timerfd.c linux-2.6.34.5-cher1/fs/timerfd.c
--- linux-2.6.34.5/fs/timerfd.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/timerfd.c	2010-08-26 14:45:12.330575305 +0400
@@ -183,6 +183,11 @@ SYSCALL_DEFINE2(timerfd_create, int, clo
 	int ufd;
 	struct timerfd_ctx *ctx;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Check the TFD_* constants for consistency.  */
 	BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(TFD_NONBLOCK != O_NONBLOCK);
@@ -216,6 +221,11 @@ SYSCALL_DEFINE4(timerfd_settime, int, uf
 	struct timerfd_ctx *ctx;
 	struct itimerspec ktmr, kotmr;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_from_user(&ktmr, utmr, sizeof(ktmr)))
 		return -EFAULT;
 
@@ -272,6 +282,11 @@ SYSCALL_DEFINE2(timerfd_gettime, int, uf
 	struct timerfd_ctx *ctx;
 	struct itimerspec kotmr;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	file = timerfd_fget(ufd);
 	if (IS_ERR(file))
 		return PTR_ERR(file);
diff -ruNp linux-2.6.34.5/fs/utimes.c linux-2.6.34.5-cher1/fs/utimes.c
--- linux-2.6.34.5/fs/utimes.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/utimes.c	2010-08-26 14:45:12.330575305 +0400
@@ -28,6 +28,11 @@ SYSCALL_DEFINE2(utime, char __user *, fi
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (times) {
 		if (get_user(tv[0].tv_sec, &times->actime) ||
 		    get_user(tv[1].tv_sec, &times->modtime))
@@ -175,6 +180,11 @@ SYSCALL_DEFINE4(utimensat, int, dfd, cha
 {
 	struct timespec tstimes[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (utimes) {
 		if (copy_from_user(&tstimes, utimes, sizeof(tstimes)))
 			return -EFAULT;
@@ -194,6 +204,11 @@ SYSCALL_DEFINE3(futimesat, int, dfd, cha
 	struct timeval times[2];
 	struct timespec tstimes[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (utimes) {
 		if (copy_from_user(&times, utimes, sizeof(times)))
 			return -EFAULT;
diff -ruNp linux-2.6.34.5/fs/xattr.c linux-2.6.34.5-cher1/fs/xattr.c
--- linux-2.6.34.5/fs/xattr.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/fs/xattr.c	2010-08-26 14:45:12.331562456 +0400
@@ -283,6 +283,11 @@ SYSCALL_DEFINE5(setxattr, const char __u
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path(pathname, &path);
 	if (error)
 		return error;
@@ -302,6 +307,11 @@ SYSCALL_DEFINE5(lsetxattr, const char __
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_lpath(pathname, &path);
 	if (error)
 		return error;
@@ -321,6 +331,11 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
 	struct dentry *dentry;
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	f = fget(fd);
 	if (!f)
 		return error;
@@ -379,6 +394,11 @@ SYSCALL_DEFINE4(getxattr, const char __u
 	struct path path;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path(pathname, &path);
 	if (error)
 		return error;
@@ -393,6 +413,11 @@ SYSCALL_DEFINE4(lgetxattr, const char __
 	struct path path;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_lpath(pathname, &path);
 	if (error)
 		return error;
@@ -407,6 +432,11 @@ SYSCALL_DEFINE4(fgetxattr, int, fd, cons
 	struct file *f;
 	ssize_t error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	f = fget(fd);
 	if (!f)
 		return error;
@@ -452,6 +482,11 @@ SYSCALL_DEFINE3(listxattr, const char __
 	struct path path;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path(pathname, &path);
 	if (error)
 		return error;
@@ -466,6 +501,11 @@ SYSCALL_DEFINE3(llistxattr, const char _
 	struct path path;
 	ssize_t error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_lpath(pathname, &path);
 	if (error)
 		return error;
@@ -479,6 +519,11 @@ SYSCALL_DEFINE3(flistxattr, int, fd, cha
 	struct file *f;
 	ssize_t error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	f = fget(fd);
 	if (!f)
 		return error;
@@ -512,6 +557,11 @@ SYSCALL_DEFINE2(removexattr, const char 
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_path(pathname, &path);
 	if (error)
 		return error;
@@ -530,6 +580,11 @@ SYSCALL_DEFINE2(lremovexattr, const char
 	struct path path;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = user_lpath(pathname, &path);
 	if (error)
 		return error;
@@ -548,6 +603,11 @@ SYSCALL_DEFINE2(fremovexattr, int, fd, c
 	struct dentry *dentry;
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	f = fget(fd);
 	if (!f)
 		return error;
diff -ruNp linux-2.6.34.5/include/asm-generic/resource.h linux-2.6.34.5-cher1/include/asm-generic/resource.h
--- linux-2.6.34.5/include/asm-generic/resource.h	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/include/asm-generic/resource.h	2010-08-26 14:45:12.331562456 +0400
@@ -45,7 +45,11 @@
 					   0-39 for nice level 19 .. -20 */
 #define RLIMIT_RTPRIO		14	/* maximum realtime priority */
 #define RLIMIT_RTTIME		15	/* timeout for RT tasks in us */
-#define RLIM_NLIMITS		16
+#define RLIMIT_FUTURE1          16      /* for future use */
+#define RLIMIT_FUTURE2          17      /* for future use */
+#define RLIMIT_FUTURE3          18      /* for future use */
+#define RLIMIT_MCPU             19      /* millisecond cpu limit */
+#define RLIM_NLIMITS		20
 
 /*
  * SuS says limits have to be unsigned.
@@ -87,6 +91,10 @@
 	[RLIMIT_NICE]		= { 0, 0 },				\
 	[RLIMIT_RTPRIO]		= { 0, 0 },				\
 	[RLIMIT_RTTIME]		= {  RLIM_INFINITY,  RLIM_INFINITY },	\
+	[RLIMIT_FUTURE1]        = { 0, 0 },				\
+	[RLIMIT_FUTURE2]        = { 0, 0 },				\
+	[RLIMIT_FUTURE3]        = { 0, 0 },				\
+	[RLIMIT_MCPU]           = {  RLIM_INFINITY,  RLIM_INFINITY },   \
 }
 
 #endif	/* __KERNEL__ */
diff -ruNp linux-2.6.34.5/include/linux/posix-timers.h linux-2.6.34.5-cher1/include/linux/posix-timers.h
--- linux-2.6.34.5/include/linux/posix-timers.h	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/include/linux/posix-timers.h	2010-08-26 14:45:12.331562456 +0400
@@ -118,5 +118,6 @@ void set_process_cpu_timer(struct task_s
 long clock_nanosleep_restart(struct restart_block *restart_block);
 
 void update_rlimit_cpu(unsigned long rlim_new);
+void update_rlimit_mcpu(unsigned long rlim_new);
 
 #endif
diff -ruNp linux-2.6.34.5/include/linux/ptrace.h linux-2.6.34.5-cher1/include/linux/ptrace.h
--- linux-2.6.34.5/include/linux/ptrace.h	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/include/linux/ptrace.h	2010-08-26 14:45:12.331562456 +0400
@@ -47,6 +47,10 @@
 #define PTRACE_GETREGSET	0x4204
 #define PTRACE_SETREGSET	0x4205
 
+#define PTRACE_MEMLIMIT         0x4280
+#define PTRACE_NO_SYSCALLS      0x4281
+#define PTRACE_TIMELIMIT        0x4282
+
 /* options set using PTRACE_SETOPTIONS */
 #define PTRACE_O_TRACESYSGOOD	0x00000001
 #define PTRACE_O_TRACEFORK	0x00000002
diff -ruNp linux-2.6.34.5/include/linux/sched.h linux-2.6.34.5-cher1/include/linux/sched.h
--- linux-2.6.34.5/include/linux/sched.h	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/include/linux/sched.h	2010-08-26 14:45:12.332557080 +0400
@@ -1167,6 +1167,17 @@ struct sched_rt_entity {
 
 struct rcu_node;
 
+/* sandbox flags */
+enum {
+	SBOX_NO_SYSCALLS  = 1,   /* disable most "dangerous" syscalls */
+	SBOX_NO_EXEC      = 2,   /* disable exec syscall */
+	SBOX_MEMLIMITON   = 4,   /* enable memory limit check */
+	SBOX_WAS_MEMLIMIT = 8,   /* memory limit happened?  */
+	SBOX_WAS_SECURITY = 16,  /* was security violation? */
+	SBOX_TLON         = 32,  /* enable kernel time limit check */
+	SBOX_WAS_TL       = 64,  /* was time limit? */
+};
+
 struct task_struct {
 	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
 	void *stack;
@@ -1505,8 +1516,19 @@ struct task_struct {
 		unsigned long memsw_bytes; /* uncharged mem+swap usage */
 	} memcg_batch;
 #endif
+
+	/* sandbox flags */
+	int sbox_flags;
 };
 
+#define SBOX_IS_RESTRICTED() unlikely(current->sbox_flags & SBOX_NO_SYSCALLS)
+#define SBOX_SET_SECURITY_ERR() (current->sbox_flags |= SBOX_WAS_SECURITY)
+#define SBOX_SET_TL_ERR() (current->sbox_flags |= SBOX_WAS_TL)
+
+#define SBOX_IS_MEMLIMIT_ERR(p) (p->sbox_flags & SBOX_WAS_MEMLIMIT)
+#define SBOX_IS_SECURITY_ERR(p) (p->sbox_flags & SBOX_WAS_SECURITY)
+#define SBOX_IS_TL_ERR(p) (p->sbox_flags & SBOX_WAS_TL)
+
 /* Future-safe accessor for struct task_struct's cpus_allowed. */
 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
 
diff -ruNp linux-2.6.34.5/ipc/compat_mq.c linux-2.6.34.5-cher1/ipc/compat_mq.c
--- linux-2.6.34.5/ipc/compat_mq.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/ipc/compat_mq.c	2010-08-26 14:45:12.344634835 +0400
@@ -51,6 +51,12 @@ asmlinkage long compat_sys_mq_open(const
 			struct compat_mq_attr __user *u_attr)
 {
 	void __user *p = NULL;
+
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_attr && oflag & O_CREAT) {
 		struct mq_attr attr;
 		p = compat_alloc_user_space(sizeof(attr));
@@ -82,6 +88,11 @@ asmlinkage long compat_sys_mq_timedsend(
 {
 	struct timespec __user *u_ts;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (compat_prepare_timeout(&u_ts, u_abs_timeout))
 		return -EFAULT;
 
@@ -95,6 +106,12 @@ asmlinkage ssize_t compat_sys_mq_timedre
 			const struct compat_timespec __user *u_abs_timeout)
 {
 	struct timespec __user *u_ts;
+
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (compat_prepare_timeout(&u_ts, u_abs_timeout))
 		return -EFAULT;
 
@@ -106,6 +123,12 @@ asmlinkage long compat_sys_mq_notify(mqd
 			const struct compat_sigevent __user *u_notification)
 {
 	struct sigevent __user *p = NULL;
+
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_notification) {
 		struct sigevent n;
 		p = compat_alloc_user_space(sizeof(*p));
@@ -124,9 +147,15 @@ asmlinkage long compat_sys_mq_getsetattr
 			struct compat_mq_attr __user *u_omqstat)
 {
 	struct mq_attr mqstat;
-	struct mq_attr __user *p = compat_alloc_user_space(2 * sizeof(*p));
+	struct mq_attr __user *p = NULL;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+	p = compat_alloc_user_space(2 * sizeof(*p));
 	if (u_mqstat) {
 		if (get_compat_mq_attr(&mqstat, u_mqstat) ||
 		    copy_to_user(p, &mqstat, sizeof(mqstat)))
diff -ruNp linux-2.6.34.5/ipc/mqueue.c linux-2.6.34.5-cher1/ipc/mqueue.c
--- linux-2.6.34.5/ipc/mqueue.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/ipc/mqueue.c	2010-08-26 14:45:12.346562202 +0400
@@ -695,6 +695,11 @@ SYSCALL_DEFINE4(mq_open, const char __us
 	int fd, error;
 	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_attr && copy_from_user(&attr, u_attr, sizeof(struct mq_attr)))
 		return -EFAULT;
 
@@ -766,6 +771,11 @@ SYSCALL_DEFINE1(mq_unlink, const char __
 	struct inode *inode = NULL;
 	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	name = getname(u_name);
 	if (IS_ERR(name))
 		return PTR_ERR(name);
@@ -866,6 +876,11 @@ SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqd
 	long timeout;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_abs_timeout) {
 		if (copy_from_user(&ts, u_abs_timeout, 
 					sizeof(struct timespec)))
@@ -963,6 +978,11 @@ SYSCALL_DEFINE5(mq_timedreceive, mqd_t, 
 	struct ext_wait_queue wait;
 	struct timespec ts, *p = NULL;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_abs_timeout) {
 		if (copy_from_user(&ts, u_abs_timeout, 
 					sizeof(struct timespec)))
@@ -1056,6 +1076,11 @@ SYSCALL_DEFINE2(mq_notify, mqd_t, mqdes,
 	struct mqueue_inode_info *info;
 	struct sk_buff *nc;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_notification) {
 		if (copy_from_user(&notification, u_notification,
 					sizeof(struct sigevent)))
@@ -1186,6 +1211,11 @@ SYSCALL_DEFINE3(mq_getsetattr, mqd_t, mq
 	struct inode *inode;
 	struct mqueue_inode_info *info;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_mqstat != NULL) {
 		if (copy_from_user(&mqstat, u_mqstat, sizeof(struct mq_attr)))
 			return -EFAULT;
diff -ruNp linux-2.6.34.5/ipc/msg.c linux-2.6.34.5-cher1/ipc/msg.c
--- linux-2.6.34.5/ipc/msg.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/ipc/msg.c	2010-08-26 14:45:12.356716638 +0400
@@ -315,6 +315,11 @@ SYSCALL_DEFINE2(msgget, key_t, key, int,
 	struct ipc_ops msg_ops;
 	struct ipc_params msg_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	msg_ops.getnew = newque;
@@ -472,6 +477,11 @@ SYSCALL_DEFINE3(msgctl, int, msqid, int,
 	int err, version;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (msqid < 0 || cmd < 0)
 		return -EINVAL;
 
@@ -728,6 +738,11 @@ SYSCALL_DEFINE4(msgsnd, int, msqid, stru
 {
 	long mtype;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(mtype, &msgp->mtype))
 		return -EFAULT;
 	return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
@@ -909,6 +924,11 @@ SYSCALL_DEFINE5(msgrcv, int, msqid, stru
 {
 	long err, mtype;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err =  do_msgrcv(msqid, &mtype, msgp->mtext, msgsz, msgtyp, msgflg);
 	if (err < 0)
 		goto out;
diff -ruNp linux-2.6.34.5/ipc/sem.c linux-2.6.34.5-cher1/ipc/sem.c
--- linux-2.6.34.5/ipc/sem.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/ipc/sem.c	2010-08-26 14:45:12.357562009 +0400
@@ -321,6 +321,11 @@ SYSCALL_DEFINE3(semget, key_t, key, int,
 	struct ipc_ops sem_ops;
 	struct ipc_params sem_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	if (nsems < 0 || nsems > ns->sc_semmsl)
@@ -941,6 +946,11 @@ SYSCALL_DEFINE(semctl)(int semid, int se
 	int version;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (semid < 0)
 		return -EINVAL;
 
@@ -974,6 +984,11 @@ SYSCALL_DEFINE(semctl)(int semid, int se
 #ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
 asmlinkage long SyS_semctl(int semid, int semnum, int cmd, union semun arg)
 {
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return SYSC_semctl((int) semid, (int) semnum, (int) cmd, arg);
 }
 SYSCALL_ALIAS(sys_semctl, SyS_semctl);
@@ -1130,6 +1145,11 @@ SYSCALL_DEFINE4(semtimedop, int, semid, 
 	unsigned long jiffies_left = 0;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	if (nsops < 1 || semid < 0)
diff -ruNp linux-2.6.34.5/ipc/shm.c linux-2.6.34.5-cher1/ipc/shm.c
--- linux-2.6.34.5/ipc/shm.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/ipc/shm.c	2010-08-26 14:45:12.358568507 +0400
@@ -454,6 +454,11 @@ SYSCALL_DEFINE3(shmget, key_t, key, size
 	struct ipc_ops shm_ops;
 	struct ipc_params shm_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	shm_ops.getnew = newseg;
@@ -641,6 +646,11 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int,
 	int err, version;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (cmd < 0 || shmid < 0) {
 		err = -EINVAL;
 		goto out;
@@ -960,6 +970,11 @@ SYSCALL_DEFINE3(shmat, int, shmid, char 
 	unsigned long ret;
 	long err;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = do_shmat(shmid, shmaddr, shmflg, &ret);
 	if (err)
 		return err;
@@ -982,6 +997,11 @@ SYSCALL_DEFINE1(shmdt, char __user *, sh
 	struct vm_area_struct *next;
 #endif
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (addr & ~PAGE_MASK)
 		return retval;
 
diff -ruNp linux-2.6.34.5/kernel/acct.c linux-2.6.34.5-cher1/kernel/acct.c
--- linux-2.6.34.5/kernel/acct.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/acct.c	2010-08-26 14:45:12.359572839 +0400
@@ -283,6 +283,11 @@ SYSCALL_DEFINE1(acct, const char __user 
 {
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_PACCT))
 		return -EPERM;
 
diff -ruNp linux-2.6.34.5/kernel/capability.c linux-2.6.34.5-cher1/kernel/capability.c
--- linux-2.6.34.5/kernel/capability.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/capability.c	2010-08-26 14:45:12.359572839 +0400
@@ -166,6 +166,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_
 	unsigned tocopy;
 	kernel_cap_t pE, pI, pP;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	ret = cap_validate_magic(header, &tocopy);
 	if ((dataptr == NULL) || (ret != 0))
 		return ((dataptr == NULL) && (ret == -EINVAL)) ? 0 : ret;
@@ -242,6 +245,11 @@ SYSCALL_DEFINE2(capset, cap_user_header_
 	int ret;
 	pid_t pid;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+        	return -EPERM;
+	}
+
 	ret = cap_validate_magic(header, &tocopy);
 	if (ret != 0)
 		return ret;
diff -ruNp linux-2.6.34.5/kernel/compat.c linux-2.6.34.5-cher1/kernel/compat.c
--- linux-2.6.34.5/kernel/compat.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/compat.c	2010-08-26 14:45:12.360562295 +0400
@@ -75,6 +75,11 @@ asmlinkage long compat_sys_settimeofday(
 	struct timespec kts;
 	struct timezone ktz;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (tv) {
 		if (compat_get_timeval(&kts, tv))
 			return -EFAULT;
@@ -131,6 +136,11 @@ asmlinkage long compat_sys_nanosleep(str
 	mm_segment_t oldfs;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_compat_timespec(&tu, rqtp))
 		return -EFAULT;
 
@@ -184,6 +194,11 @@ asmlinkage long compat_sys_getitimer(int
 	struct itimerval kit;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = do_getitimer(which, &kit);
 	if (!error && put_compat_itimerval(it, &kit))
 		error = -EFAULT;
@@ -197,6 +212,11 @@ asmlinkage long compat_sys_setitimer(int
 	struct itimerval kin, kout;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (in) {
 		if (get_compat_itimerval(&kin, in))
 			return -EFAULT;
@@ -218,6 +238,11 @@ static compat_clock_t clock_t_to_compat_
 
 asmlinkage long compat_sys_times(struct compat_tms __user *tbuf)
 {
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (tbuf) {
 		struct tms tms;
 		struct compat_tms tmp;
@@ -244,8 +269,13 @@ asmlinkage long compat_sys_sigpending(co
 {
 	old_sigset_t s;
 	long ret;
-	mm_segment_t old_fs = get_fs();
+	mm_segment_t old_fs;
+
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
 
+        old_fs = get_fs();
 	set_fs(KERNEL_DS);
 	ret = sys_sigpending((old_sigset_t __user *) &s);
 	set_fs(old_fs);
@@ -261,6 +291,11 @@ asmlinkage long compat_sys_sigprocmask(i
 	long ret;
 	mm_segment_t old_fs;
 
+        if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (set && get_user(s, set))
 		return -EFAULT;
 	old_fs = get_fs();
@@ -280,8 +315,14 @@ asmlinkage long compat_sys_setrlimit(uns
 {
 	struct rlimit r;
 	int ret;
-	mm_segment_t old_fs = get_fs ();
+	mm_segment_t old_fs;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+        old_fs = get_fs ();
 	if (resource >= RLIM_NLIMITS)
 		return -EINVAL;
 
@@ -401,6 +442,11 @@ asmlinkage long
 compat_sys_wait4(compat_pid_t pid, compat_uint_t __user *stat_addr, int options,
 	struct compat_rusage __user *ru)
 {
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!ru) {
 		return sys_wait4(pid, stat_addr, options, NULL);
 	} else {
@@ -433,8 +479,14 @@ asmlinkage long compat_sys_waitid(int wh
 	siginfo_t info;
 	struct rusage ru;
 	long ret;
-	mm_segment_t old_fs = get_fs();
+	mm_segment_t old_fs;
+
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
 
+        old_fs = get_fs();
 	memset(&info, 0, sizeof(info));
 
 	set_fs(KERNEL_DS);
@@ -477,6 +529,11 @@ asmlinkage long compat_sys_sched_setaffi
 	cpumask_var_t new_mask;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!alloc_cpumask_var(&new_mask, GFP_KERNEL))
 		return -ENOMEM;
 
@@ -542,6 +599,11 @@ long compat_sys_timer_create(clockid_t w
 {
 	struct sigevent __user *event = NULL;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (timer_event_spec) {
 		struct sigevent kevent;
 
@@ -562,6 +624,11 @@ long compat_sys_timer_settime(timer_t ti
 	mm_segment_t oldfs;
 	struct itimerspec newts, oldts;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!new)
 		return -EINVAL;
 	if (get_compat_itimerspec(&newts, new))
@@ -584,6 +651,11 @@ long compat_sys_timer_gettime(timer_t ti
 	mm_segment_t oldfs;
 	struct itimerspec ts;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	oldfs = get_fs();
 	set_fs(KERNEL_DS);
 	err = sys_timer_gettime(timer_id,
@@ -601,6 +673,11 @@ long compat_sys_clock_settime(clockid_t 
 	mm_segment_t oldfs;
 	struct timespec ts;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_compat_timespec(&ts, tp))
 		return -EFAULT;
 	oldfs = get_fs();
@@ -618,6 +695,11 @@ long compat_sys_clock_gettime(clockid_t 
 	mm_segment_t oldfs;
 	struct timespec ts;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	oldfs = get_fs();
 	set_fs(KERNEL_DS);
 	err = sys_clock_gettime(which_clock,
@@ -635,6 +717,11 @@ long compat_sys_clock_getres(clockid_t w
 	mm_segment_t oldfs;
 	struct timespec ts;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	oldfs = get_fs();
 	set_fs(KERNEL_DS);
 	err = sys_clock_getres(which_clock,
@@ -678,6 +765,11 @@ long compat_sys_clock_nanosleep(clockid_
 	struct timespec in, out;
 	struct restart_block *restart;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_compat_timespec(&in, rqtp))
 		return -EFAULT;
 
@@ -825,6 +917,11 @@ compat_sys_rt_sigtimedwait (compat_sigse
 	siginfo_t info;
 	long ret, timeout = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (sigsetsize != sizeof(sigset_t))
 		return -EINVAL;
 
@@ -886,6 +983,11 @@ compat_sys_rt_tgsigqueueinfo(compat_pid_
 {
 	siginfo_t info;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_siginfo_from_user32(&info, uinfo))
 		return -EFAULT;
 	return do_rt_tgsigqueueinfo(tgid, pid, sig, &info);
@@ -916,6 +1018,11 @@ asmlinkage long compat_sys_stime(compat_
 	struct timespec tv;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(tv.tv_sec, tptr))
 		return -EFAULT;
 
@@ -937,6 +1044,11 @@ asmlinkage long compat_sys_rt_sigsuspend
 	sigset_t newset;
 	compat_sigset_t newset32;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		return -EINVAL;
@@ -964,6 +1076,11 @@ asmlinkage long compat_sys_adjtimex(stru
 	struct timex txc;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	memset(&txc, 0, sizeof(struct timex));
 
 	if (!access_ok(VERIFY_READ, utp, sizeof(struct compat_timex)) ||
@@ -1028,6 +1145,11 @@ asmlinkage long compat_sys_move_pages(pi
 	const void __user * __user *pages;
 	int i;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	pages = compat_alloc_user_space(nr_pages * sizeof(void *));
 	for (i = 0; i < nr_pages; i++) {
 		compat_uptr_t p;
@@ -1050,6 +1172,11 @@ asmlinkage long compat_sys_migrate_pages
 	unsigned long nr_bits;
 	unsigned long size;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	nr_bits = min_t(unsigned long, maxnode - 1, MAX_NUMNODES);
 	size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 	if (old_nodes) {
diff -ruNp linux-2.6.34.5/kernel/exec_domain.c linux-2.6.34.5-cher1/kernel/exec_domain.c
--- linux-2.6.34.5/kernel/exec_domain.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/exec_domain.c	2010-08-26 14:45:12.360562295 +0400
@@ -192,6 +192,9 @@ SYSCALL_DEFINE1(personality, u_long, per
 {
 	u_long old = current->personality;
 
+        if (SBOX_IS_RESTRICTED())
+		return (long) old;
+
 	if (personality != 0xffffffff) {
 		set_personality(personality);
 		if (current->personality != personality)
diff -ruNp linux-2.6.34.5/kernel/exit.c linux-2.6.34.5-cher1/kernel/exit.c
--- linux-2.6.34.5/kernel/exit.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/exit.c	2010-08-26 14:45:12.361567396 +0400
@@ -1184,6 +1184,7 @@ static int wait_task_zombie(struct wait_
 	pid_t pid = task_pid_vnr(p);
 	uid_t uid = __task_cred(p)->uid;
 	struct siginfo __user *infop;
+        int status2;
 
 	if (!likely(wo->wo_flags & WEXITED))
 		return 0;
@@ -1201,6 +1202,12 @@ static int wait_task_zombie(struct wait_
 			why = (exit_code & 0x80) ? CLD_DUMPED : CLD_KILLED;
 			status = exit_code & 0x7f;
 		}
+                if (SBOX_IS_MEMLIMIT_ERR(p))
+                	status |= 0x10000;
+		if (SBOX_IS_SECURITY_ERR(p))
+			status |= 0x20000;
+		if (SBOX_IS_TL_ERR(p))
+                	status |= 0x40000;
 		return wait_noreap_copyout(wo, p, pid, uid, why, status);
 	}
 
@@ -1293,8 +1300,16 @@ static int wait_task_zombie(struct wait_
 		? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
 	status = (p->signal->flags & SIGNAL_GROUP_EXIT)
 		? p->signal->group_exit_code : p->exit_code;
-	if (!retval && wo->wo_stat)
-		retval = put_user(status, wo->wo_stat);
+	if (!retval && wo->wo_stat) {
+        	status2 = status;
+                if (SBOX_IS_MEMLIMIT_ERR(p))
+                	status2 |= 0x10000;
+		if (SBOX_IS_SECURITY_ERR(p))
+                	status2 |= 0x20000;
+		if (SBOX_IS_TL_ERR(p))
+                	status2 |= 0x40000;
+		retval = put_user(status2, wo->wo_stat);
+	}
 
 	infop = wo->wo_info;
 	if (!retval && infop)
@@ -1416,8 +1431,16 @@ unlock_sig:
 
 	retval = wo->wo_rusage
 		? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
-	if (!retval && wo->wo_stat)
-		retval = put_user((exit_code << 8) | 0x7f, wo->wo_stat);
+	if (!retval && wo->wo_stat) {
+        	int status2 = (exit_code << 8) | 0x7f;
+                if (SBOX_IS_MEMLIMIT_ERR(p))
+                	status2 |= 0x10000;
+		if (SBOX_IS_SECURITY_ERR(p))
+                	status2 |= 0x20000;
+		if (SBOX_IS_TL_ERR(p))
+                	status2 |= 0x40000;
+		retval = put_user(status2, wo->wo_stat);
+	}
 
 	infop = wo->wo_info;
 	if (!retval && infop)
@@ -1477,8 +1500,16 @@ static int wait_task_continued(struct wa
 		retval = wo->wo_rusage
 			? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
 		put_task_struct(p);
-		if (!retval && wo->wo_stat)
-			retval = put_user(0xffff, wo->wo_stat);
+		if (!retval && wo->wo_stat) {
+                	int status2 = 0xffff;
+                        if (SBOX_IS_MEMLIMIT_ERR(p))
+                        	status2 |= 0x10000;
+                        if (SBOX_IS_SECURITY_ERR(p))
+                        	status2 |= 0x20000;
+                        if (SBOX_IS_TL_ERR(p))
+                        	status2 |= 0x40000;
+			retval = put_user(status2, wo->wo_stat);
+		}
 		if (!retval)
 			retval = pid;
 	} else {
@@ -1669,6 +1700,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_
 	enum pid_type type;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (options & ~(WNOHANG|WNOWAIT|WEXITED|WSTOPPED|WCONTINUED))
 		return -EINVAL;
 	if (!(options & (WEXITED|WSTOPPED|WCONTINUED)))
@@ -1740,6 +1774,9 @@ SYSCALL_DEFINE4(wait4, pid_t, upid, int 
 	enum pid_type type;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (options & ~(WNOHANG|WUNTRACED|WCONTINUED|
 			__WNOTHREAD|__WCLONE|__WALL))
 		return -EINVAL;
diff -ruNp linux-2.6.34.5/kernel/fork.c linux-2.6.34.5-cher1/kernel/fork.c
--- linux-2.6.34.5/kernel/fork.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/fork.c	2010-08-26 14:45:12.362562509 +0400
@@ -836,6 +836,7 @@ void __cleanup_sighand(struct sighand_st
 static void posix_cpu_timers_init_group(struct signal_struct *sig)
 {
 	unsigned long cpu_limit;
+        unsigned long mcpu_limit;
 
 	/* Thread group counters. */
 	thread_group_cputime_init(sig);
@@ -845,6 +846,11 @@ static void posix_cpu_timers_init_group(
 		sig->cputime_expires.prof_exp = secs_to_cputime(cpu_limit);
 		sig->cputimer.running = 1;
 	}
+        mcpu_limit = ACCESS_ONCE(sig->rlim[RLIMIT_MCPU].rlim_cur);
+        if (mcpu_limit != RLIM_INFINITY) {
+        	sig->cputime_expires.prof_exp = msecs_to_cputime(mcpu_limit);
+                sig->cputimer.running = 1;
+	}
 
 	/* The timer lists. */
 	INIT_LIST_HEAD(&sig->cpu_timers[0]);
@@ -1359,6 +1365,11 @@ long do_fork(unsigned long clone_flags,
 	int trace = 0;
 	long nr;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/*
 	 * Do some preliminary argument and permissions checking before we
 	 * actually start allocating stuff
@@ -1619,6 +1630,9 @@ SYSCALL_DEFINE1(unshare, unsigned long, 
 	struct nsproxy *new_nsproxy = NULL;
 	int do_sysvsem = 0;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	check_unshare_flags(&unshare_flags);
 
 	/* Return -EINVAL for all unsupported flags */
diff -ruNp linux-2.6.34.5/kernel/groups.c linux-2.6.34.5-cher1/kernel/groups.c
--- linux-2.6.34.5/kernel/groups.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/groups.c	2010-08-26 14:45:12.363567679 +0400
@@ -240,6 +240,11 @@ SYSCALL_DEFINE2(setgroups, int, gidsetsi
 	struct group_info *group_info;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SETGID))
 		return -EPERM;
 	if ((unsigned)gidsetsize > NGROUPS_MAX)
diff -ruNp linux-2.6.34.5/kernel/hrtimer.c linux-2.6.34.5-cher1/kernel/hrtimer.c
--- linux-2.6.34.5/kernel/hrtimer.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/hrtimer.c	2010-08-26 14:45:12.363567679 +0400
@@ -1608,6 +1608,9 @@ SYSCALL_DEFINE2(nanosleep, struct timesp
 {
 	struct timespec tu;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (copy_from_user(&tu, rqtp, sizeof(tu)))
 		return -EFAULT;
 
diff -ruNp linux-2.6.34.5/kernel/itimer.c linux-2.6.34.5-cher1/kernel/itimer.c
--- linux-2.6.34.5/kernel/itimer.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/itimer.c	2010-08-26 14:45:12.364562651 +0400
@@ -105,6 +105,9 @@ SYSCALL_DEFINE2(getitimer, int, which, s
 	int error = -EFAULT;
 	struct itimerval get_buffer;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (value) {
 		error = do_getitimer(which, &get_buffer);
 		if (!error &&
@@ -282,6 +285,9 @@ SYSCALL_DEFINE3(setitimer, int, which, s
 	struct itimerval set_buffer, get_buffer;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (value) {
 		if(copy_from_user(&set_buffer, value, sizeof(set_buffer)))
 			return -EFAULT;
diff -ruNp linux-2.6.34.5/kernel/kexec.c linux-2.6.34.5-cher1/kernel/kexec.c
--- linux-2.6.34.5/kernel/kexec.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/kexec.c	2010-08-26 14:45:12.365567402 +0400
@@ -942,6 +942,11 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
 	struct kimage **dest_image, *image;
 	int result;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* We only trust the superuser with rebooting the system. */
 	if (!capable(CAP_SYS_BOOT))
 		return -EPERM;
@@ -1033,6 +1038,11 @@ asmlinkage long compat_sys_kexec_load(un
 	struct kexec_segment out, __user *ksegments;
 	unsigned long i, result;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Don't allow clients that don't understand the native
 	 * architecture to do anything.
 	 */
diff -ruNp linux-2.6.34.5/kernel/module.c linux-2.6.34.5-cher1/kernel/module.c
--- linux-2.6.34.5/kernel/module.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/module.c	2010-08-26 14:45:12.366567334 +0400
@@ -716,6 +716,11 @@ SYSCALL_DEFINE2(delete_module, const cha
 	char name[MODULE_NAME_LEN];
 	int ret, forced = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_MODULE) || modules_disabled)
 		return -EPERM;
 
@@ -2505,6 +2510,11 @@ SYSCALL_DEFINE3(init_module, void __user
 	struct module *mod;
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Must have permission */
 	if (!capable(CAP_SYS_MODULE) || modules_disabled)
 		return -EPERM;
diff -ruNp linux-2.6.34.5/kernel/perf_event.c linux-2.6.34.5-cher1/kernel/perf_event.c
--- linux-2.6.34.5/kernel/perf_event.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/perf_event.c	2010-08-26 14:45:12.375557153 +0400
@@ -4848,6 +4848,9 @@ SYSCALL_DEFINE5(perf_event_open,
 	int fput_needed = 0;
 	int err;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	/* for future expandability... */
 	if (flags & ~(PERF_FLAG_FD_NO_GROUP | PERF_FLAG_FD_OUTPUT))
 		return -EINVAL;
diff -ruNp linux-2.6.34.5/kernel/posix-cpu-timers.c linux-2.6.34.5-cher1/kernel/posix-cpu-timers.c
--- linux-2.6.34.5/kernel/posix-cpu-timers.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/posix-cpu-timers.c	2010-08-26 14:45:12.481672366 +0400
@@ -26,6 +26,19 @@ void update_rlimit_cpu(unsigned long rli
 	}
 }
 
+void update_rlimit_mcpu(unsigned long rlim_new)
+{
+	cputime_t cputime = msecs_to_cputime(rlim_new);
+	struct signal_struct *const sig = current->signal;
+
+	if (cputime_eq(sig->it[CPUCLOCK_PROF].expires, cputime_zero) ||
+	    cputime_gt(sig->it[CPUCLOCK_PROF].expires, cputime)) {
+		spin_lock_irq(&current->sighand->siglock);
+		set_process_cpu_timer(current, CPUCLOCK_PROF, &cputime, NULL);
+		spin_unlock_irq(&current->sighand->siglock);
+	}
+}
+
 static int check_clock(const clockid_t which_clock)
 {
 	int error = 0;
@@ -643,6 +656,10 @@ static void arm_timer(struct k_itimer *t
 				if (i != RLIM_INFINITY &&
 				    i <= cputime_to_secs(exp->cpu))
 					break;
+				i = sig->rlim[RLIMIT_MCPU].rlim_cur;
+				if (i != RLIM_INFINITY &&
+				    i <= cputime_to_msecs(exp->cpu))
+					break;
 				sig->cputime_expires.prof_exp = exp->cpu;
 				break;
 			case CPUCLOCK_SCHED:
@@ -1134,6 +1151,7 @@ static void check_process_timers(struct 
 	if (list_empty(&timers[CPUCLOCK_PROF]) &&
 	    cputime_eq(sig->it[CPUCLOCK_PROF].expires, cputime_zero) &&
 	    sig->rlim[RLIMIT_CPU].rlim_cur == RLIM_INFINITY &&
+	    sig->rlim[RLIMIT_MCPU].rlim_cur == RLIM_INFINITY &&
 	    list_empty(&timers[CPUCLOCK_VIRT]) &&
 	    cputime_eq(sig->it[CPUCLOCK_VIRT].expires, cputime_zero) &&
 	    list_empty(&timers[CPUCLOCK_SCHED])) {
@@ -1210,6 +1228,8 @@ static void check_process_timers(struct 
 			 * At the hard limit, we just die.
 			 * No need to calculate anything else now.
 			 */
+			if ((tsk->sbox_flags & SBOX_TLON))
+				tsk->sbox_flags |= SBOX_WAS_TL;
 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
 			return;
 		}
@@ -1230,6 +1250,39 @@ static void check_process_timers(struct 
 		}
 	}
 
+	soft = ACCESS_ONCE(sig->rlim[RLIMIT_MCPU].rlim_cur);
+	if (soft != RLIM_INFINITY) {
+		unsigned long pmsecs = cputime_to_msecs(ptime);
+		unsigned long hard =
+			ACCESS_ONCE(sig->rlim[RLIMIT_MCPU].rlim_max);
+		cputime_t x;
+		if (pmsecs >= hard) {
+			/*
+			 * At the hard limit, we just die.
+			 * No need to calculate anything else now.
+			 */
+			if ((tsk->sbox_flags & SBOX_TLON))
+				tsk->sbox_flags |= SBOX_WAS_TL;
+			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
+			return;
+		}
+		if (pmsecs >= soft) {
+			/*
+			 * At the soft limit, send a SIGXCPU every second.
+			 */
+			__group_send_sig_info(SIGXCPU, SEND_SIG_PRIV, tsk);
+			if (soft < hard) {
+				soft++;
+				sig->rlim[RLIMIT_MCPU].rlim_cur = soft;
+			}
+		}
+		x = msecs_to_cputime(soft);
+		if (cputime_eq(prof_expires, cputime_zero) ||
+		    cputime_lt(x, prof_expires)) {
+			prof_expires = x;
+		}
+	}
+
 	if (!cputime_eq(prof_expires, cputime_zero) &&
 	    (cputime_eq(sig->cputime_expires.prof_exp, cputime_zero) ||
 	     cputime_gt(sig->cputime_expires.prof_exp, prof_expires)))
@@ -1390,7 +1443,8 @@ static inline int fastpath_timer_check(s
 			return 1;
 	}
 
-	return sig->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY;
+	return sig->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY
+           || sig->rlim[RLIMIT_MCPU].rlim_cur != RLIM_INFINITY;
 }
 
 /*
@@ -1491,6 +1545,9 @@ void set_process_cpu_timer(struct task_s
 		if (tsk->signal->rlim[RLIMIT_CPU].rlim_cur
 		    < cputime_to_secs(*newval))
 			return;
+		if (tsk->signal->rlim[RLIMIT_MCPU].rlim_cur
+                    < cputime_to_msecs(*newval))
+			return;
 	}
 
 	/*
diff -ruNp linux-2.6.34.5/kernel/posix-timers.c linux-2.6.34.5-cher1/kernel/posix-timers.c
--- linux-2.6.34.5/kernel/posix-timers.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/posix-timers.c	2010-08-26 14:45:12.481672366 +0400
@@ -528,6 +528,11 @@ SYSCALL_DEFINE3(timer_create, const cloc
 	sigevent_t event;
 	int it_id_set = IT_ID_NOT_SET;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (invalid_clockid(which_clock))
 		return -EINVAL;
 
@@ -706,6 +711,11 @@ SYSCALL_DEFINE2(timer_gettime, timer_t, 
 	struct itimerspec cur_setting;
 	unsigned long flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	timr = lock_timer(timer_id, &flags);
 	if (!timr)
 		return -EINVAL;
@@ -735,6 +745,11 @@ SYSCALL_DEFINE1(timer_getoverrun, timer_
 	int overrun;
 	unsigned long flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	timr = lock_timer(timer_id, &flags);
 	if (!timr)
 		return -EINVAL;
@@ -807,6 +822,11 @@ SYSCALL_DEFINE4(timer_settime, timer_t, 
 	unsigned long flag;
 	struct itimerspec *rtn = old_setting ? &old_spec : NULL;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!new_setting)
 		return -EINVAL;
 
@@ -857,6 +877,11 @@ SYSCALL_DEFINE1(timer_delete, timer_t, t
 	struct k_itimer *timer;
 	unsigned long flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 retry_delete:
 	timer = lock_timer(timer_id, &flags);
 	if (!timer)
@@ -943,6 +968,11 @@ SYSCALL_DEFINE2(clock_settime, const clo
 {
 	struct timespec new_tp;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (invalid_clockid(which_clock))
 		return -EINVAL;
 	if (copy_from_user(&new_tp, tp, sizeof (*tp)))
@@ -957,6 +987,11 @@ SYSCALL_DEFINE2(clock_gettime, const clo
 	struct timespec kernel_tp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (invalid_clockid(which_clock))
 		return -EINVAL;
 	error = CLOCK_DISPATCH(which_clock, clock_get,
@@ -974,6 +1009,11 @@ SYSCALL_DEFINE2(clock_getres, const cloc
 	struct timespec rtn_tp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (invalid_clockid(which_clock))
 		return -EINVAL;
 
@@ -1004,6 +1044,11 @@ SYSCALL_DEFINE4(clock_nanosleep, const c
 {
 	struct timespec t;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (invalid_clockid(which_clock))
 		return -EINVAL;
 
diff -ruNp linux-2.6.34.5/kernel/printk.c linux-2.6.34.5-cher1/kernel/printk.c
--- linux-2.6.34.5/kernel/printk.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/printk.c	2010-08-26 14:45:12.596558501 +0400
@@ -410,6 +410,9 @@ out:
 
 SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	return do_syslog(type, buf, len, SYSLOG_FROM_CALL);
 }
 
diff -ruNp linux-2.6.34.5/kernel/ptrace.c linux-2.6.34.5-cher1/kernel/ptrace.c
--- linux-2.6.34.5/kernel/ptrace.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/ptrace.c	2010-08-26 14:45:12.629563879 +0400
@@ -666,6 +666,24 @@ SYSCALL_DEFINE4(ptrace, long, request, l
 	struct task_struct *child;
 	long ret;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
+	if (request == PTRACE_MEMLIMIT) {
+		current->sbox_flags |= SBOX_MEMLIMITON;
+		return 0;
+	}
+	if (request == PTRACE_NO_SYSCALLS) {
+		current->sbox_flags |= SBOX_NO_SYSCALLS;
+		return 0;
+	}
+	if (request == PTRACE_TIMELIMIT) {
+		current->sbox_flags |= SBOX_TLON;
+		return 0;
+	}
+
 	/*
 	 * This lock_kernel fixes a subtle race with suid exec
 	 */
@@ -813,6 +831,20 @@ asmlinkage long compat_sys_ptrace(compat
 	struct task_struct *child;
 	long ret;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
+	if (request == PTRACE_MEMLIMIT) {
+		current->sbox_flags |= SBOX_MEMLIMITON;
+		return 0;
+	}
+	if (request == PTRACE_NO_SYSCALLS) {
+		current->sbox_flags |= SBOX_NO_SYSCALLS;
+		return 0;
+	}
+
 	/*
 	 * This lock_kernel fixes a subtle race with suid exec
 	 */
diff -ruNp linux-2.6.34.5/kernel/sched.c linux-2.6.34.5-cher1/kernel/sched.c
--- linux-2.6.34.5/kernel/sched.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/sched.c	2010-08-26 14:45:12.633682990 +0400
@@ -4384,6 +4384,11 @@ SYSCALL_DEFINE1(nice, int, increment)
 {
 	long nice, retval;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	/*
 	 * Setpriority might change our priority at the same moment.
 	 * We don't have to worry. Conceptually one call occurs first
@@ -4697,6 +4702,11 @@ do_sched_setscheduler(pid_t pid, int pol
 SYSCALL_DEFINE3(sched_setscheduler, pid_t, pid, int, policy,
 		struct sched_param __user *, param)
 {
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	/* negative values for policy are not valid */
 	if (policy < 0)
 		return -EINVAL;
@@ -4711,6 +4721,11 @@ SYSCALL_DEFINE3(sched_setscheduler, pid_
  */
 SYSCALL_DEFINE2(sched_setparam, pid_t, pid, struct sched_param __user *, param)
 {
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	return do_sched_setscheduler(pid, -1, param);
 }
 
@@ -4864,6 +4879,11 @@ SYSCALL_DEFINE3(sched_setaffinity, pid_t
 	cpumask_var_t new_mask;
 	int retval;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (!alloc_cpumask_var(&new_mask, GFP_KERNEL))
 		return -ENOMEM;
 
diff -ruNp linux-2.6.34.5/kernel/signal.c linux-2.6.34.5-cher1/kernel/signal.c
--- linux-2.6.34.5/kernel/signal.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/signal.c	2010-08-26 14:45:12.646562077 +0400
@@ -1245,6 +1245,14 @@ static int kill_something_info(int sig, 
 {
 	int ret;
 
+	if (SBOX_IS_RESTRICTED()) {
+		if (!pid) pid = current->pid;
+		if (pid != current->pid) {
+			SBOX_SET_SECURITY_ERR();
+			return -EPERM;
+		}
+	}
+
 	if (pid > 0) {
 		rcu_read_lock();
 		ret = kill_pid_info(sig, info, find_vpid(pid));
@@ -2110,6 +2118,9 @@ SYSCALL_DEFINE4(rt_sigprocmask, int, how
 	int error = -EINVAL;
 	sigset_t old_set, new_set;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		goto out;
@@ -2166,6 +2177,9 @@ out:
 
 SYSCALL_DEFINE2(rt_sigpending, sigset_t __user *, set, size_t, sigsetsize)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	return do_sigpending(set, sigsetsize);
 }
 
@@ -2245,6 +2259,9 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
 	siginfo_t info;
 	long timeout = 0;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		return -EINVAL;
@@ -2378,6 +2395,9 @@ static int do_tkill(pid_t tgid, pid_t pi
  */
 SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid_t, pid, int, sig)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	/* This is only valid for single tasks */
 	if (pid <= 0 || tgid <= 0)
 		return -EINVAL;
@@ -2390,6 +2410,9 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
  */
 SYSCALL_DEFINE2(tkill, pid_t, pid, int, sig)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	/* This is only valid for single tasks */
 	if (pid <= 0)
 		return -EINVAL;
@@ -2402,6 +2425,9 @@ SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t, 
 {
 	siginfo_t info;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (copy_from_user(&info, uinfo, sizeof(siginfo_t)))
 		return -EFAULT;
 
@@ -2435,6 +2461,9 @@ SYSCALL_DEFINE4(rt_tgsigqueueinfo, pid_t
 {
 	siginfo_t info;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (copy_from_user(&info, uinfo, sizeof(siginfo_t)))
 		return -EFAULT;
 
@@ -2557,6 +2586,9 @@ out:
 
 SYSCALL_DEFINE1(sigpending, old_sigset_t __user *, set)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	return do_sigpending(set, sizeof(*set));
 }
 
@@ -2572,6 +2604,9 @@ SYSCALL_DEFINE3(sigprocmask, int, how, o
 	int error;
 	old_sigset_t old_set, new_set;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (set) {
 		error = -EFAULT;
 		if (copy_from_user(&new_set, set, sizeof(*set)))
@@ -2625,6 +2660,11 @@ SYSCALL_DEFINE4(rt_sigaction, int, sig,
 	struct k_sigaction new_sa, old_sa;
 	int ret = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+		if (sig == SIGINT || sig == SIGTERM)
+			return -EPERM;
+        }
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		goto out;
@@ -2660,6 +2700,9 @@ SYSCALL_DEFINE1(ssetmask, int, newmask)
 {
 	int old;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	spin_lock_irq(&current->sighand->siglock);
 	old = current->blocked.sig[0];
 
@@ -2681,6 +2724,9 @@ SYSCALL_DEFINE2(signal, int, sig, __sigh
 	struct k_sigaction new_sa, old_sa;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	new_sa.sa.sa_handler = handler;
 	new_sa.sa.sa_flags = SA_ONESHOT | SA_NOMASK;
 	sigemptyset(&new_sa.sa.sa_mask);
@@ -2695,6 +2741,9 @@ SYSCALL_DEFINE2(signal, int, sig, __sigh
 
 SYSCALL_DEFINE0(pause)
 {
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	current->state = TASK_INTERRUPTIBLE;
 	schedule();
 	return -ERESTARTNOHAND;
@@ -2707,6 +2756,9 @@ SYSCALL_DEFINE2(rt_sigsuspend, sigset_t 
 {
 	sigset_t newset;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		return -EINVAL;
diff -ruNp linux-2.6.34.5/kernel/sys.c linux-2.6.34.5-cher1/kernel/sys.c
--- linux-2.6.34.5/kernel/sys.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/sys.c	2010-08-26 14:45:12.661557144 +0400
@@ -154,6 +154,11 @@ SYSCALL_DEFINE3(setpriority, int, which,
 	int error = -EINVAL;
 	struct pid *pgrp;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (which > PRIO_USER || which < PRIO_PROCESS)
 		goto out;
 
@@ -371,6 +376,11 @@ SYSCALL_DEFINE4(reboot, int, magic1, int
 	char buffer[256];
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* We only trust the superuser with rebooting the system. */
 	if (!capable(CAP_SYS_BOOT))
 		return -EPERM;
@@ -487,6 +497,11 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
 	struct cred *new;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return -ENOMEM;
@@ -538,6 +553,11 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
 	struct cred *new;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return -ENOMEM;
@@ -605,6 +625,11 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
 	struct cred *new;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return -ENOMEM;
@@ -670,6 +695,11 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
 	struct cred *new;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return -ENOMEM;
@@ -715,6 +745,11 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, 
 	struct cred *new;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return -ENOMEM;
@@ -783,6 +818,11 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, 
 	struct cred *new;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return -ENOMEM;
@@ -845,6 +885,11 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
 	struct cred *new;
 	uid_t old_fsuid;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return current_fsuid();
@@ -882,6 +927,11 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
 	struct cred *new;
 	gid_t old_fsgid;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	new = prepare_creds();
 	if (!new)
 		return current_fsgid();
@@ -926,6 +976,11 @@ void do_sys_times(struct tms *tms)
 
 SYSCALL_DEFINE1(times, struct tms __user *, tbuf)
 {
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (tbuf) {
 		struct tms tmp;
 
@@ -956,6 +1011,11 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid
 	struct pid *pgrp;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!pid)
 		pid = task_pid_vnr(group_leader);
 	if (!pgid)
@@ -1090,6 +1150,11 @@ SYSCALL_DEFINE0(setsid)
 	pid_t session = pid_vnr(sid);
 	int err = -EPERM;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	write_lock_irq(&tasklist_lock);
 	/* Fail if I am already a session leader */
 	if (group_leader->signal->leader)
@@ -1198,6 +1263,11 @@ SYSCALL_DEFINE2(sethostname, char __user
 	int errno;
 	char tmp[__NEW_UTS_LEN];
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 	if (len < 0 || len > __NEW_UTS_LEN)
@@ -1247,6 +1317,11 @@ SYSCALL_DEFINE2(setdomainname, char __us
 	int errno;
 	char tmp[__NEW_UTS_LEN];
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 	if (len < 0 || len > __NEW_UTS_LEN)
@@ -1308,6 +1383,11 @@ SYSCALL_DEFINE2(setrlimit, unsigned int,
 	struct rlimit new_rlim, *old_rlim;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+        	SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (resource >= RLIM_NLIMITS)
 		return -EINVAL;
 	if (copy_from_user(&new_rlim, rlim, sizeof(*rlim)))
@@ -1334,11 +1414,25 @@ SYSCALL_DEFINE2(setrlimit, unsigned int,
 		 */
 		new_rlim.rlim_cur = 1;
 	}
+	if (resource == RLIMIT_MCPU && new_rlim.rlim_cur == 0) {
+		/*
+		 * The caller is asking for an immediate RLIMIT_MCPU
+		 * expiry.  But we use the zero value to mean "it was
+		 * never set".  So let's cheat and make it one msec
+		 * instead
+		 */
+		new_rlim.rlim_cur = 1;
+	}
 
 	task_lock(current->group_leader);
 	*old_rlim = new_rlim;
 	task_unlock(current->group_leader);
 
+        if (resource == RLIMIT_MCPU && new_rlim.rlim_cur != RLIM_INFINITY) {
+		update_rlimit_mcpu(new_rlim.rlim_cur);
+		return 0;
+	}
+
 	if (resource != RLIMIT_CPU)
 		goto out;
 
@@ -1490,6 +1584,10 @@ SYSCALL_DEFINE2(getrusage, int, who, str
 
 SYSCALL_DEFINE1(umask, int, mask)
 {
+	if (SBOX_IS_RESTRICTED()) {
+		return current->fs->umask;
+	}
+
 	mask = xchg(&current->fs->umask, mask & S_IRWXUGO);
 	return mask;
 }
@@ -1501,6 +1599,11 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
 	unsigned char comm[sizeof(me->comm)];
 	long error;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	error = security_task_prctl(option, arg2, arg3, arg4, arg5);
 	if (error != -ENOSYS)
 		return error;
diff -ruNp linux-2.6.34.5/kernel/sysctl_binary.c linux-2.6.34.5-cher1/kernel/sysctl_binary.c
--- linux-2.6.34.5/kernel/sysctl_binary.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/sysctl_binary.c	2010-08-26 14:45:12.666698163 +0400
@@ -1469,6 +1469,9 @@ SYSCALL_DEFINE1(sysctl, struct __sysctl_
 	size_t oldlen = 0;
 	ssize_t result;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	if (copy_from_user(&tmp, args, sizeof(tmp)))
 		return -EFAULT;
 
@@ -1513,6 +1516,9 @@ asmlinkage long compat_sys_sysctl(struct
 	size_t oldlen = 0;
 	ssize_t result;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	if (copy_from_user(&tmp, args, sizeof(tmp)))
 		return -EFAULT;
 
diff -ruNp linux-2.6.34.5/kernel/time.c linux-2.6.34.5-cher1/kernel/time.c
--- linux-2.6.34.5/kernel/time.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/time.c	2010-08-26 14:45:12.667567421 +0400
@@ -83,6 +83,11 @@ SYSCALL_DEFINE1(stime, time_t __user *, 
 	struct timespec tv;
 	int err;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (get_user(tv.tv_sec, tptr))
 		return -EFAULT;
 
@@ -190,6 +195,11 @@ SYSCALL_DEFINE2(settimeofday, struct tim
 	struct timespec	new_ts;
 	struct timezone new_tz;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (tv) {
 		if (copy_from_user(&user_tv, tv, sizeof(*tv)))
 			return -EFAULT;
@@ -209,6 +219,11 @@ SYSCALL_DEFINE1(adjtimex, struct timex _
 	struct timex txc;		/* Local copy of parameter */
 	int ret;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	/* Copy the user data space into the kernel copy
 	 * structure. But bear in mind that the structures
 	 * may change
diff -ruNp linux-2.6.34.5/kernel/timer.c linux-2.6.34.5-cher1/kernel/timer.c
--- linux-2.6.34.5/kernel/timer.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/timer.c	2010-08-26 14:45:12.668557296 +0400
@@ -1249,6 +1249,10 @@ void do_timer(unsigned long ticks)
  */
 SYSCALL_DEFINE1(alarm, unsigned int, seconds)
 {
+	if (SBOX_IS_RESTRICTED()) {
+		return -EPERM;
+	}
+
 	return alarm_setitimer(seconds);
 }
 
diff -ruNp linux-2.6.34.5/kernel/uid16.c linux-2.6.34.5-cher1/kernel/uid16.c
--- linux-2.6.34.5/kernel/uid16.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/kernel/uid16.c	2010-08-26 14:45:12.668557296 +0400
@@ -189,6 +189,11 @@ SYSCALL_DEFINE2(setgroups16, int, gidset
 	struct group_info *group_info;
 	int retval;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (!capable(CAP_SETGID))
 		return -EPERM;
 	if ((unsigned)gidsetsize > NGROUPS_MAX)
diff -ruNp linux-2.6.34.5/Makefile linux-2.6.34.5-cher1/Makefile
--- linux-2.6.34.5/Makefile	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/Makefile	2010-08-26 14:48:55.497693577 +0400
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 34
-EXTRAVERSION = .5
+EXTRAVERSION = .5-cher1
 NAME = Sheep on Meth
 
 # *DOCUMENTATION*
diff -ruNp linux-2.6.34.5/mm/fadvise.c linux-2.6.34.5-cher1/mm/fadvise.c
--- linux-2.6.34.5/mm/fadvise.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/mm/fadvise.c	2010-08-26 14:45:12.670562467 +0400
@@ -26,7 +26,7 @@
  */
 SYSCALL_DEFINE(fadvise64_64)(int fd, loff_t offset, loff_t len, int advice)
 {
-	struct file *file = fget(fd);
+	struct file *file;
 	struct address_space *mapping;
 	struct backing_dev_info *bdi;
 	loff_t endbyte;			/* inclusive */
@@ -35,6 +35,12 @@ SYSCALL_DEFINE(fadvise64_64)(int fd, lof
 	unsigned long nrpages;
 	int ret = 0;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
+        file = fget(fd);
 	if (!file)
 		return -EBADF;
 
diff -ruNp linux-2.6.34.5/mm/filemap.c linux-2.6.34.5-cher1/mm/filemap.c
--- linux-2.6.34.5/mm/filemap.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/mm/filemap.c	2010-08-26 14:45:12.671572525 +0400
@@ -1344,6 +1344,9 @@ SYSCALL_DEFINE(readahead)(int fd, loff_t
 	ssize_t ret;
 	struct file *file;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	ret = -EBADF;
 	file = fget(fd);
 	if (file) {
diff -ruNp linux-2.6.34.5/mm/fremap.c linux-2.6.34.5-cher1/mm/fremap.c
--- linux-2.6.34.5/mm/fremap.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/mm/fremap.c	2010-08-26 14:45:12.683617803 +0400
@@ -130,6 +130,9 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
 	int err = -EINVAL;
 	int has_write_lock = 0;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	if (prot)
 		return err;
 	/*
diff -ruNp linux-2.6.34.5/mm/madvise.c linux-2.6.34.5-cher1/mm/madvise.c
--- linux-2.6.34.5/mm/madvise.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/mm/madvise.c	2010-08-26 14:45:12.684568496 +0400
@@ -341,6 +341,9 @@ SYSCALL_DEFINE3(madvise, unsigned long, 
 	int write;
 	size_t len;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 #ifdef CONFIG_MEMORY_FAILURE
 	if (behavior == MADV_HWPOISON || behavior == MADV_SOFT_OFFLINE)
 		return madvise_hwpoison(behavior, start, start+len_in);
diff -ruNp linux-2.6.34.5/mm/mempolicy.c linux-2.6.34.5-cher1/mm/mempolicy.c
--- linux-2.6.34.5/mm/mempolicy.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/mm/mempolicy.c	2010-08-26 14:45:12.685578975 +0400
@@ -1168,6 +1168,9 @@ SYSCALL_DEFINE6(mbind, unsigned long, st
 	int err;
 	unsigned short mode_flags;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	mode_flags = mode & MPOL_MODE_FLAGS;
 	mode &= ~MPOL_MODE_FLAGS;
 	if (mode >= MPOL_MAX)
@@ -1189,6 +1192,9 @@ SYSCALL_DEFINE3(set_mempolicy, int, mode
 	nodemask_t nodes;
 	unsigned short flags;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	flags = mode & MPOL_MODE_FLAGS;
 	mode &= ~MPOL_MODE_FLAGS;
 	if ((unsigned int)mode >= MPOL_MAX)
@@ -1213,6 +1219,9 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
 	nodemask_t task_nodes;
 	int err;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	err = get_nodes(&old, old_nodes, maxnode);
 	if (err)
 		return err;
@@ -1339,6 +1348,9 @@ asmlinkage long compat_sys_set_mempolicy
 	unsigned long nr_bits, alloc_size;
 	DECLARE_BITMAP(bm, MAX_NUMNODES);
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
@@ -1363,6 +1375,9 @@ asmlinkage long compat_sys_mbind(compat_
 	unsigned long nr_bits, alloc_size;
 	nodemask_t bm;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
diff -ruNp linux-2.6.34.5/mm/migrate.c linux-2.6.34.5-cher1/mm/migrate.c
--- linux-2.6.34.5/mm/migrate.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/mm/migrate.c	2010-08-26 14:45:12.696557342 +0400
@@ -1036,6 +1036,11 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
 	struct mm_struct *mm;
 	int err;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	/* Check flags */
 	if (flags & ~(MPOL_MF_MOVE|MPOL_MF_MOVE_ALL))
 		return -EINVAL;
diff -ruNp linux-2.6.34.5/mm/mincore.c linux-2.6.34.5-cher1/mm/mincore.c
--- linux-2.6.34.5/mm/mincore.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/mm/mincore.c	2010-08-26 14:45:12.696557342 +0400
@@ -221,6 +221,11 @@ SYSCALL_DEFINE3(mincore, unsigned long, 
 	unsigned long pages;
 	unsigned char *tmp;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	/* Check the start address: needs to be page-aligned.. */
  	if (start & ~PAGE_CACHE_MASK)
 		return -EINVAL;
diff -ruNp linux-2.6.34.5/mm/mlock.c linux-2.6.34.5-cher1/mm/mlock.c
--- linux-2.6.34.5/mm/mlock.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/mm/mlock.c	2010-08-26 14:45:12.697572569 +0400
@@ -483,6 +483,11 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
 	unsigned long lock_limit;
 	int error = -ENOMEM;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (!can_do_mlock())
 		return -EPERM;
 
@@ -509,6 +514,11 @@ SYSCALL_DEFINE2(munlock, unsigned long, 
 {
 	int ret;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	down_write(&current->mm->mmap_sem);
 	len = PAGE_ALIGN(len + (start & ~PAGE_MASK));
 	start &= PAGE_MASK;
@@ -547,6 +557,11 @@ SYSCALL_DEFINE1(mlockall, int, flags)
 	unsigned long lock_limit;
 	int ret = -EINVAL;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (!flags || (flags & ~(MCL_CURRENT | MCL_FUTURE)))
 		goto out;
 
@@ -574,6 +589,11 @@ SYSCALL_DEFINE0(munlockall)
 {
 	int ret;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	down_write(&current->mm->mmap_sem);
 	ret = do_mlockall(0);
 	up_write(&current->mm->mmap_sem);
diff -ruNp linux-2.6.34.5/mm/mmap.c linux-2.6.34.5-cher1/mm/mmap.c
--- linux-2.6.34.5/mm/mmap.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/mm/mmap.c	2010-08-26 14:45:12.700562237 +0400
@@ -267,8 +267,13 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
 	 */
 	rlim = rlimit(RLIMIT_DATA);
 	if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
-			(mm->end_data - mm->start_data) > rlim)
+			(mm->end_data - mm->start_data) > rlim) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+			send_sig(SIGKILL, current, 0);
+		}
 		goto out;
+	}
 
 	newbrk = PAGE_ALIGN(brk);
 	oldbrk = PAGE_ALIGN(mm->brk);
@@ -1654,8 +1659,13 @@ static int acct_stack_growth(struct vm_a
 		return -ENOMEM;
 
 	/* Stack limit test */
-	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur)) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+			send_sig(SIGKILL, current, 0);
+		}
 		return -ENOMEM;
+	}
 
 	/* mlock limit tests */
 	if (vma->vm_flags & VM_LOCKED) {
@@ -2375,8 +2385,13 @@ int may_expand_vm(struct mm_struct *mm, 
 
 	lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
 
-	if (cur + npages > lim)
+	if (cur + npages > lim) {
+		if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+			current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+			send_sig(SIGKILL, current, 0);
+		}
 		return 0;
+	}
 	return 1;
 }
 
diff -ruNp linux-2.6.34.5/mm/mprotect.c linux-2.6.34.5-cher1/mm/mprotect.c
--- linux-2.6.34.5/mm/mprotect.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/mm/mprotect.c	2010-08-26 14:45:12.711557228 +0400
@@ -229,6 +229,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
 	if (grows == (PROT_GROWSDOWN|PROT_GROWSUP)) /* can't be both */
 		return -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+		return -EPERM;
+
 	if (start & ~PAGE_MASK)
 		return -EINVAL;
 	if (!len)
diff -ruNp linux-2.6.34.5/mm/mremap.c linux-2.6.34.5-cher1/mm/mremap.c
--- linux-2.6.34.5/mm/mremap.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/mm/mremap.c	2010-08-26 14:45:12.712578951 +0400
@@ -513,6 +513,9 @@ SYSCALL_DEFINE5(mremap, unsigned long, a
 {
 	unsigned long ret;
 
+        if (SBOX_IS_RESTRICTED())
+        	return -EPERM;
+
 	down_write(&current->mm->mmap_sem);
 	ret = do_mremap(addr, old_len, new_len, flags, new_addr);
 	up_write(&current->mm->mmap_sem);
diff -ruNp linux-2.6.34.5/mm/swapfile.c linux-2.6.34.5-cher1/mm/swapfile.c
--- linux-2.6.34.5/mm/swapfile.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/mm/swapfile.c	2010-08-26 14:45:12.714572598 +0400
@@ -1534,6 +1534,11 @@ SYSCALL_DEFINE1(swapoff, const char __us
 	int i, type, prev;
 	int err;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
@@ -1804,6 +1809,11 @@ SYSCALL_DEFINE2(swapon, const char __use
 	struct inode *inode = NULL;
 	int did_down = 0;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
diff -ruNp linux-2.6.34.5/net/compat.c linux-2.6.34.5-cher1/net/compat.c
--- linux-2.6.34.5/net/compat.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/net/compat.c	2010-08-26 14:45:12.727557255 +0400
@@ -391,6 +391,11 @@ asmlinkage long compat_sys_setsockopt(in
 	int err;
 	struct socket *sock;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if ((sock = sockfd_lookup(fd, &err))!=NULL)
 	{
 		err = security_socket_setsockopt(sock,level,optname);
@@ -504,6 +509,11 @@ asmlinkage long compat_sys_getsockopt(in
 	int err;
 	struct socket *sock;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if ((sock = sockfd_lookup(fd, &err))!=NULL)
 	{
 		err = security_socket_getsockopt(sock, level,
@@ -760,6 +770,11 @@ asmlinkage long compat_sys_recvmmsg(int 
 	int datagrams;
 	struct timespec ktspec;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (timeout == NULL)
 		return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
 				      flags | MSG_CMSG_COMPAT, NULL);
@@ -781,6 +796,11 @@ asmlinkage long compat_sys_socketcall(in
 	u32 a[6];
 	u32 a0, a1;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (call < SYS_SOCKET || call > SYS_RECVMMSG)
 		return -EINVAL;
 	if (copy_from_user(a, args, nas[call]))
diff -ruNp linux-2.6.34.5/net/socket.c linux-2.6.34.5-cher1/net/socket.c
--- linux-2.6.34.5/net/socket.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/net/socket.c	2010-08-26 14:45:12.728572551 +0400
@@ -1297,6 +1297,11 @@ SYSCALL_DEFINE3(socket, int, family, int
 	struct socket *sock;
 	int flags;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	/* Check the SOCK_* constants for consistency.  */
 	BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
@@ -1340,6 +1345,11 @@ SYSCALL_DEFINE4(socketpair, int, family,
 	struct file *newfile1, *newfile2;
 	int flags;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	flags = type & ~SOCK_TYPE_MASK;
 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
 		return -EINVAL;
@@ -1419,6 +1429,11 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
 	struct sockaddr_storage address;
 	int err, fput_needed;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock) {
 		err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
@@ -1448,6 +1463,11 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
 	int err, fput_needed;
 	int somaxconn;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock) {
 		somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
@@ -1483,6 +1503,11 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
 	int err, len, newfd, fput_needed;
 	struct sockaddr_storage address;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
 		return -EINVAL;
 
@@ -1573,6 +1598,11 @@ SYSCALL_DEFINE3(connect, int, fd, struct
 	struct sockaddr_storage address;
 	int err, fput_needed;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1605,6 +1635,11 @@ SYSCALL_DEFINE3(getsockname, int, fd, st
 	struct sockaddr_storage address;
 	int len, err, fput_needed;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1636,6 +1671,11 @@ SYSCALL_DEFINE3(getpeername, int, fd, st
 	struct sockaddr_storage address;
 	int len, err, fput_needed;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_getpeername(sock);
@@ -1672,6 +1712,11 @@ SYSCALL_DEFINE6(sendto, int, fd, void __
 	struct iovec iov;
 	int fput_needed;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1729,6 +1774,11 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void 
 	int err, err2;
 	int fput_needed;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1778,6 +1828,11 @@ SYSCALL_DEFINE5(setsockopt, int, fd, int
 	int err, fput_needed;
 	struct socket *sock;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (optlen < 0)
 		return -EINVAL;
 
@@ -1812,6 +1867,11 @@ SYSCALL_DEFINE5(getsockopt, int, fd, int
 	int err, fput_needed;
 	struct socket *sock;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_getsockopt(sock, level, optname);
@@ -1841,6 +1901,11 @@ SYSCALL_DEFINE2(shutdown, int, fd, int, 
 	int err, fput_needed;
 	struct socket *sock;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_shutdown(sock, how);
@@ -1877,6 +1942,11 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct
 	int err, ctl_len, iov_size, total_len;
 	int fput_needed;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	err = -EFAULT;
 	if (MSG_CMSG_COMPAT & flags) {
 		if (get_compat_msghdr(&msg_sys, msg_compat))
@@ -2070,6 +2140,11 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct
 	struct msghdr msg_sys;
 	struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (!sock)
 		goto out;
 
@@ -2192,6 +2267,11 @@ SYSCALL_DEFINE5(recvmmsg, int, fd, struc
 	int datagrams;
 	struct timespec timeout_sys;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (!timeout)
 		return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
 
@@ -2234,6 +2314,11 @@ SYSCALL_DEFINE2(socketcall, int, call, u
 	int err;
 	unsigned int len;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	if (call < 1 || call > SYS_RECVMMSG)
 		return -EINVAL;
 
diff -ruNp linux-2.6.34.5/security/keys/keyctl.c linux-2.6.34.5-cher1/security/keys/keyctl.c
--- linux-2.6.34.5/security/keys/keyctl.c	2010-08-20 22:52:05.000000000 +0400
+++ linux-2.6.34.5-cher1/security/keys/keyctl.c	2010-08-26 14:45:12.738562093 +0400
@@ -66,6 +66,11 @@ SYSCALL_DEFINE5(add_key, const char __us
 	long ret;
 	bool vm;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	ret = -EINVAL;
 	if (plen > 1024 * 1024 - 1)
 		goto error;
@@ -158,6 +163,11 @@ SYSCALL_DEFINE4(request_key, const char 
 	char type[32], *description, *callout_info;
 	long ret;
 
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	/* pull the type into kernel space */
 	ret = key_get_type_from_user(type, _type, sizeof(type));
 	if (ret < 0)
@@ -1345,6 +1355,11 @@ error_keyring:
 SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
 		unsigned long, arg4, unsigned long, arg5)
 {
+	if (SBOX_IS_RESTRICTED()) {
+		SBOX_SET_SECURITY_ERR();
+		return -EPERM;
+	}
+
 	switch (option) {
 	case KEYCTL_GET_KEYRING_ID:
 		return keyctl_get_keyring_ID((key_serial_t) arg2,
diff -ruNp linux-2.6.34.5/tools/make-syscall-table.cpp linux-2.6.34.5-cher1/tools/make-syscall-table.cpp
--- linux-2.6.34.5/tools/make-syscall-table.cpp	1970-01-01 03:00:00.000000000 +0300
+++ linux-2.6.34.5-cher1/tools/make-syscall-table.cpp	2010-08-26 14:45:12.750710944 +0400
@@ -0,0 +1,339 @@
+#include <stdio.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <ctype.h>
+#include <string.h>
+#include <string>
+#include <iostream>
+#include <map>
+
+using namespace std;
+
+void
+die(const char *msg, ...)
+    __attribute__((noreturn, format(printf, 1, 2)));
+void
+die(const char *format, ...)
+{
+    va_list args;
+    char buf[1024];
+
+    va_start(args, format);
+    vsnprintf(buf, sizeof(buf), format, args);
+    va_end(args);
+
+    fprintf(stderr, "fatal: %s\n", buf);
+
+    exit(1);
+}
+
+class SyscallName
+{
+public:
+    SyscallName(const string &name_, const string &arch_)
+        : name(name_),
+          arch(arch_)
+    {
+    }
+
+    string get_name() const { return name; }
+    string get_arch() const { return arch; }
+
+    friend bool operator == (const SyscallName &v1, const SyscallName &v2);
+    friend bool operator != (const SyscallName &v1, const SyscallName &v2);
+    friend bool operator <= (const SyscallName &v1, const SyscallName &v2);
+    friend bool operator < (const SyscallName &v1, const SyscallName &v2);
+    friend bool operator > (const SyscallName &v1, const SyscallName &v2);
+    friend bool operator >= (const SyscallName &v1, const SyscallName &v2);
+
+private:
+    string name;
+    string arch;
+};
+
+bool
+operator == (const SyscallName &v1, const SyscallName &v2)
+{
+    return v1.name == v2.name && v1.arch == v2.arch;
+}
+
+bool
+operator != (const SyscallName &v1, const SyscallName &v2)
+{
+    return v1.name != v2.name || v1.arch != v2.arch;
+}
+
+bool
+operator < (const SyscallName &v1, const SyscallName &v2)
+{
+    if (v1.name == v2.name) return v1.arch < v2.arch;
+    return v1.name < v2.name;
+}
+
+bool
+operator <= (const SyscallName &v1, const SyscallName &v2)
+{
+    if (v1.name == v2.name) return v1.arch <= v2.arch;
+    return v1.name <= v2.name;
+}
+
+bool
+operator > (const SyscallName &v1, const SyscallName &v2)
+{
+    if (v1.name == v2.name) return v1.arch > v2.arch;
+    return v1.name > v2.name;
+}
+
+bool
+operator >= (const SyscallName &v1, const SyscallName &v2)
+{
+    if (v1.name == v2.name) return v1.arch >= v2.arch;
+    return v1.name >= v2.name;
+}
+
+enum SyscallMode
+{
+    UNDEFINED,
+    ALLOWED,
+    RESTRICTED,
+    SECURED,
+    REDIRECT,
+    UNIMPLEMENTED
+};
+
+class SyscallInfo
+{
+public:
+    SyscallInfo()
+    {
+    }
+
+    SyscallInfo(string source_file_, SyscallMode mode_, string ref_func_)
+        : source_file(source_file_),
+          mode(mode_),
+          ref_func(ref_func_)
+    {
+    }
+
+    string get_source_file() const { return source_file; }
+    SyscallMode get_mode() const { return mode; }
+    string get_mode_str() const
+    {
+        switch (mode) {
+        case ALLOWED:
+            return "OK ";
+        case RESTRICTED:
+            return "CAP";
+        case SECURED:
+            return "SEC";
+        case REDIRECT:
+            return "RED";
+        case UNIMPLEMENTED:
+            return "---";
+        default:
+            return "???";
+        }
+    }
+    string get_ref_func() const { return ref_func; }
+
+    void set_mode(SyscallMode mode_)
+    {
+        mode = mode_;
+    }
+    void set_ref_func(string ref_func_)
+    {
+        ref_func = ref_func_;
+    }
+
+private:
+    string source_file;
+    SyscallMode mode;
+    string ref_func;
+};
+
+map<SyscallName, SyscallInfo> sysinfos;
+
+void
+read_in_file(const char *path)
+{
+    FILE *in = NULL;
+    char buf[1024];
+    char func_name[sizeof(buf)];
+    char mode_str[sizeof(buf)];
+    char ref_str[sizeof(buf)];
+    size_t len;
+    int lineno = 0;
+    string current_file_name;
+
+    if (!(in = fopen(path, "r"))) die("cannot open `%s'", path);
+    while (fgets(buf, sizeof(buf), in)) {
+        len = strlen(buf);
+        lineno++;
+        if (len > sizeof(buf) - 4) die("[%d] line is too long", lineno);
+        while (len > 0 && isspace(buf[len - 1])) {
+            len--;
+        }
+        buf[len] = 0;
+        if (!len) continue;
+
+        if (buf[len - 1] == ':') {
+            buf[--len] = 0;
+            if (!len) die("[%d] invalid file name", lineno);
+            current_file_name = string(buf);
+            //cerr << "File: " << current_file_name << endl;
+            continue;
+        }
+
+        int n = 0;
+        char const *p = buf;
+        if (sscanf(p, "%s%n", func_name, &n) != 1)
+            die("[%d] cannot parse function name", lineno);
+        p += n;
+        if (sscanf(p, "%s%n", mode_str, &n) != 1) die("[%d] cannot parse mode string", lineno);
+        p += n;
+        ref_str[0] = 0;
+	sscanf(p, "%s%n", ref_str, &n);
+        p += n;
+
+        SyscallMode mode = UNDEFINED;
+
+        if (!strcmp(mode_str, "allowed")) {
+            mode = ALLOWED;
+        } else if (!strcmp(mode_str, "restricted")) {
+            mode = RESTRICTED;
+        } else if (!strcmp(mode_str, "secured")) {
+            mode = SECURED;
+        } else if (!strcmp(mode_str, "redirect")) {
+            mode = REDIRECT;
+        } else if (!strcmp(mode_str, "unimpl")) {
+            mode = UNIMPLEMENTED;
+        } else {
+            die("[%d] invalid mode line %s", lineno, mode_str);
+        }
+
+        string ref_func;
+        if (mode == REDIRECT)
+            ref_func = ref_str;
+
+        SyscallName sn(string(func_name), "");
+        SyscallInfo si(current_file_name, mode, ref_func);
+
+        sysinfos[sn] = si;
+    }
+    fclose(in); in = NULL;
+}
+
+void
+handle_redirects(void)
+{
+    bool flag = true;
+
+    while (flag) {
+        flag = false;
+
+        map<SyscallName, SyscallInfo>::const_iterator ii;
+        for (ii = sysinfos.begin(); ii != sysinfos.end(); ++ii) {
+            SyscallName sn = ii->first;
+            SyscallInfo si = ii->second;
+            if (si.get_mode() != REDIRECT) continue;
+
+            SyscallName sn2(si.get_ref_func(), "");
+            map<SyscallName, SyscallInfo>::const_iterator ii2;
+            ii2 = sysinfos.find(sn2);
+            if (ii2 == sysinfos.end()) die("invalid redirect %s", si.get_ref_func().c_str());
+            SyscallInfo si2 = ii2->second;
+            si.set_mode(si2.get_mode());
+            si.set_ref_func(si2.get_ref_func());
+            sysinfos[sn] = si;
+            flag = true;
+
+            //cerr << "redirect: " << sn.get_name() << "->" << si2.get_ref_func() << endl;
+        }
+    }
+}
+
+void
+process_file(const char *path)
+{
+    char out_name[1024];
+    FILE *in = NULL;
+    FILE *out = NULL;
+    char buf[1024];
+    size_t len;
+    char syscall_name[sizeof(buf)];
+
+    snprintf(out_name, sizeof(out_name), "%s.out", path);
+
+    if (!(in = fopen(path, "r"))) die("cannot open input file %s", path);
+    if (!(out = fopen(out_name, "w"))) die("cannot open output file %s", out_name);
+
+    while (fgets(buf, sizeof(buf), in)) {
+        len = strlen(buf);
+        if (len > sizeof(buf) - 4) die("line is too long in %s", path);
+        while (len > 0 && isspace(buf[len - 1])) {
+            len--;
+        }
+        buf[len] = 0;
+        if (len == 0) {
+            fprintf(out, "\n");
+            continue;
+        }
+
+        sscanf(buf, "%s", syscall_name);
+        map<SyscallName, SyscallInfo>::const_iterator ii;
+        ii = sysinfos.find(SyscallName(string(syscall_name), ""));
+        if (ii == sysinfos.end()) {
+            fprintf(out, "%s\n", buf);
+            continue;
+        }
+
+        SyscallName sn = ii->first;
+        SyscallInfo si = ii->second;
+
+        if (si.get_mode() == UNIMPLEMENTED) {
+            fprintf(out, "%-32s%-8s\n",
+                    sn.get_name().c_str(),
+                    si.get_mode_str().c_str());
+            continue;
+        }
+
+        fprintf(out, "%-32s%-8s%s\n",
+                sn.get_name().c_str(),
+                si.get_mode_str().c_str(),
+                si.get_source_file().c_str());
+    }
+
+    fclose(in); in = NULL;
+    fclose(out); out = NULL;
+}
+
+int main(int argc, char **argv)
+{
+    if (argc <= 1) die("invalid number of arguments");
+    read_in_file(argv[1]);
+
+    handle_redirects();
+
+    for (int i = 2; i < argc; ++i) {
+        process_file(argv[i]);
+    }
+
+    /*
+    map<SyscallName, SyscallInfo>::const_iterator ii;
+    for (ii = sysinfos.begin(); ii != sysinfos.end(); ++ii) {
+        SyscallName sn = ii->first;
+        SyscallInfo si = ii->second;
+
+        cerr << sn.get_name() << "," << si.get_source_file() << "," << si.get_mode_str() << endl;
+    }
+    */
+
+    return 0;
+}
+
+/*
+ * Local variables:
+ *  compile-command: "g++ -g -Wall make-syscall-table.cpp -o make-syscall-table"
+ *  c-basic-offset: 4
+ * End:
+ */
