diff -ruNp linux-3.12.6/arch/x86/ia32/sys_ia32.c linux-3.12.6-cher1/arch/x86/ia32/sys_ia32.c
--- linux-3.12.6/arch/x86/ia32/sys_ia32.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/arch/x86/ia32/sys_ia32.c	2013-12-24 13:58:59.323816360 +0400
@@ -95,12 +95,26 @@ static int cp_stat64(struct stat64 __use
 	return 0;
 }
 
+int cher_patch_is_secure_path(const char *);
+
 asmlinkage long sys32_stat64(const char __user *filename,
 			     struct stat64 __user *statbuf)
 {
 	struct kstat stat;
-	int ret = vfs_stat(filename, &stat);
+	int ret = 0;
+
+        if (SBOX_IS_RESTRICTED()) {
+                struct filename *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp->name) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp->name, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
 
+        ret = vfs_stat(filename, &stat);
 	if (!ret)
 		ret = cp_stat64(statbuf, &stat);
 	return ret;
@@ -110,7 +124,20 @@ asmlinkage long sys32_lstat64(const char
 			      struct stat64 __user *statbuf)
 {
 	struct kstat stat;
-	int ret = vfs_lstat(filename, &stat);
+	int ret = 0;
+
+        if (SBOX_IS_RESTRICTED()) {
+                struct filename *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp->name) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp->name, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
+	ret = vfs_lstat(filename, &stat);
 	if (!ret)
 		ret = cp_stat64(statbuf, &stat);
 	return ret;
@@ -131,6 +158,10 @@ asmlinkage long sys32_fstatat(unsigned i
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 	error = vfs_fstatat(dfd, filename, &stat, flag);
 	if (error)
 		return error;
@@ -206,6 +237,11 @@ long sys32_vm86_warning(void)
 	struct task_struct *me = current;
 	static char lastcomm[sizeof(me->comm)];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (strncmp(lastcomm, me->comm, sizeof(lastcomm))) {
 		compat_printk(KERN_INFO
 			      "%s: vm86 mode not supported on 64 bit kernel\n",
diff -ruNp linux-3.12.6/arch/x86/kernel/ioport.c linux-3.12.6-cher1/arch/x86/kernel/ioport.c
--- linux-3.12.6/arch/x86/kernel/ioport.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/arch/x86/kernel/ioport.c	2013-12-24 13:58:59.323816360 +0400
@@ -26,6 +26,11 @@ asmlinkage long sys_ioperm(unsigned long
 	struct tss_struct *tss;
 	unsigned int i, max_long, bytes, bytes_updated;
 
+        if (SBOX_IS_RESTRICTED()) {
+                //SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
 		return -EINVAL;
 	if (turn_on && !capable(CAP_SYS_RAWIO))
@@ -99,6 +104,11 @@ SYSCALL_DEFINE1(iopl, unsigned int, leve
 	unsigned int old = (regs->flags >> 12) & 3;
 	struct thread_struct *t = &current->thread;
 
+        if (SBOX_IS_RESTRICTED()) {
+                //SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (level > 3)
 		return -EINVAL;
 	/* Trying to gain more privileges? */
diff -ruNp linux-3.12.6/arch/x86/kernel/ldt.c linux-3.12.6-cher1/arch/x86/kernel/ldt.c
--- linux-3.12.6/arch/x86/kernel/ldt.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/arch/x86/kernel/ldt.c	2013-12-24 13:58:59.323816360 +0400
@@ -249,6 +249,11 @@ asmlinkage int sys_modify_ldt(int func,
 {
 	int ret = -ENOSYS;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	switch (func) {
 	case 0:
 		ret = read_ldt(ptr, bytecount);
diff -ruNp linux-3.12.6/arch/x86/kernel/vm86_32.c linux-3.12.6-cher1/arch/x86/kernel/vm86_32.c
--- linux-3.12.6/arch/x86/kernel/vm86_32.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/arch/x86/kernel/vm86_32.c	2013-12-24 13:58:59.323816360 +0400
@@ -212,6 +212,11 @@ SYSCALL_DEFINE1(vm86old, struct vm86_str
 	struct task_struct *tsk = current;
 	int tmp;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (tsk->thread.saved_sp0)
 		return -EPERM;
 	tmp = copy_vm86_regs_from_user(&info.regs, &v86->regs,
@@ -238,6 +243,11 @@ SYSCALL_DEFINE2(vm86, unsigned long, cmd
 	int tmp;
 	struct vm86plus_struct __user *v86;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	tsk = current;
 	switch (cmd) {
 	case VM86_REQUEST_IRQ:
diff -ruNp linux-3.12.6/arch/x86/syscalls/syscall_32.patched.tbl linux-3.12.6-cher1/arch/x86/syscalls/syscall_32.patched.tbl
--- linux-3.12.6/arch/x86/syscalls/syscall_32.patched.tbl	1970-01-01 03:00:00.000000000 +0300
+++ linux-3.12.6-cher1/arch/x86/syscalls/syscall_32.patched.tbl	2013-12-24 13:58:59.383817161 +0400
@@ -0,0 +1,359 @@
+#
+# 32-bit system call numbers and entry vectors
+#
+# The format is:
+# <number> <abi> <name> <entry point> <compat entry point>
+#
+# The abi is always "i386" for this file.
+#
++0	i386	restart_syscall		sys_restart_syscall
++1	i386	exit			sys_exit
+-2	i386	fork			sys_fork			stub32_fork
++3	i386	read			sys_read
++4	i386	write			sys_write
+-5	i386	open			sys_open			?compat_sys_open
++6	i386	close			sys_close
++7	i386	waitpid			sys_waitpid			?sys32_waitpid
+-8	i386	creat			sys_creat
+-9	i386	link			sys_link
+-10	i386	unlink			sys_unlink
+-11	i386	execve			sys_execve			stub32_execve
+-12	i386	chdir			sys_chdir
++13	i386	time			sys_time			-compat_sys_time
+-14	i386	mknod			sys_mknod
+-15	i386	chmod			sys_chmod
+-16	i386	lchown			sys_lchown16
++17	i386	break
+-18	i386	oldstat			sys_stat
++19	i386	lseek			sys_lseek			compat_sys_lseek
++20	i386	getpid			sys_getpid
+-21	i386	mount			sys_mount			-compat_sys_mount
+-22	i386	umount			sys_oldumount
+-23	i386	setuid			sys_setuid16
++24	i386	getuid			sys_getuid16
+-25	i386	stime			sys_stime			-compat_sys_stime
+-26	i386	ptrace			sys_ptrace			compat_sys_ptrace
++27	i386	alarm			sys_alarm
++28	i386	oldfstat		sys_fstat
++29	i386	pause			sys_pause
+-30	i386	utime			sys_utime			-compat_sys_utime
+31	i386	stty
+32	i386	gtty
+-33	i386	access			sys_access
+-34	i386	nice			sys_nice
+35	i386	ftime
+-36	i386	sync			sys_sync
+-37	i386	kill			sys_kill
+-38	i386	rename			sys_rename
+-39	i386	mkdir			sys_mkdir
+-40	i386	rmdir			sys_rmdir
+41	i386	dup			sys_dup
+-42	i386	pipe			sys_pipe
++43	i386	times			sys_times			-compat_sys_times
+44	i386	prof
++45	i386	brk			sys_brk
+-46	i386	setgid			sys_setgid16
++47	i386	getgid			sys_getgid16
++48	i386	signal			sys_signal
++49	i386	geteuid			sys_geteuid16
++50	i386	getegid			sys_getegid16
+-51	i386	acct			sys_acct
+-52	i386	umount2			sys_umount
+53	i386	lock
+-54	i386	ioctl			sys_ioctl			-compat_sys_ioctl
+-55	i386	fcntl			sys_fcntl			-compat_sys_fcntl64
+56	i386	mpx
+-57	i386	setpgid			sys_setpgid
+58	i386	ulimit
++59	i386	oldolduname		sys_olduname
+-60	i386	umask			sys_umask
+-61	i386	chroot			sys_chroot
+-62	i386	ustat			sys_ustat			-compat_sys_ustat
+63	i386	dup2			sys_dup2
++64	i386	getppid			sys_getppid
++65	i386	getpgrp			sys_getpgrp
+-66	i386	setsid			sys_setsid
++67	i386	sigaction		sys_sigaction			compat_sys_sigaction
++68	i386	sgetmask		sys_sgetmask
+-69	i386	ssetmask		sys_ssetmask
+-70	i386	setreuid		sys_setreuid16
+-71	i386	setregid		sys_setregid16
++72	i386	sigsuspend		sys_sigsuspend			sys_sigsuspend
++73	i386	sigpending		sys_sigpending			+compat_sys_sigpending
+-74	i386	sethostname		sys_sethostname
+-75	i386	setrlimit		sys_setrlimit			-compat_sys_setrlimit
++76	i386	getrlimit		sys_old_getrlimit		+compat_sys_old_getrlimit
++77	i386	getrusage		sys_getrusage			compat_sys_getrusage
++78	i386	gettimeofday		sys_gettimeofday		+compat_sys_gettimeofday
+-79	i386	settimeofday		sys_settimeofday		-compat_sys_settimeofday
++80	i386	getgroups		sys_getgroups16
+-81	i386	setgroups		sys_setgroups16
+82	i386	select			sys_old_select			+compat_sys_old_select
+-83	i386	symlink			sys_symlink
+-84	i386	oldlstat		sys_lstat
+-85	i386	readlink		sys_readlink
+-86	i386	uselib			sys_uselib
+-87	i386	swapon			sys_swapon
+-88	i386	reboot			sys_reboot
++89	i386	readdir			sys_old_readdir			compat_sys_old_readdir
+90	i386	mmap			sys_old_mmap			+sys32_mmap
+91	i386	munmap			sys_munmap
+-92	i386	truncate		sys_truncate			compat_sys_truncate
+-93	i386	ftruncate		sys_ftruncate			compat_sys_ftruncate
+-94	i386	fchmod			sys_fchmod
+-95	i386	fchown			sys_fchown16
++96	i386	getpriority		sys_getpriority
+-97	i386	setpriority		sys_setpriority
+98	i386	profil
+-99	i386	statfs			sys_statfs			-compat_sys_statfs
+-100	i386	fstatfs			sys_fstatfs			-compat_sys_fstatfs
+-101	i386	ioperm			sys_ioperm
+-102	i386	socketcall		sys_socketcall			-compat_sys_socketcall
+-103	i386	syslog			sys_syslog
+104	i386	setitimer		sys_setitimer			-compat_sys_setitimer
+105	i386	getitimer		sys_getitimer			-compat_sys_getitimer
+-106	i386	stat			sys_newstat			-compat_sys_newstat
+-107	i386	lstat			sys_newlstat			-compat_sys_newlstat
++108	i386	fstat			sys_newfstat			+compat_sys_newfstat
++109	i386	olduname		sys_uname
+-110	i386	iopl			sys_iopl
+-111	i386	vhangup			sys_vhangup
+112	i386	idle
+-113	i386	vm86old			sys_vm86old			-sys32_vm86_warning
+114	i386	wait4			sys_wait4			?compat_sys_wait4
+-115	i386	swapoff			sys_swapoff
+-116	i386	sysinfo			sys_sysinfo			compat_sys_sysinfo
+-117	i386	ipc			sys_ipc				compat_sys_ipc
+-118	i386	fsync			sys_fsync
+119	i386	sigreturn		sys_sigreturn			stub32_sigreturn
+-120	i386	clone			sys_clone			stub32_clone
+-121	i386	setdomainname		sys_setdomainname
++122	i386	uname			sys_newuname
+-123	i386	modify_ldt		sys_modify_ldt
+-124	i386	adjtimex		sys_adjtimex			-compat_sys_adjtimex
++125	i386	mprotect		sys_mprotect
+-126	i386	sigprocmask		sys_sigprocmask			-compat_sys_sigprocmask
+127	i386	create_module
+-128	i386	init_module		sys_init_module
+-129	i386	delete_module		sys_delete_module
+130	i386	get_kernel_syms
+-131	i386	quotactl		sys_quotactl			-sys32_quotactl
++132	i386	getpgid			sys_getpgid
+-133	i386	fchdir			sys_fchdir
+-134	i386	bdflush			sys_bdflush
+-135	i386	sysfs			sys_sysfs
+-136	i386	personality		sys_personality
+137	i386	afs_syscall
+-138	i386	setfsuid		sys_setfsuid16
+-139	i386	setfsgid		sys_setfsgid16
++140	i386	_llseek			sys_llseek
++141	i386	getdents		sys_getdents			+compat_sys_getdents
+142	i386	_newselect		sys_select			+compat_sys_select
+-143	i386	flock			sys_flock
+-144	i386	msync			sys_msync
++145	i386	readv			sys_readv			compat_sys_readv
++146	i386	writev			sys_writev			compat_sys_writev
++147	i386	getsid			sys_getsid
+-148	i386	fdatasync		sys_fdatasync
+-149	i386	_sysctl			sys_sysctl			compat_sys_sysctl
+-150	i386	mlock			sys_mlock
+-151	i386	munlock			sys_munlock
+-152	i386	mlockall		sys_mlockall
+-153	i386	munlockall		sys_munlockall
+-154	i386	sched_setparam		sys_sched_setparam
++155	i386	sched_getparam		sys_sched_getparam
+-156	i386	sched_setscheduler	sys_sched_setscheduler
++157	i386	sched_getscheduler	sys_sched_getscheduler
++158	i386	sched_yield		sys_sched_yield
++159	i386	sched_get_priority_max	sys_sched_get_priority_max
++160	i386	sched_get_priority_min	sys_sched_get_priority_min
++161	i386	sched_rr_get_interval	sys_sched_rr_get_interval	+compat_sys_sched_rr_get_interval
+162	i386	nanosleep		sys_nanosleep			+compat_sys_nanosleep
+163	i386	mremap			sys_mremap
+-164	i386	setresuid		sys_setresuid16
++165	i386	getresuid		sys_getresuid16
+-166	i386	vm86			sys_vm86			-sys32_vm86_warning
+167	i386	query_module
+168	i386	poll			sys_poll
+169	i386	nfsservctl
+-170	i386	setresgid		sys_setresgid16
++171	i386	getresgid		sys_getresgid16
+-172	i386	prctl			sys_prctl
+173	i386	rt_sigreturn		sys_rt_sigreturn		stub32_rt_sigreturn
+-174	i386	rt_sigaction		sys_rt_sigaction		compat_sys_rt_sigaction
+-175	i386	rt_sigprocmask		sys_rt_sigprocmask
++176	i386	rt_sigpending		sys_rt_sigpending		compat_sys_rt_sigpending
++177	i386	rt_sigtimedwait		sys_rt_sigtimedwait		+compat_sys_rt_sigtimedwait
++178	i386	rt_sigqueueinfo		sys_rt_sigqueueinfo		compat_sys_rt_sigqueueinfo
++179	i386	rt_sigsuspend		sys_rt_sigsuspend
+-180	i386	pread64			sys_pread64			?sys32_pread
+-181	i386	pwrite64		sys_pwrite64			?sys32_pwrite
+-182	i386	chown			sys_chown16
+-183	i386	getcwd			sys_getcwd
++184	i386	capget			sys_capget
+-185	i386	capset			sys_capset
+-186	i386	sigaltstack		sys_sigaltstack			compat_sys_sigaltstack
++187	i386	sendfile		sys_sendfile			compat_sys_sendfile
+188	i386	getpmsg
+189	i386	putpmsg
+-190	i386	vfork			sys_vfork			stub32_vfork
++191	i386	ugetrlimit		sys_getrlimit			+compat_sys_getrlimit
+192	i386	mmap2			sys_mmap_pgoff
+-193	i386	truncate64		sys_truncate64			?sys32_truncate64
+-194	i386	ftruncate64		sys_ftruncate64			?sys32_ftruncate64
+-195	i386	stat64			sys_stat64			-sys32_stat64
+-196	i386	lstat64			sys_lstat64			-sys32_lstat64
++197	i386	fstat64			sys_fstat64			+sys32_fstat64
+-198	i386	lchown32		sys_lchown
+199	i386	getuid32		sys_getuid
+200	i386	getgid32		sys_getgid
+201	i386	geteuid32		sys_geteuid
+202	i386	getegid32		sys_getegid
+-203	i386	setreuid32		sys_setreuid
+-204	i386	setregid32		sys_setregid
+205	i386	getgroups32		sys_getgroups
+-206	i386	setgroups32		sys_setgroups
+-207	i386	fchown32		sys_fchown
+-208	i386	setresuid32		sys_setresuid
++209	i386	getresuid32		sys_getresuid
+-210	i386	setresgid32		sys_setresgid
++211	i386	getresgid32		sys_getresgid
+-212	i386	chown32			sys_chown
+-213	i386	setuid32		sys_setuid
+-214	i386	setgid32		sys_setgid
+-215	i386	setfsuid32		sys_setfsuid
+-216	i386	setfsgid32		sys_setfsgid
+-217	i386	pivot_root		sys_pivot_root
+-218	i386	mincore			sys_mincore
+-219	i386	madvise			sys_madvise
++220	i386	getdents64		sys_getdents64			+compat_sys_getdents64
+-221	i386	fcntl64			sys_fcntl64			-compat_sys_fcntl64
+# 222 is unused
+# 223 is unused
++224	i386	gettid			sys_gettid
+-225	i386	readahead		sys_readahead			?sys32_readahead
+-226	i386	setxattr		sys_setxattr
+-227	i386	lsetxattr		sys_lsetxattr
+-228	i386	fsetxattr		sys_fsetxattr
+-229	i386	getxattr		sys_getxattr
+-230	i386	lgetxattr		sys_lgetxattr
+-231	i386	fgetxattr		sys_fgetxattr
+-232	i386	listxattr		sys_listxattr
+-233	i386	llistxattr		sys_llistxattr
+-234	i386	flistxattr		sys_flistxattr
+-235	i386	removexattr		sys_removexattr
+-236	i386	lremovexattr		sys_lremovexattr
+-237	i386	fremovexattr		sys_fremovexattr
+-238	i386	tkill			sys_tkill
++239	i386	sendfile64		sys_sendfile64
+240	i386	futex			sys_futex			compat_sys_futex
+-241	i386	sched_setaffinity	sys_sched_setaffinity		-compat_sys_sched_setaffinity
++242	i386	sched_getaffinity	sys_sched_getaffinity		+compat_sys_sched_getaffinity
+243	i386	set_thread_area		sys_set_thread_area
+244	i386	get_thread_area		sys_get_thread_area
+-245	i386	io_setup		sys_io_setup			-compat_sys_io_setup
+-246	i386	io_destroy		sys_io_destroy
+-247	i386	io_getevents		sys_io_getevents		-compat_sys_io_getevents
+-248	i386	io_submit		sys_io_submit			-compat_sys_io_submit
+-249	i386	io_cancel		sys_io_cancel
+-250	i386	fadvise64		sys_fadvise64			?sys32_fadvise64
+# 251 is available for reuse (was briefly sys_set_zone_reclaim)
+252	i386	exit_group		sys_exit_group
+-253	i386	lookup_dcookie		sys_lookup_dcookie		compat_sys_lookup_dcookie
+-254	i386	epoll_create		sys_epoll_create
+-255	i386	epoll_ctl		sys_epoll_ctl
+-256	i386	epoll_wait		sys_epoll_wait
+-257	i386	remap_file_pages	sys_remap_file_pages
+258	i386	set_tid_address		sys_set_tid_address
+259	i386	timer_create		sys_timer_create		-compat_sys_timer_create
+260	i386	timer_settime		sys_timer_settime		-compat_sys_timer_settime
+261	i386	timer_gettime		sys_timer_gettime		-compat_sys_timer_gettime
+262	i386	timer_getoverrun	sys_timer_getoverrun
+263	i386	timer_delete		sys_timer_delete
+264	i386	clock_settime		sys_clock_settime		-compat_sys_clock_settime
+265	i386	clock_gettime		sys_clock_gettime		-compat_sys_clock_gettime
+266	i386	clock_getres		sys_clock_getres		-compat_sys_clock_getres
+267	i386	clock_nanosleep		sys_clock_nanosleep		+compat_sys_clock_nanosleep
+-268	i386	statfs64		sys_statfs64			-compat_sys_statfs64
+-269	i386	fstatfs64		sys_fstatfs64			-compat_sys_fstatfs64
+-270	i386	tgkill			sys_tgkill
+-271	i386	utimes			sys_utimes			-compat_sys_utimes
+-272	i386	fadvise64_64		sys_fadvise64_64		?sys32_fadvise64_64
+273	i386	vserver
+-274	i386	mbind			sys_mbind
+-275	i386	get_mempolicy		sys_get_mempolicy		compat_sys_get_mempolicy
+-276	i386	set_mempolicy		sys_set_mempolicy
+-277	i386	mq_open			sys_mq_open			compat_sys_mq_open
+-278	i386	mq_unlink		sys_mq_unlink
+-279	i386	mq_timedsend		sys_mq_timedsend		compat_sys_mq_timedsend
+-280	i386	mq_timedreceive		sys_mq_timedreceive		compat_sys_mq_timedreceive
+-281	i386	mq_notify		sys_mq_notify			compat_sys_mq_notify
+-282	i386	mq_getsetattr		sys_mq_getsetattr		compat_sys_mq_getsetattr
+-283	i386	kexec_load		sys_kexec_load			compat_sys_kexec_load
+284	i386	waitid			sys_waitid			?compat_sys_waitid
+# 285 sys_setaltroot
+-286	i386	add_key			sys_add_key
+-287	i386	request_key		sys_request_key
+-288	i386	keyctl			sys_keyctl
+-289	i386	ioprio_set		sys_ioprio_set
++290	i386	ioprio_get		sys_ioprio_get
+-291	i386	inotify_init		sys_inotify_init
+-292	i386	inotify_add_watch	sys_inotify_add_watch
+-293	i386	inotify_rm_watch	sys_inotify_rm_watch
+-294	i386	migrate_pages		sys_migrate_pages
+-295	i386	openat			sys_openat			-compat_sys_openat
+-296	i386	mkdirat			sys_mkdirat
+-297	i386	mknodat			sys_mknodat
+-298	i386	fchownat		sys_fchownat
+-299	i386	futimesat		sys_futimesat			-compat_sys_futimesat
+-300	i386	fstatat64		sys_fstatat64			-sys32_fstatat
+-301	i386	unlinkat		sys_unlinkat
+-302	i386	renameat		sys_renameat
+-303	i386	linkat			sys_linkat
+-304	i386	symlinkat		sys_symlinkat
+-305	i386	readlinkat		sys_readlinkat
+-306	i386	fchmodat		sys_fchmodat
+-307	i386	faccessat		sys_faccessat
+308	i386	pselect6		sys_pselect6			+compat_sys_pselect6
+309	i386	ppoll			sys_ppoll			+compat_sys_ppoll
+310	i386	unshare			sys_unshare
+311	i386	set_robust_list		sys_set_robust_list		compat_sys_set_robust_list
+312	i386	get_robust_list		sys_get_robust_list		compat_sys_get_robust_list
+-313	i386	splice			sys_splice
+-314	i386	sync_file_range		sys_sync_file_range		?sys32_sync_file_range
+-315	i386	tee			sys_tee
+-316	i386	vmsplice		sys_vmsplice			compat_sys_vmsplice
+-317	i386	move_pages		sys_move_pages			-compat_sys_move_pages
++318	i386	getcpu			sys_getcpu
+-319	i386	epoll_pwait		sys_epoll_pwait
+-320	i386	utimensat		sys_utimensat			-compat_sys_utimensat
+-321	i386	signalfd		sys_signalfd			compat_sys_signalfd
+-322	i386	timerfd_create		sys_timerfd_create
+-323	i386	eventfd			sys_eventfd
+-324	i386	fallocate		sys_fallocate			?sys32_fallocate
+-325	i386	timerfd_settime		sys_timerfd_settime		compat_sys_timerfd_settime
+-326	i386	timerfd_gettime		sys_timerfd_gettime		compat_sys_timerfd_gettime
+-327	i386	signalfd4		sys_signalfd4			compat_sys_signalfd4
+-328	i386	eventfd2		sys_eventfd2
+-329	i386	epoll_create1		sys_epoll_create1
+330	i386	dup3			sys_dup3
+-331	i386	pipe2			sys_pipe2
+-332	i386	inotify_init1		sys_inotify_init1
+-333	i386	preadv			sys_preadv			compat_sys_preadv
+-334	i386	pwritev			sys_pwritev			compat_sys_pwritev
++335	i386	rt_tgsigqueueinfo	sys_rt_tgsigqueueinfo		compat_sys_rt_tgsigqueueinfo
+-336	i386	perf_event_open		sys_perf_event_open
+-337	i386	recvmmsg		sys_recvmmsg			-compat_sys_recvmmsg
+-338	i386	fanotify_init		sys_fanotify_init
+-339	i386	fanotify_mark		sys_fanotify_mark		compat_sys_fanotify_mark
+-340	i386	prlimit64		sys_prlimit64
+-341	i386	name_to_handle_at	sys_name_to_handle_at
+-342	i386	open_by_handle_at	sys_open_by_handle_at		-compat_sys_open_by_handle_at
+343	i386	clock_adjtime		sys_clock_adjtime		-compat_sys_clock_adjtime
+-344	i386	syncfs			sys_syncfs
+-345	i386	sendmmsg		sys_sendmmsg			-compat_sys_sendmmsg
+-346	i386	setns			sys_setns
+-347	i386	process_vm_readv	sys_process_vm_readv		compat_sys_process_vm_readv
+-348	i386	process_vm_writev	sys_process_vm_writev		compat_sys_process_vm_writev
+-349	i386	kcmp			sys_kcmp
+-350	i386	finit_module		sys_finit_module
diff -ruNp linux-3.12.6/arch/x86/syscalls/syscall_64.patched.tbl linux-3.12.6-cher1/arch/x86/syscalls/syscall_64.patched.tbl
--- linux-3.12.6/arch/x86/syscalls/syscall_64.patched.tbl	1970-01-01 03:00:00.000000000 +0300
+++ linux-3.12.6-cher1/arch/x86/syscalls/syscall_64.patched.tbl	2013-12-24 13:58:59.383817161 +0400
@@ -0,0 +1,358 @@
+#
+# 64-bit system call numbers and entry vectors
+#
+# The format is:
+# <number> <abi> <name> <entry point>
+#
+# The abi is "common", "64" or "x32" for this file.
+#
++0	common	read			sys_read
++1	common	write			sys_write
+-2	common	open			sys_open
++3	common	close			sys_close
+-4	common	stat			sys_newstat
++5	common	fstat			sys_newfstat
+-6	common	lstat			sys_newlstat
+7	common	poll			sys_poll
++8	common	lseek			sys_lseek
+9	common	mmap			sys_mmap
++10	common	mprotect		sys_mprotect
+11	common	munmap			sys_munmap
+12	common	brk			sys_brk
++13	64	rt_sigaction		sys_rt_sigaction
+-14	common	rt_sigprocmask		sys_rt_sigprocmask
+15	64	rt_sigreturn		stub_rt_sigreturn
+-16	64	ioctl			sys_ioctl
+-17	common	pread64			sys_pread64
+-18	common	pwrite64		sys_pwrite64
++19	64	readv			sys_readv
++20	64	writev			sys_writev
+-21	common	access			sys_access
+-22	common	pipe			sys_pipe
++23	common	select			sys_select
++24	common	sched_yield		sys_sched_yield
++25	common	mremap			sys_mremap
+-26	common	msync			sys_msync
+-27	common	mincore			sys_mincore
+-28	common	madvise			sys_madvise
+-29	common	shmget			sys_shmget
+-30	common	shmat			sys_shmat
+-31	common	shmctl			sys_shmctl
+32	common	dup			sys_dup
+33	common	dup2			sys_dup2
++34	common	pause			sys_pause
+35	common	nanosleep		sys_nanosleep
+36	common	getitimer		sys_getitimer
+37	common	alarm			sys_alarm
+38	common	setitimer		sys_setitimer
++39	common	getpid			sys_getpid
++40	common	sendfile		sys_sendfile64
+-41	common	socket			sys_socket
+-42	common	connect			sys_connect
+-43	common	accept			sys_accept
+-44	common	sendto			sys_sendto
+-45	64	recvfrom		sys_recvfrom
+-46	64	sendmsg			sys_sendmsg
+-47	64	recvmsg			sys_recvmsg
+-48	common	shutdown		sys_shutdown
+-49	common	bind			sys_bind
+-50	common	listen			sys_listen
+-51	common	getsockname		sys_getsockname
+-52	common	getpeername		sys_getpeername
+-53	common	socketpair		sys_socketpair
+-54	64	setsockopt		sys_setsockopt
+-55	64	getsockopt		sys_getsockopt
+-56	common	clone			stub_clone
+-57	common	fork			stub_fork
+-58	common	vfork			stub_vfork
+-59	64	execve			stub_execve
+60	common	exit			sys_exit
+61	common	wait4			sys_wait4
+-62	common	kill			sys_kill
++63	common	uname			sys_newuname
+-64	common	semget			sys_semget
+-65	common	semop			sys_semop
+-66	common	semctl			sys_semctl
+-67	common	shmdt			sys_shmdt
+-68	common	msgget			sys_msgget
+-69	common	msgsnd			sys_msgsnd
+-70	common	msgrcv			sys_msgrcv
+-71	common	msgctl			sys_msgctl
+-72	common	fcntl			sys_fcntl
+-73	common	flock			sys_flock
+74	common	fsync			sys_fsync
+-75	common	fdatasync		sys_fdatasync
+-76	common	truncate		sys_truncate
+77	common	ftruncate		sys_ftruncate
++78	common	getdents		sys_getdents
+-79	common	getcwd			sys_getcwd
+-80	common	chdir			sys_chdir
+-81	common	fchdir			sys_fchdir
+-82	common	rename			sys_rename
+-83	common	mkdir			sys_mkdir
+-84	common	rmdir			sys_rmdir
+-85	common	creat			sys_creat
+-86	common	link			sys_link
+-87	common	unlink			sys_unlink
+-88	common	symlink			sys_symlink
+-89	common	readlink		sys_readlink
+-90	common	chmod			sys_chmod
+-91	common	fchmod			sys_fchmod
+-92	common	chown			sys_chown
+-93	common	fchown			sys_fchown
+-94	common	lchown			sys_lchown
+-95	common	umask			sys_umask
+-96	common	gettimeofday		sys_gettimeofday
++97	common	getrlimit		sys_getrlimit
++98	common	getrusage		sys_getrusage
+-99	common	sysinfo			sys_sysinfo
++100	common	times			sys_times
+-101	64	ptrace			sys_ptrace
++102	common	getuid			sys_getuid
+-103	common	syslog			sys_syslog
++104	common	getgid			sys_getgid
+-105	common	setuid			sys_setuid
+-106	common	setgid			sys_setgid
++107	common	geteuid			sys_geteuid
++108	common	getegid			sys_getegid
+-109	common	setpgid			sys_setpgid
++110	common	getppid			sys_getppid
++111	common	getpgrp			sys_getpgrp
+-112	common	setsid			sys_setsid
+-113	common	setreuid		sys_setreuid
+-114	common	setregid		sys_setregid
+115	common	getgroups		sys_getgroups
+-116	common	setgroups		sys_setgroups
+-117	common	setresuid		sys_setresuid
++118	common	getresuid		sys_getresuid
+-119	common	setresgid		sys_setresgid
++120	common	getresgid		sys_getresgid
++121	common	getpgid			sys_getpgid
+-122	common	setfsuid		sys_setfsuid
+-123	common	setfsgid		sys_setfsgid
++124	common	getsid			sys_getsid
++125	common	capget			sys_capget
+-126	common	capset			sys_capset
++127	64	rt_sigpending		sys_rt_sigpending
++128	64	rt_sigtimedwait		sys_rt_sigtimedwait
++129	64	rt_sigqueueinfo		sys_rt_sigqueueinfo
++130	common	rt_sigsuspend		sys_rt_sigsuspend
+-131	64	sigaltstack		sys_sigaltstack
+-132	common	utime			sys_utime
+-133	common	mknod			sys_mknod
+-134	64	uselib
+-135	common	personality		sys_personality
+-136	common	ustat			sys_ustat
+-137	common	statfs			sys_statfs
+-138	common	fstatfs			sys_fstatfs
+-139	common	sysfs			sys_sysfs
++140	common	getpriority		sys_getpriority
+-141	common	setpriority		sys_setpriority
+-142	common	sched_setparam		sys_sched_setparam
++143	common	sched_getparam		sys_sched_getparam
+-144	common	sched_setscheduler	sys_sched_setscheduler
++145	common	sched_getscheduler	sys_sched_getscheduler
++146	common	sched_get_priority_max	sys_sched_get_priority_max
++147	common	sched_get_priority_min	sys_sched_get_priority_min
++148	common	sched_rr_get_interval	+sys_sched_rr_get_interval
+-149	common	mlock			sys_mlock
+-150	common	munlock			sys_munlock
+-151	common	mlockall		sys_mlockall
+-152	common	munlockall		sys_munlockall
+-153	common	vhangup			sys_vhangup
+-154	common	modify_ldt		sys_modify_ldt
+-155	common	pivot_root		sys_pivot_root
+-156	64	_sysctl			sys_sysctl
+-157	common	prctl			sys_prctl
+-158	common	arch_prctl		sys_arch_prctl
+-159	common	adjtimex		sys_adjtimex
++160	common	setrlimit		sys_setrlimit
+-161	common	chroot			sys_chroot
+-162	common	sync			sys_sync
+-163	common	acct			sys_acct
+-164	common	settimeofday		sys_settimeofday
+165	common	mount			sys_mount
+-166	common	umount2			sys_umount
+-167	common	swapon			sys_swapon
+-168	common	swapoff			sys_swapoff
+-169	common	reboot			sys_reboot
+-170	common	sethostname		sys_sethostname
+-171	common	setdomainname		sys_setdomainname
+-172	common	iopl			stub_iopl
+-173	common	ioperm			sys_ioperm
+174	64	create_module
+-175	common	init_module		sys_init_module
+-176	common	delete_module		sys_delete_module
+177	64	get_kernel_syms
+178	64	query_module
+-179	common	quotactl		sys_quotactl
+180	64	nfsservctl
+181	common	getpmsg
+182	common	putpmsg
+183	common	afs_syscall
+184	common	tuxcall
+185	common	security
++186	common	gettid			sys_gettid
+-187	common	readahead		sys_readahead
+-188	common	setxattr		sys_setxattr
+-189	common	lsetxattr		sys_lsetxattr
+-190	common	fsetxattr		sys_fsetxattr
+-191	common	getxattr		sys_getxattr
+-192	common	lgetxattr		sys_lgetxattr
+-193	common	fgetxattr		sys_fgetxattr
+-194	common	listxattr		sys_listxattr
+-195	common	llistxattr		sys_llistxattr
+-196	common	flistxattr		sys_flistxattr
+-197	common	removexattr		sys_removexattr
+-198	common	lremovexattr		sys_lremovexattr
+-199	common	fremovexattr		sys_fremovexattr
+-200	common	tkill			sys_tkill
++201	common	time			sys_time
+202	common	futex			sys_futex
+-203	common	sched_setaffinity	sys_sched_setaffinity
++204	common	sched_getaffinity	sys_sched_getaffinity
+205	64	set_thread_area
+-206	common	io_setup		sys_io_setup
+-207	common	io_destroy		sys_io_destroy
+-208	common	io_getevents		sys_io_getevents
+-209	common	io_submit		sys_io_submit
+-210	common	io_cancel		sys_io_cancel
+211	64	get_thread_area
+-212	common	lookup_dcookie		sys_lookup_dcookie
+-213	common	epoll_create		sys_epoll_create
+214	64	epoll_ctl_old
+215	64	epoll_wait_old
+-216	common	remap_file_pages	sys_remap_file_pages
++217	common	getdents64		sys_getdents64
+218	common	set_tid_address		sys_set_tid_address
++219	common	restart_syscall		sys_restart_syscall
+-220	common	semtimedop		sys_semtimedop
+-221	common	fadvise64		sys_fadvise64
+222	64	timer_create		sys_timer_create
+223	common	timer_settime		sys_timer_settime
+224	common	timer_gettime		sys_timer_gettime
+225	common	timer_getoverrun	sys_timer_getoverrun
+226	common	timer_delete		sys_timer_delete
+227	common	clock_settime		sys_clock_settime
+228	common	clock_gettime		sys_clock_gettime
+229	common	clock_getres		sys_clock_getres
+230	common	clock_nanosleep		sys_clock_nanosleep
+231	common	exit_group		sys_exit_group
+-232	common	epoll_wait		sys_epoll_wait
+-233	common	epoll_ctl		sys_epoll_ctl
+-234	common	tgkill			sys_tgkill
+-235	common	utimes			sys_utimes
+236	64	vserver
+-237	common	mbind			sys_mbind
+-238	common	set_mempolicy		sys_set_mempolicy
+-239	common	get_mempolicy		sys_get_mempolicy
+-240	common	mq_open			sys_mq_open
+-241	common	mq_unlink		sys_mq_unlink
+-242	common	mq_timedsend		sys_mq_timedsend
+-243	common	mq_timedreceive		sys_mq_timedreceive
+-244	64	mq_notify		sys_mq_notify
+-245	common	mq_getsetattr		sys_mq_getsetattr
+-246	64	kexec_load		sys_kexec_load
+247	64	waitid			sys_waitid
+-248	common	add_key			sys_add_key
+-249	common	request_key		sys_request_key
+-250	common	keyctl			sys_keyctl
+-251	common	ioprio_set		sys_ioprio_set
++252	common	ioprio_get		sys_ioprio_get
+-253	common	inotify_init		sys_inotify_init
+-254	common	inotify_add_watch	sys_inotify_add_watch
+-255	common	inotify_rm_watch	sys_inotify_rm_watch
+-256	common	migrate_pages		sys_migrate_pages
+-257	common	openat			sys_openat
+-258	common	mkdirat			sys_mkdirat
+-259	common	mknodat			sys_mknodat
+-260	common	fchownat		sys_fchownat
+-261	common	futimesat		sys_futimesat
+-262	common	newfstatat		sys_newfstatat
+-263	common	unlinkat		sys_unlinkat
+-264	common	renameat		sys_renameat
+-265	common	linkat			sys_linkat
+-266	common	symlinkat		sys_symlinkat
+-267	common	readlinkat		sys_readlinkat
+-268	common	fchmodat		sys_fchmodat
+-269	common	faccessat		sys_faccessat
+270	common	pselect6		sys_pselect6
+271	common	ppoll			sys_ppoll
+272	common	unshare			sys_unshare
+273	64	set_robust_list		sys_set_robust_list
+274	64	get_robust_list		sys_get_robust_list
+-275	common	splice			sys_splice
+-276	common	tee			sys_tee
+-277	common	sync_file_range		sys_sync_file_range
+-278	64	vmsplice		sys_vmsplice
+-279	64	move_pages		sys_move_pages
+-280	common	utimensat		sys_utimensat
+-281	common	epoll_pwait		sys_epoll_pwait
+-282	common	signalfd		sys_signalfd
+-283	common	timerfd_create		sys_timerfd_create
+-284	common	eventfd			sys_eventfd
+-285	common	fallocate		sys_fallocate
+-286	common	timerfd_settime		sys_timerfd_settime
+-287	common	timerfd_gettime		sys_timerfd_gettime
+-288	common	accept4			sys_accept4
+-289	common	signalfd4		sys_signalfd4
+-290	common	eventfd2		sys_eventfd2
+-291	common	epoll_create1		sys_epoll_create1
+292	common	dup3			sys_dup3
+-293	common	pipe2			sys_pipe2
+-294	common	inotify_init1		sys_inotify_init1
+-295	64	preadv			sys_preadv
+-296	64	pwritev			sys_pwritev
++297	64	rt_tgsigqueueinfo	sys_rt_tgsigqueueinfo
+-298	common	perf_event_open		sys_perf_event_open
+-299	64	recvmmsg		sys_recvmmsg
+-300	common	fanotify_init		sys_fanotify_init
+-301	common	fanotify_mark		sys_fanotify_mark
+-302	common	prlimit64		sys_prlimit64
+-303	common	name_to_handle_at	sys_name_to_handle_at
+-304	common	open_by_handle_at	sys_open_by_handle_at
+305	common	clock_adjtime		sys_clock_adjtime
+-306	common	syncfs			sys_syncfs
+-307	64	sendmmsg		sys_sendmmsg
+-308	common	setns			sys_setns
++309	common	getcpu			sys_getcpu
+-310	64	process_vm_readv	sys_process_vm_readv
+-311	64	process_vm_writev	sys_process_vm_writev
+-312	common	kcmp			sys_kcmp
+-313	common	finit_module		sys_finit_module
+
+#
+# x32-specific system call numbers start at 512 to avoid cache impact
+# for native 64-bit operation.
+#
++512	x32	rt_sigaction		compat_sys_rt_sigaction
+513	x32	rt_sigreturn		stub_x32_rt_sigreturn
+-514	x32	ioctl			-compat_sys_ioctl
++515	x32	readv			compat_sys_readv
++516	x32	writev			compat_sys_writev
+517	x32	recvfrom		-compat_sys_recvfrom
+-518	x32	sendmsg			compat_sys_sendmsg
+-519	x32	recvmsg			-compat_sys_recvmsg
+-520	x32	execve			stub_x32_execve
+-521	x32	ptrace			compat_sys_ptrace
++522	x32	rt_sigpending		compat_sys_rt_sigpending
++523	x32	rt_sigtimedwait		+compat_sys_rt_sigtimedwait
++524	x32	rt_sigqueueinfo		compat_sys_rt_sigqueueinfo
+-525	x32	sigaltstack		compat_sys_sigaltstack
+526	x32	timer_create		-compat_sys_timer_create
+-527	x32	mq_notify		compat_sys_mq_notify
+-528	x32	kexec_load		compat_sys_kexec_load
+529	x32	waitid			?compat_sys_waitid
+530	x32	set_robust_list		compat_sys_set_robust_list
+531	x32	get_robust_list		compat_sys_get_robust_list
+-532	x32	vmsplice		compat_sys_vmsplice
+-533	x32	move_pages		-compat_sys_move_pages
+-534	x32	preadv			compat_sys_preadv64
+-535	x32	pwritev			compat_sys_pwritev64
++536	x32	rt_tgsigqueueinfo	compat_sys_rt_tgsigqueueinfo
+-537	x32	recvmmsg		compat_sys_recvmmsg
+-538	x32	sendmmsg		compat_sys_sendmmsg
+-539	x32	process_vm_readv	compat_sys_process_vm_readv
+-540	x32	process_vm_writev	compat_sys_process_vm_writev
+-541	x32	setsockopt		compat_sys_setsockopt
+-542	x32	getsockopt		compat_sys_getsockopt
diff -ruNp linux-3.12.6/fs/aio.c linux-3.12.6-cher1/fs/aio.c
--- linux-3.12.6/fs/aio.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/aio.c	2013-12-24 13:58:59.384817170 +0400
@@ -1130,6 +1130,9 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_e
 	unsigned long ctx;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = get_user(ctx, ctxp);
 	if (unlikely(ret))
 		goto out;
@@ -1162,7 +1165,13 @@ out:
  */
 SYSCALL_DEFINE1(io_destroy, aio_context_t, ctx)
 {
-	struct kioctx *ioctx = lookup_ioctx(ctx);
+	struct kioctx *ioctx = NULL;
+
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
+	ioctx = lookup_ioctx(ctx);
 	if (likely(NULL != ioctx)) {
 		kill_ioctx(current->mm, ioctx);
 		percpu_ref_put(&ioctx->users);
@@ -1465,6 +1474,9 @@ long do_io_submit(aio_context_t ctx_id,
 SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr,
 		struct iocb __user * __user *, iocbpp)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_io_submit(ctx_id, nr, iocbpp, 0);
 }
 
@@ -1508,6 +1520,9 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t
 	u32 key;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = get_user(key, &iocb->aio_key);
 	if (unlikely(ret))
 		return -EFAULT;
@@ -1558,9 +1573,13 @@ SYSCALL_DEFINE5(io_getevents, aio_contex
 		struct io_event __user *, events,
 		struct timespec __user *, timeout)
 {
-	struct kioctx *ioctx = lookup_ioctx(ctx_id);
+	struct kioctx *ioctx;
 	long ret = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        ioctx = lookup_ioctx(ctx_id);
 	if (likely(ioctx)) {
 		if (likely(min_nr <= nr && min_nr >= 0))
 			ret = read_events(ioctx, min_nr, nr, events, timeout);
diff -ruNp linux-3.12.6/fs/buffer.c linux-3.12.6-cher1/fs/buffer.c
--- linux-3.12.6/fs/buffer.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/buffer.c	2013-12-24 13:58:59.384817170 +0400
@@ -3280,6 +3280,9 @@ SYSCALL_DEFINE2(bdflush, int, func, long
 {
 	static int msg_count;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
diff -ruNp linux-3.12.6/fs/compat.c linux-3.12.6-cher1/fs/compat.c
--- linux-3.12.6/fs/compat.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/compat.c	2013-12-24 13:58:59.385817178 +0400
@@ -77,6 +77,11 @@ asmlinkage long compat_sys_utime(const c
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (t) {
 		if (get_user(tv[0].tv_sec, &t->actime) ||
 		    get_user(tv[1].tv_sec, &t->modtime))
@@ -91,6 +96,11 @@ asmlinkage long compat_sys_utimensat(uns
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if  (t) {
 		if (get_compat_timespec(&tv[0], &t[0]) ||
 		    get_compat_timespec(&tv[1], &t[1]))
@@ -106,6 +116,11 @@ asmlinkage long compat_sys_futimesat(uns
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (t) {
 		if (get_user(tv[0].tv_sec, &t[0].tv_sec) ||
 		    get_user(tv[0].tv_nsec, &t[0].tv_usec) ||
@@ -159,12 +174,25 @@ static int cp_compat_stat(struct kstat *
 	return copy_to_user(ubuf, &tmp, sizeof(tmp)) ? -EFAULT : 0;
 }
 
+int cher_patch_is_secure_path(const char*);
+
 asmlinkage long compat_sys_newstat(const char __user * filename,
 		struct compat_stat __user *statbuf)
 {
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                struct filename *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp->name) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp->name, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
 	error = vfs_stat(filename, &stat);
 	if (error)
 		return error;
@@ -177,6 +205,17 @@ asmlinkage long compat_sys_newlstat(cons
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                struct filename *tmp = getname(filename);
+                if (IS_ERR(tmp)) return -EINVAL;
+                if (cher_patch_is_secure_path(tmp->name) < 0) {
+                        putname(tmp);
+                        return -EPERM;
+                }
+                if (!strncmp(tmp->name, "/SANDBOX/", 9)) filename += 9;
+                putname(tmp);
+        }
+
 	error = vfs_lstat(filename, &stat);
 	if (error)
 		return error;
@@ -191,6 +230,9 @@ asmlinkage long compat_sys_newfstatat(un
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = vfs_fstatat(dfd, filename, &stat, flag);
 	if (error)
 		return error;
@@ -250,7 +292,12 @@ static int put_compat_statfs(struct comp
 asmlinkage long compat_sys_statfs(const char __user *pathname, struct compat_statfs __user *buf)
 {
 	struct kstatfs tmp;
-	int error = user_statfs(pathname, &tmp);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        error = user_statfs(pathname, &tmp);
 	if (!error)
 		error = put_compat_statfs(buf, &tmp);
 	return error;
@@ -259,7 +306,12 @@ asmlinkage long compat_sys_statfs(const
 asmlinkage long compat_sys_fstatfs(unsigned int fd, struct compat_statfs __user *buf)
 {
 	struct kstatfs tmp;
-	int error = fd_statfs(fd, &tmp);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        error = fd_statfs(fd, &tmp);
 	if (!error)
 		error = put_compat_statfs(buf, &tmp);
 	return error;
@@ -303,6 +355,9 @@ asmlinkage long compat_sys_statfs64(cons
 	struct kstatfs tmp;
 	int error;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -317,6 +372,9 @@ asmlinkage long compat_sys_fstatfs64(uns
 	struct kstatfs tmp;
 	int error;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -335,7 +393,12 @@ asmlinkage long compat_sys_ustat(unsigne
 {
 	struct compat_ustat tmp;
 	struct kstatfs sbuf;
-	int err = vfs_ustat(new_decode_dev(dev), &sbuf);
+	int err;
+
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        err = vfs_ustat(new_decode_dev(dev), &sbuf);
 	if (err)
 		return err;
 
@@ -406,6 +469,9 @@ asmlinkage long compat_sys_fcntl64(unsig
 	struct flock f;
 	long ret;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	switch (cmd) {
 	case F_GETLK:
 	case F_SETLK:
@@ -483,6 +549,10 @@ compat_sys_io_setup(unsigned nr_reqs, u3
 	aio_context_t ctx64;
 
 	mm_segment_t oldfs = get_fs();
+
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (unlikely(get_user(ctx64, ctx32p)))
 		return -EFAULT;
 
@@ -507,6 +577,9 @@ compat_sys_io_getevents(aio_context_t ct
 	struct timespec t;
 	struct timespec __user *ut = NULL;
 
+       if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = -EFAULT;
 	if (unlikely(!access_ok(VERIFY_WRITE, events, 
 				nr * sizeof(struct io_event))))
@@ -623,6 +696,9 @@ compat_sys_io_submit(aio_context_t ctx_i
 	struct iocb __user * __user *iocb64; 
 	long ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (unlikely(nr < 0))
 		return -EINVAL;
 
@@ -781,6 +857,11 @@ asmlinkage long compat_sys_mount(const c
 	struct filename *dir;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	retval = copy_mount_string(type, &kernel_type);
 	if (retval < 0)
 		goto out;
@@ -882,6 +963,13 @@ asmlinkage long compat_sys_old_readdir(u
 	if (!f.file)
 		return -EBADF;
 
+        /*
+        if (SBOX_IS_RESTRICTED()) {
+                fdput(fd);
+                return -EPERM;
+        }
+        */
+
 	error = iterate_dir(f.file, &buf.ctx);
 	if (buf.result)
 		error = buf.result;
@@ -960,6 +1048,11 @@ asmlinkage long compat_sys_getdents(unsi
 	};
 	int error;
 
+        /*
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+        */
+
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		return -EFAULT;
 
@@ -1045,6 +1138,11 @@ asmlinkage long compat_sys_getdents64(un
 	};
 	int error;
 
+        /*
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+        */
+
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		return -EFAULT;
 
@@ -1083,6 +1181,10 @@ COMPAT_SYSCALL_DEFINE3(open, const char
  */
 COMPAT_SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, umode_t, mode)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
 	return do_sys_open(dfd, filename, flags, mode);
 }
 
@@ -1461,6 +1563,11 @@ asmlinkage long compat_sys_ppoll(struct
 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
 			     struct file_handle __user *, handle, int, flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_handle_open(mountdirfd, handle, flags);
 }
 #endif
diff -ruNp linux-3.12.6/fs/compat_ioctl.c linux-3.12.6-cher1/fs/compat_ioctl.c
--- linux-3.12.6/fs/compat_ioctl.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/compat_ioctl.c	2013-12-24 13:58:59.385817178 +0400
@@ -1545,6 +1545,9 @@ asmlinkage long compat_sys_ioctl(unsigne
 	if (!f.file)
 		goto out;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* RED-PEN how should LSM module know it's handling 32bit? */
 	error = security_file_ioctl(f.file, cmd, arg);
 	if (error)
diff -ruNp linux-3.12.6/fs/dcache.c linux-3.12.6-cher1/fs/dcache.c
--- linux-3.12.6/fs/dcache.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/dcache.c	2013-12-24 13:58:59.385817178 +0400
@@ -3218,8 +3218,14 @@ SYSCALL_DEFINE2(getcwd, char __user *, b
 {
 	int error;
 	struct path pwd, root;
-	char *page = __getname();
+	char *page = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                copy_to_user(buf, "/SANDBOX", 9);
+                return 9;
+        }
+
+        page = __getname();
 	if (!page)
 		return -ENOMEM;
 
diff -ruNp linux-3.12.6/fs/dcookies.c linux-3.12.6-cher1/fs/dcookies.c
--- linux-3.12.6/fs/dcookies.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/dcookies.c	2013-12-24 13:58:59.386817183 +0400
@@ -155,6 +155,11 @@ SYSCALL_DEFINE3(lookup_dcookie, u64, coo
 	size_t pathlen;
 	struct dcookie_struct * dcs;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* we could leak path information to users
 	 * without dir read permission without this
 	 */
diff -ruNp linux-3.12.6/fs/eventfd.c linux-3.12.6-cher1/fs/eventfd.c
--- linux-3.12.6/fs/eventfd.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/eventfd.c	2013-12-24 13:58:59.386817183 +0400
@@ -428,6 +428,9 @@ SYSCALL_DEFINE2(eventfd2, unsigned int,
 	int fd, error;
 	struct file *file;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = get_unused_fd_flags(flags & EFD_SHARED_FCNTL_FLAGS);
 	if (error < 0)
 		return error;
diff -ruNp linux-3.12.6/fs/eventpoll.c linux-3.12.6-cher1/fs/eventpoll.c
--- linux-3.12.6/fs/eventpoll.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/eventpoll.c	2013-12-24 13:58:59.386817183 +0400
@@ -1737,6 +1737,9 @@ SYSCALL_DEFINE1(epoll_create1, int, flag
 	struct eventpoll *ep = NULL;
 	struct file *file;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the EPOLL_* constant for consistency.  */
 	BUILD_BUG_ON(EPOLL_CLOEXEC != O_CLOEXEC);
 
@@ -1797,6 +1800,9 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, in
 	struct epitem *epi;
 	struct epoll_event epds;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	error = -EFAULT;
 	if (ep_op_has_event(op) &&
 	    copy_from_user(&epds, event, sizeof(struct epoll_event)))
@@ -1921,6 +1927,9 @@ SYSCALL_DEFINE4(epoll_wait, int, epfd, s
 	struct fd f;
 	struct eventpoll *ep;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* The maximum number of event must be greater than zero */
 	if (maxevents <= 0 || maxevents > EP_MAX_EVENTS)
 		return -EINVAL;
@@ -1967,6 +1976,9 @@ SYSCALL_DEFINE6(epoll_pwait, int, epfd,
 	int error;
 	sigset_t ksigmask, sigsaved;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/*
 	 * If the caller wants a certain signal mask to be set during the wait,
 	 * we apply it here.
diff -ruNp linux-3.12.6/fs/exec.c linux-3.12.6-cher1/fs/exec.c
--- linux-3.12.6/fs/exec.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/exec.c	2013-12-24 13:58:59.386817183 +0400
@@ -119,6 +119,11 @@ SYSCALL_DEFINE1(uselib, const char __use
 	if (IS_ERR(tmp))
 		goto out;
 
+        if (SBOX_IS_RESTRICTED()) {
+                putname(tmp);
+                return -EPERM;
+        }
+
 	file = do_filp_open(AT_FDCWD, tmp, &uselib_flags);
 	putname(tmp);
 	error = PTR_ERR(file);
@@ -1684,10 +1689,23 @@ SYSCALL_DEFINE3(execve,
 		const char __user *const __user *, argv,
 		const char __user *const __user *, envp)
 {
-	struct filename *path = getname(filename);
-	int error = PTR_ERR(path);
+	struct filename *path = NULL;
+	int error = 0;
+
+        if ((current->sbox_flags & SBOX_NO_EXEC)) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+	path = getname(filename);
+	error = PTR_ERR(path);
 	if (!IS_ERR(path)) {
 		error = do_execve(path->name, argv, envp);
+                if (!error) {
+                        if ((current->sbox_flags & SBOX_NO_SYSCALLS)) {
+                                current->sbox_flags |= SBOX_NO_EXEC;
+                        }
+                }
 		putname(path);
 	}
 	return error;
@@ -1697,10 +1715,23 @@ asmlinkage long compat_sys_execve(const
 	const compat_uptr_t __user * argv,
 	const compat_uptr_t __user * envp)
 {
-	struct filename *path = getname(filename);
-	int error = PTR_ERR(path);
+	struct filename *path = NULL;
+	int error = 0;
+
+        if ((current->sbox_flags & SBOX_NO_EXEC)) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+	path = getname(filename);
+	error = PTR_ERR(path);
 	if (!IS_ERR(path)) {
 		error = compat_do_execve(path->name, argv, envp);
+                if (!error) {
+                        if ((current->sbox_flags & SBOX_NO_SYSCALLS)) {
+                                current->sbox_flags |= SBOX_NO_EXEC;
+                        }
+                }
 		putname(path);
 	}
 	return error;
diff -ruNp linux-3.12.6/fs/fcntl.c linux-3.12.6-cher1/fs/fcntl.c
--- linux-3.12.6/fs/fcntl.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/fcntl.c	2013-12-24 13:58:59.402817365 +0400
@@ -351,6 +351,10 @@ SYSCALL_DEFINE3(fcntl, unsigned int, fd,
 	struct fd f = fdget_raw(fd);
 	long err = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 	if (!f.file)
 		goto out;
 
@@ -376,6 +380,10 @@ SYSCALL_DEFINE3(fcntl64, unsigned int, f
 	struct fd f = fdget_raw(fd);
 	long err = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 	if (!f.file)
 		goto out;
 
diff -ruNp linux-3.12.6/fs/fhandle.c linux-3.12.6-cher1/fs/fhandle.c
--- linux-3.12.6/fs/fhandle.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/fhandle.c	2013-12-24 13:58:59.402817365 +0400
@@ -97,6 +97,11 @@ SYSCALL_DEFINE5(name_to_handle_at, int,
 	int lookup_flags;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
 		return -EINVAL;
 
@@ -257,6 +262,11 @@ SYSCALL_DEFINE3(open_by_handle_at, int,
 {
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (force_o_largefile())
 		flags |= O_LARGEFILE;
 
diff -ruNp linux-3.12.6/fs/filesystems.c linux-3.12.6-cher1/fs/filesystems.c
--- linux-3.12.6/fs/filesystems.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/filesystems.c	2013-12-24 13:58:59.402817365 +0400
@@ -184,6 +184,11 @@ SYSCALL_DEFINE3(sysfs, int, option, unsi
 {
 	int retval = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	switch (option) {
 		case 1:
 			retval = fs_index((const char __user *) arg1);
diff -ruNp linux-3.12.6/fs/ioctl.c linux-3.12.6-cher1/fs/ioctl.c
--- linux-3.12.6/fs/ioctl.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/ioctl.c	2013-12-24 13:58:59.402817365 +0400
@@ -608,6 +608,12 @@ SYSCALL_DEFINE3(ioctl, unsigned int, fd,
 
 	if (!f.file)
 		return -EBADF;
+
+        if (SBOX_IS_RESTRICTED()) {
+                fdput(f);
+                return -EPERM;
+        }
+
 	error = security_file_ioctl(f.file, cmd, arg);
 	if (!error)
 		error = do_vfs_ioctl(f.file, fd, cmd, arg);
diff -ruNp linux-3.12.6/fs/ioprio.c linux-3.12.6-cher1/fs/ioprio.c
--- linux-3.12.6/fs/ioprio.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/ioprio.c	2013-12-24 13:58:59.402817365 +0400
@@ -68,6 +68,9 @@ SYSCALL_DEFINE3(ioprio_set, int, which,
 	kuid_t uid;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	switch (class) {
 		case IOPRIO_CLASS_RT:
 			if (!capable(CAP_SYS_ADMIN))
diff -ruNp linux-3.12.6/fs/locks.c linux-3.12.6-cher1/fs/locks.c
--- linux-3.12.6/fs/locks.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/locks.c	2013-12-24 13:58:59.402817365 +0400
@@ -1753,6 +1753,11 @@ SYSCALL_DEFINE2(flock, unsigned int, fd,
 	if (!f.file)
 		goto out;
 
+        if (SBOX_IS_RESTRICTED()) {
+                fdput(f);
+                return -EPERM;
+        }
+
 	can_sleep = !(cmd & LOCK_NB);
 	cmd &= ~LOCK_NB;
 	unlock = (cmd == LOCK_UN);
diff -ruNp linux-3.12.6/fs/namei.c linux-3.12.6-cher1/fs/namei.c
--- linux-3.12.6/fs/namei.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/namei.c	2013-12-24 13:58:59.403817380 +0400
@@ -3431,6 +3431,11 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
 	int error;
 	unsigned int lookup_flags = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = may_mknod(mode);
 	if (error)
 		return error;
@@ -3502,6 +3507,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
 	int error;
 	unsigned int lookup_flags = LOOKUP_DIRECTORY;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 retry:
 	dentry = user_path_create(dfd, pathname, &path, lookup_flags);
 	if (IS_ERR(dentry))
@@ -3645,6 +3655,9 @@ exit1:
 
 SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
 	return do_rmdir(AT_FDCWD, pathname);
 }
 
@@ -3748,6 +3761,10 @@ slashes:
 
 SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 	if ((flag & ~AT_REMOVEDIR) != 0)
 		return -EINVAL;
 
@@ -3759,6 +3776,10 @@ SYSCALL_DEFINE3(unlinkat, int, dfd, cons
 
 SYSCALL_DEFINE1(unlink, const char __user *, pathname)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 	return do_unlinkat(AT_FDCWD, pathname);
 }
 
@@ -3791,6 +3812,10 @@ SYSCALL_DEFINE3(symlinkat, const char __
 	struct path path;
 	unsigned int lookup_flags = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 	from = getname(oldname);
 	if (IS_ERR(from))
 		return PTR_ERR(from);
@@ -3885,6 +3910,10 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
 	int how = 0;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 	if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
 		return -EINVAL;
 	/*
@@ -4102,6 +4131,11 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
 	unsigned int lookup_flags = 0;
 	bool should_retry = false;
 	int error;
+
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 retry:
 	from = user_path_parent(olddfd, oldname, &oldnd, lookup_flags);
 	if (IS_ERR(from)) {
diff -ruNp linux-3.12.6/fs/namespace.c linux-3.12.6-cher1/fs/namespace.c
--- linux-3.12.6/fs/namespace.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/namespace.c	2013-12-24 13:58:59.403817380 +0400
@@ -1312,6 +1312,11 @@ SYSCALL_DEFINE2(umount, char __user *, n
 	int retval;
 	int lookup_flags = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
 		return -EINVAL;
 
@@ -2558,6 +2563,11 @@ SYSCALL_DEFINE5(mount, char __user *, de
 	char *kernel_dev;
 	unsigned long data_page;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ret = copy_mount_string(type, &kernel_type);
 	if (ret < 0)
 		goto out_type;
@@ -2648,6 +2658,11 @@ SYSCALL_DEFINE2(pivot_root, const char _
 	struct mountpoint *old_mp, *root_mp;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!may_mount())
 		return -EPERM;
 
diff -ruNp linux-3.12.6/fs/notify/fanotify/fanotify_user.c linux-3.12.6-cher1/fs/notify/fanotify/fanotify_user.c
--- linux-3.12.6/fs/notify/fanotify/fanotify_user.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/notify/fanotify/fanotify_user.c	2013-12-24 13:58:59.405817406 +0400
@@ -696,6 +696,9 @@ SYSCALL_DEFINE2(fanotify_init, unsigned
 	int f_flags, fd;
 	struct user_struct *user;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	pr_debug("%s: flags=%d event_f_flags=%d\n",
 		__func__, flags, event_f_flags);
 
@@ -789,6 +792,9 @@ SYSCALL_DEFINE5(fanotify_mark, int, fano
 	struct path path;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	pr_debug("%s: fanotify_fd=%d flags=%x dfd=%d pathname=%p mask=%llx\n",
 		 __func__, fanotify_fd, flags, dfd, pathname, mask);
 
diff -ruNp linux-3.12.6/fs/notify/inotify/inotify_user.c linux-3.12.6-cher1/fs/notify/inotify/inotify_user.c
--- linux-3.12.6/fs/notify/inotify/inotify_user.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/notify/inotify/inotify_user.c	2013-12-24 13:58:59.405817406 +0400
@@ -702,6 +702,9 @@ SYSCALL_DEFINE1(inotify_init1, int, flag
 	struct fsnotify_group *group;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the IN_* constants for consistency.  */
 	BUILD_BUG_ON(IN_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(IN_NONBLOCK != O_NONBLOCK);
@@ -737,6 +740,9 @@ SYSCALL_DEFINE3(inotify_add_watch, int,
 	int ret;
 	unsigned flags = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* don't allow invalid bits: we don't want flags set */
 	if (unlikely(!(mask & ALL_INOTIFY_BITS)))
 		return -EINVAL;
@@ -779,6 +785,9 @@ SYSCALL_DEFINE2(inotify_rm_watch, int, f
 	struct fd f;
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	f = fdget(fd);
 	if (unlikely(!f.file))
 		return -EBADF;
diff -ruNp linux-3.12.6/fs/open.c linux-3.12.6-cher1/fs/open.c
--- linux-3.12.6/fs/open.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/open.c	2013-12-24 13:58:59.405817406 +0400
@@ -34,6 +34,54 @@
 
 #include "internal.h"
 
+static const char * const secure_paths[] =
+{
+        "/lib/", "/lib32/", "/lib64/",
+        "/usr/lib/", "/usr/lib32/", "/usr/lib64/",
+        "/usr/include/", "/usr/libexec/",
+        "/usr/local/lib/", "/usr/local/lib32/", "/usr/local/lib64/",
+        "/usr/local/include/", "/usr/local/libexec/",
+        "/bin/", "/usr/bin/", "/usr/local/bin/",
+        "/usr/share/", "/usr/local/share/", "/dev/urandom", "/dev/zero", "/dev/null",
+        "/SANDBOX/",
+        NULL
+};
+
+int cher_patch_is_secure_path(const char *path)
+{
+        const char *s;
+        int i;
+
+        if (strstr(path, ".."))
+                return -1;
+        for (i = 0; secure_paths[i] && strncmp(path, secure_paths[i], strlen(secure_paths[i])); ++i);
+        if (secure_paths[i]) {
+                return 0;
+        }
+
+        if (!strncmp(path, "/SANDBOX/", 9)) path += 9;
+        s = path;
+        while (s[0] == '.' && s[1] == '/') s += 2;
+        for (; *s && *s != '/'; s++);
+        if (*s == '/') return -1;
+        return 0;
+}
+
+int cher_check_user_path(int dfd, const char __user **p_path)
+{
+        struct filename *tmp = NULL;
+        if (dfd != AT_FDCWD) return -EPERM;
+        tmp = getname(*p_path);
+        if (IS_ERR(tmp)) return -EINVAL;
+        if (cher_patch_is_secure_path(tmp->name) < 0) {
+                putname(tmp);
+                return -EPERM;
+        }
+        if (!strncmp("/SANDBOX/", tmp->name, 9)) *p_path += 9;
+        putname(tmp);
+        return 0;
+}
+
 int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs,
 	struct file *filp)
 {
@@ -138,12 +186,18 @@ retry:
 
 SYSCALL_DEFINE2(truncate, const char __user *, path, long, length)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_sys_truncate(path, length);
 }
 
 #ifdef CONFIG_COMPAT
 COMPAT_SYSCALL_DEFINE2(truncate, const char __user *, path, compat_off_t, length)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_sys_truncate(path, length);
 }
 #endif
@@ -211,11 +265,17 @@ COMPAT_SYSCALL_DEFINE2(ftruncate, unsign
 #if BITS_PER_LONG == 32
 SYSCALL_DEFINE2(truncate64, const char __user *, path, loff_t, length)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_sys_truncate(path, length);
 }
 
 SYSCALL_DEFINE2(ftruncate64, unsigned int, fd, loff_t, length)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_sys_ftruncate(fd, length, 0);
 }
 #endif /* BITS_PER_LONG == 32 */
@@ -281,9 +341,13 @@ int do_fallocate(struct file *file, int
 
 SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len)
 {
-	struct fd f = fdget(fd);
+	struct fd f;
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+        f = fdget(fd);
 	if (f.file) {
 		error = do_fallocate(f.file, mode, offset, len);
 		fdput(f);
@@ -305,6 +369,11 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
 	int res;
 	unsigned int lookup_flags = LOOKUP_FOLLOW;
 
+        if (SBOX_IS_RESTRICTED()) {
+                res = cher_check_user_path(dfd, &filename);
+                if (res < 0) return res;
+        }
+
 	if (mode & ~S_IRWXO)	/* where's F_OK, X_OK, W_OK, R_OK? */
 		return -EINVAL;
 
@@ -382,6 +451,10 @@ SYSCALL_DEFINE1(chdir, const char __user
 	struct path path;
 	int error;
 	unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 retry:
 	error = user_path_at(AT_FDCWD, filename, lookup_flags, &path);
 	if (error)
@@ -413,6 +486,11 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
 	if (!f.file)
 		goto out;
 
+        if (SBOX_IS_RESTRICTED()) {
+                error = -EPERM;
+                goto out_putf;
+        }
+
 	inode = file_inode(f.file);
 
 	error = -ENOTDIR;
@@ -433,6 +511,12 @@ SYSCALL_DEFINE1(chroot, const char __use
 	struct path path;
 	int error;
 	unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
+
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 retry:
 	error = user_path_at(AT_FDCWD, filename, lookup_flags, &path);
 	if (error)
@@ -485,9 +569,15 @@ out_unlock:
 
 SYSCALL_DEFINE2(fchmod, unsigned int, fd, umode_t, mode)
 {
-	struct fd f = fdget(fd);
+	struct fd f;
 	int err = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+        f = fdget(fd);
 	if (f.file) {
 		audit_inode(NULL, f.file->f_path.dentry, 0);
 		err = chmod_common(&f.file->f_path, mode);
@@ -501,6 +591,12 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
 	struct path path;
 	int error;
 	unsigned int lookup_flags = LOOKUP_FOLLOW;
+
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 retry:
 	error = user_path_at(dfd, filename, lookup_flags, &path);
 	if (!error) {
@@ -562,6 +658,11 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
 	int error = -EINVAL;
 	int lookup_flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
 		goto out;
 
@@ -606,6 +707,12 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
 	if (!f.file)
 		goto out;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                error = -EPERM;
+                goto out_fput;
+        }
+
 	error = mnt_want_write_file(f.file);
 	if (error)
 		goto out_fput;
@@ -955,9 +1062,16 @@ EXPORT_SYMBOL(file_open_root);
 long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
 {
 	struct open_flags op;
-	int fd = build_open_flags(flags, mode, &op);
+	int fd = 0;
 	struct filename *tmp;
 
+        if (SBOX_IS_RESTRICTED()) {
+                int res = cher_check_user_path(dfd, &filename);
+                if (res < 0) return res;
+                flags &= ~(O_CREAT | O_EXCL);
+        }
+
+	fd = build_open_flags(flags, mode, &op);
 	if (fd)
 		return fd;
 
@@ -1062,6 +1176,9 @@ EXPORT_SYMBOL(sys_close);
  */
 SYSCALL_DEFINE0(vhangup)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (capable(CAP_SYS_TTY_CONFIG)) {
 		tty_vhangup_self();
 		return 0;
diff -ruNp linux-3.12.6/fs/pipe.c linux-3.12.6-cher1/fs/pipe.c
--- linux-3.12.6/fs/pipe.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/pipe.c	2013-12-24 13:58:59.405817406 +0400
@@ -978,6 +978,11 @@ SYSCALL_DEFINE2(pipe2, int __user *, fil
 	int fd[2];
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = __do_pipe_flags(fd, files, flags);
 	if (!error) {
 		if (unlikely(copy_to_user(fildes, fd, sizeof(fd)))) {
diff -ruNp linux-3.12.6/fs/quota/compat.c linux-3.12.6-cher1/fs/quota/compat.c
--- linux-3.12.6/fs/quota/compat.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/quota/compat.c	2013-12-24 13:58:59.405817406 +0400
@@ -52,6 +52,11 @@ asmlinkage long sys32_quotactl(unsigned
 	u16 xdata;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	cmds = cmd >> SUBCMDSHIFT;
 
 	switch (cmds) {
diff -ruNp linux-3.12.6/fs/quota/quota.c linux-3.12.6-cher1/fs/quota/quota.c
--- linux-3.12.6/fs/quota/quota.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/quota/quota.c	2013-12-24 13:58:59.406817417 +0400
@@ -400,6 +400,11 @@ SYSCALL_DEFINE4(quotactl, unsigned int,
 	struct path path, *pathp = NULL;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	cmds = cmd >> SUBCMDSHIFT;
 	type = cmd & SUBCMDMASK;
 
diff -ruNp linux-3.12.6/fs/readdir.c linux-3.12.6-cher1/fs/readdir.c
--- linux-3.12.6/fs/readdir.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/readdir.c	2013-12-24 13:58:59.406817417 +0400
@@ -117,6 +117,13 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
 	if (!f.file)
 		return -EBADF;
 
+        /*
+        if (SBOX_IS_RESTRICTED()) {
+                fdput(f);
+                return -EPERM;
+        }
+        */
+
 	error = iterate_dir(f.file, &buf.ctx);
 	if (buf.result)
 		error = buf.result;
@@ -201,6 +208,11 @@ SYSCALL_DEFINE3(getdents, unsigned int,
 	};
 	int error;
 
+        /*
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+        */
+
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		return -EFAULT;
 
@@ -281,6 +293,11 @@ SYSCALL_DEFINE3(getdents64, unsigned int
 	};
 	int error;
 
+        /*
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+        */
+
 	if (!access_ok(VERIFY_WRITE, dirent, count))
 		return -EFAULT;
 
diff -ruNp linux-3.12.6/fs/read_write.c linux-3.12.6-cher1/fs/read_write.c
--- linux-3.12.6/fs/read_write.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/read_write.c	2013-12-24 13:58:59.406817417 +0400
@@ -534,6 +534,9 @@ SYSCALL_DEFINE4(pread64, unsigned int, f
 	struct fd f;
 	ssize_t ret = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -554,6 +557,9 @@ SYSCALL_DEFINE4(pwrite64, unsigned int,
 	struct fd f;
 	ssize_t ret = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -802,9 +808,15 @@ EXPORT_SYMBOL(vfs_writev);
 SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
 		unsigned long, vlen)
 {
-	struct fd f = fdget(fd);
+	struct fd f;
 	ssize_t ret = -EBADF;
 
+/* C++ needs that
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+*/
+
+        f = fdget(fd);
 	if (f.file) {
 		loff_t pos = file_pos_read(f.file);
 		ret = vfs_readv(f.file, vec, vlen, &pos);
@@ -822,9 +834,15 @@ SYSCALL_DEFINE3(readv, unsigned long, fd
 SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
 		unsigned long, vlen)
 {
-	struct fd f = fdget(fd);
+	struct fd f;
 	ssize_t ret = -EBADF;
 
+/* C++ needs that
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+*/
+
+	f = fdget(fd);
 	if (f.file) {
 		loff_t pos = file_pos_read(f.file);
 		ret = vfs_writev(f.file, vec, vlen, &pos);
@@ -852,6 +870,9 @@ SYSCALL_DEFINE5(preadv, unsigned long, f
 	struct fd f;
 	ssize_t ret = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -876,6 +897,9 @@ SYSCALL_DEFINE5(pwritev, unsigned long,
 	struct fd f;
 	ssize_t ret = -EBADF;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 
@@ -981,10 +1005,16 @@ COMPAT_SYSCALL_DEFINE3(readv, unsigned l
 		const struct compat_iovec __user *,vec,
 		unsigned long, vlen)
 {
-	struct fd f = fdget(fd);
+	struct fd f;
 	ssize_t ret;
 	loff_t pos;
 
+/* C++ needs that
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+*/
+
+	f = fdget(fd);
 	if (!f.file)
 		return -EBADF;
 	pos = f.file->f_pos;
@@ -1002,6 +1032,9 @@ COMPAT_SYSCALL_DEFINE4(preadv64, unsigne
 	struct fd f;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 	f = fdget(fd);
@@ -1048,10 +1081,16 @@ COMPAT_SYSCALL_DEFINE3(writev, unsigned
 		const struct compat_iovec __user *, vec,
 		unsigned long, vlen)
 {
-	struct fd f = fdget(fd);
+	struct fd f;
 	ssize_t ret;
 	loff_t pos;
 
+/* C++ needs that
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+*/
+
+	f = fdget(fd);
 	if (!f.file)
 		return -EBADF;
 	pos = f.file->f_pos;
@@ -1069,6 +1108,9 @@ COMPAT_SYSCALL_DEFINE4(pwritev64, unsign
 	struct fd f;
 	ssize_t ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (pos < 0)
 		return -EINVAL;
 	f = fdget(fd);
diff -ruNp linux-3.12.6/fs/signalfd.c linux-3.12.6-cher1/fs/signalfd.c
--- linux-3.12.6/fs/signalfd.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/signalfd.c	2013-12-24 13:58:59.406817417 +0400
@@ -259,6 +259,9 @@ SYSCALL_DEFINE4(signalfd4, int, ufd, sig
 	sigset_t sigmask;
 	struct signalfd_ctx *ctx;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the SFD_* constants for consistency.  */
 	BUILD_BUG_ON(SFD_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(SFD_NONBLOCK != O_NONBLOCK);
@@ -323,6 +326,9 @@ COMPAT_SYSCALL_DEFINE4(signalfd4, int, u
 	sigset_t tmp;
 	sigset_t __user *ksigmask;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sigsetsize != sizeof(compat_sigset_t))
 		return -EINVAL;
 	if (copy_from_user(&ss32, sigmask, sizeof(ss32)))
diff -ruNp linux-3.12.6/fs/splice.c linux-3.12.6-cher1/fs/splice.c
--- linux-3.12.6/fs/splice.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/splice.c	2013-12-24 13:58:59.407817428 +0400
@@ -1686,6 +1686,9 @@ SYSCALL_DEFINE4(vmsplice, int, fd, const
 	struct fd f;
 	long error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (unlikely(nr_segs > UIO_MAXIOV))
 		return -EINVAL;
 	else if (unlikely(!nr_segs))
@@ -1711,6 +1714,10 @@ COMPAT_SYSCALL_DEFINE4(vmsplice, int, fd
 {
 	unsigned i;
 	struct iovec __user *iov;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (nr_segs > UIO_MAXIOV)
 		return -EINVAL;
 	iov = compat_alloc_user_space(nr_segs * sizeof(struct iovec));
@@ -1733,6 +1740,9 @@ SYSCALL_DEFINE6(splice, int, fd_in, loff
 	struct fd in, out;
 	long error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (unlikely(!len))
 		return 0;
 
@@ -2064,6 +2074,9 @@ SYSCALL_DEFINE4(tee, int, fdin, int, fdo
 	struct fd in;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (unlikely(!len))
 		return 0;
 
diff -ruNp linux-3.12.6/fs/stat.c linux-3.12.6-cher1/fs/stat.c
--- linux-3.12.6/fs/stat.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/stat.c	2013-12-24 13:58:59.407817428 +0400
@@ -18,6 +18,8 @@
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 
+int cher_check_user_path(int dfd, const char __user **p_path);
+
 void generic_fillattr(struct inode *inode, struct kstat *stat)
 {
 	stat->dev = inode->i_sb->s_dev;
@@ -180,6 +182,11 @@ SYSCALL_DEFINE2(stat, const char __user
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                error = cher_check_user_path(AT_FDCWD, &filename);
+                if (error < 0) return error;
+        }
+
 	error = vfs_stat(filename, &stat);
 	if (error)
 		return error;
@@ -193,6 +200,11 @@ SYSCALL_DEFINE2(lstat, const char __user
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                error = cher_check_user_path(AT_FDCWD, &filename);
+                if (error < 0) return error;
+        }
+
 	error = vfs_lstat(filename, &stat);
 	if (error)
 		return error;
@@ -267,8 +279,14 @@ SYSCALL_DEFINE2(newstat, const char __us
 		struct stat __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_stat(filename, &stat);
+	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                error = cher_check_user_path(AT_FDCWD, &filename);
+                if (error < 0) return error;
+        }
+
+	error = vfs_stat(filename, &stat);
 	if (error)
 		return error;
 	return cp_new_stat(&stat, statbuf);
@@ -280,6 +298,11 @@ SYSCALL_DEFINE2(newlstat, const char __u
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                error = cher_check_user_path(AT_FDCWD, &filename);
+                if (error < 0) return error;
+        }
+
 	error = vfs_lstat(filename, &stat);
 	if (error)
 		return error;
@@ -294,6 +317,11 @@ SYSCALL_DEFINE4(newfstatat, int, dfd, co
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                error = cher_check_user_path(dfd, &filename);
+                if (error < 0) return error;
+        }
+
 	error = vfs_fstatat(dfd, filename, &stat, flag);
 	if (error)
 		return error;
@@ -320,6 +348,11 @@ SYSCALL_DEFINE4(readlinkat, int, dfd, co
 	int empty = 0;
 	unsigned int lookup_flags = LOOKUP_EMPTY;
 
+        if (SBOX_IS_RESTRICTED()) {
+                error = cher_check_user_path(dfd, &pathname);
+                if (error < 0) return error;
+        }
+
 	if (bufsiz <= 0)
 		return -EINVAL;
 
@@ -401,8 +434,14 @@ SYSCALL_DEFINE2(stat64, const char __use
 		struct stat64 __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_stat(filename, &stat);
+	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                error = cher_check_user_path(AT_FDCWD, &filename);
+                if (error < 0) return error;
+        }
+
+	error = vfs_stat(filename, &stat);
 	if (!error)
 		error = cp_new_stat64(&stat, statbuf);
 
@@ -413,8 +452,14 @@ SYSCALL_DEFINE2(lstat64, const char __us
 		struct stat64 __user *, statbuf)
 {
 	struct kstat stat;
-	int error = vfs_lstat(filename, &stat);
+	int error;
+
+        if (SBOX_IS_RESTRICTED()) {
+                error = cher_check_user_path(AT_FDCWD, &filename);
+                if (error < 0) return error;
+        }
 
+	error = vfs_lstat(filename, &stat);
 	if (!error)
 		error = cp_new_stat64(&stat, statbuf);
 
@@ -438,6 +483,11 @@ SYSCALL_DEFINE4(fstatat64, int, dfd, con
 	struct kstat stat;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                error = cher_check_user_path(dfd, &filename);
+                if (error < 0) return error;
+        }
+
 	error = vfs_fstatat(dfd, filename, &stat, flag);
 	if (error)
 		return error;
diff -ruNp linux-3.12.6/fs/statfs.c linux-3.12.6-cher1/fs/statfs.c
--- linux-3.12.6/fs/statfs.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/statfs.c	2013-12-24 13:58:59.407817428 +0400
@@ -172,7 +172,12 @@ static int do_statfs64(struct kstatfs *s
 SYSCALL_DEFINE2(statfs, const char __user *, pathname, struct statfs __user *, buf)
 {
 	struct kstatfs st;
-	int error = user_statfs(pathname, &st);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	error = user_statfs(pathname, &st);
 	if (!error)
 		error = do_statfs_native(&st, buf);
 	return error;
@@ -182,6 +187,10 @@ SYSCALL_DEFINE3(statfs64, const char __u
 {
 	struct kstatfs st;
 	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 	error = user_statfs(pathname, &st);
@@ -193,7 +202,12 @@ SYSCALL_DEFINE3(statfs64, const char __u
 SYSCALL_DEFINE2(fstatfs, unsigned int, fd, struct statfs __user *, buf)
 {
 	struct kstatfs st;
-	int error = fd_statfs(fd, &st);
+	int error;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	error = fd_statfs(fd, &st);
 	if (!error)
 		error = do_statfs_native(&st, buf);
 	return error;
@@ -204,6 +218,9 @@ SYSCALL_DEFINE3(fstatfs64, unsigned int,
 	struct kstatfs st;
 	int error;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (sz != sizeof(*buf))
 		return -EINVAL;
 
@@ -229,7 +246,12 @@ SYSCALL_DEFINE2(ustat, unsigned, dev, st
 {
 	struct ustat tmp;
 	struct kstatfs sbuf;
-	int err = vfs_ustat(new_decode_dev(dev), &sbuf);
+	int err;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	err = vfs_ustat(new_decode_dev(dev), &sbuf);
 	if (err)
 		return err;
 
diff -ruNp linux-3.12.6/fs/sync.c linux-3.12.6-cher1/fs/sync.c
--- linux-3.12.6/fs/sync.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/sync.c	2013-12-24 13:58:59.408817439 +0400
@@ -103,6 +103,9 @@ SYSCALL_DEFINE0(sync)
 {
 	int nowait = 0, wait = 1;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	wakeup_flusher_threads(0, WB_REASON_SYNC);
 	iterate_supers(sync_inodes_one_sb, NULL);
 	iterate_supers(sync_fs_one_sb, &nowait);
@@ -148,10 +151,14 @@ void emergency_sync(void)
  */
 SYSCALL_DEFINE1(syncfs, int, fd)
 {
-	struct fd f = fdget(fd);
+	struct fd f;
 	struct super_block *sb;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	f = fdget(fd);
 	if (!f.file)
 		return -EBADF;
 	sb = f.file->f_dentry->d_sb;
@@ -211,11 +218,17 @@ static int do_fsync(unsigned int fd, int
 
 SYSCALL_DEFINE1(fsync, unsigned int, fd)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_fsync(fd, 0);
 }
 
 SYSCALL_DEFINE1(fdatasync, unsigned int, fd)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	return do_fsync(fd, 1);
 }
 
@@ -292,6 +305,9 @@ SYSCALL_DEFINE4(sync_file_range, int, fd
 	loff_t endbyte;			/* inclusive */
 	umode_t i_mode;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = -EINVAL;
 	if (flags & ~VALID_FLAGS)
 		goto out;
diff -ruNp linux-3.12.6/fs/timerfd.c linux-3.12.6-cher1/fs/timerfd.c
--- linux-3.12.6/fs/timerfd.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/timerfd.c	2013-12-24 13:58:59.409817451 +0400
@@ -309,6 +309,9 @@ SYSCALL_DEFINE2(timerfd_create, int, clo
 	int ufd;
 	struct timerfd_ctx *ctx;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the TFD_* constants for consistency.  */
 	BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(TFD_NONBLOCK != O_NONBLOCK);
@@ -448,6 +451,9 @@ SYSCALL_DEFINE4(timerfd_settime, int, uf
 	struct itimerspec new, old;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (copy_from_user(&new, utmr, sizeof(new)))
 		return -EFAULT;
 	ret = do_timerfd_settime(ufd, flags, &new, &old);
@@ -462,7 +468,12 @@ SYSCALL_DEFINE4(timerfd_settime, int, uf
 SYSCALL_DEFINE2(timerfd_gettime, int, ufd, struct itimerspec __user *, otmr)
 {
 	struct itimerspec kotmr;
-	int ret = do_timerfd_gettime(ufd, &kotmr);
+	int ret;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	ret = do_timerfd_gettime(ufd, &kotmr);
 	if (ret)
 		return ret;
 	return copy_to_user(otmr, &kotmr, sizeof(kotmr)) ? -EFAULT: 0;
@@ -476,6 +487,9 @@ COMPAT_SYSCALL_DEFINE4(timerfd_settime,
 	struct itimerspec new, old;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (get_compat_itimerspec(&new, utmr))
 		return -EFAULT;
 	ret = do_timerfd_settime(ufd, flags, &new, &old);
@@ -490,7 +504,12 @@ COMPAT_SYSCALL_DEFINE2(timerfd_gettime,
 		struct compat_itimerspec __user *, otmr)
 {
 	struct itimerspec kotmr;
-	int ret = do_timerfd_gettime(ufd, &kotmr);
+	int ret;
+
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	ret = do_timerfd_gettime(ufd, &kotmr);
 	if (ret)
 		return ret;
 	return put_compat_itimerspec(otmr, &kotmr) ? -EFAULT: 0;
diff -ruNp linux-3.12.6/fs/utimes.c linux-3.12.6-cher1/fs/utimes.c
--- linux-3.12.6/fs/utimes.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/utimes.c	2013-12-24 13:58:59.409817451 +0400
@@ -28,6 +28,9 @@ SYSCALL_DEFINE2(utime, char __user *, fi
 {
 	struct timespec tv[2];
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (times) {
 		if (get_user(tv[0].tv_sec, &times->actime) ||
 		    get_user(tv[1].tv_sec, &times->modtime))
@@ -180,6 +183,9 @@ SYSCALL_DEFINE4(utimensat, int, dfd, con
 {
 	struct timespec tstimes[2];
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (utimes) {
 		if (copy_from_user(&tstimes, utimes, sizeof(tstimes)))
 			return -EFAULT;
@@ -199,6 +205,9 @@ SYSCALL_DEFINE3(futimesat, int, dfd, con
 	struct timeval times[2];
 	struct timespec tstimes[2];
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (utimes) {
 		if (copy_from_user(&times, utimes, sizeof(times)))
 			return -EFAULT;
diff -ruNp linux-3.12.6/fs/xattr.c linux-3.12.6-cher1/fs/xattr.c
--- linux-3.12.6/fs/xattr.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/fs/xattr.c	2013-12-24 13:58:59.413817501 +0400
@@ -371,6 +371,12 @@ SYSCALL_DEFINE5(setxattr, const char __u
 	struct path path;
 	int error;
 	unsigned int lookup_flags = LOOKUP_FOLLOW;
+
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 retry:
 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
 	if (error)
@@ -395,6 +401,12 @@ SYSCALL_DEFINE5(lsetxattr, const char __
 	struct path path;
 	int error;
 	unsigned int lookup_flags = 0;
+
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 retry:
 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
 	if (error)
@@ -415,10 +427,16 @@ retry:
 SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
 		const void __user *,value, size_t, size, int, flags)
 {
-	struct fd f = fdget(fd);
+	struct fd f;
 	struct dentry *dentry;
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+	f = fdget(fd);
 	if (!f.file)
 		return error;
 	dentry = f.file->f_path.dentry;
@@ -487,6 +505,12 @@ SYSCALL_DEFINE4(getxattr, const char __u
 	struct path path;
 	ssize_t error;
 	unsigned int lookup_flags = LOOKUP_FOLLOW;
+
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 retry:
 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
 	if (error)
@@ -506,6 +530,12 @@ SYSCALL_DEFINE4(lgetxattr, const char __
 	struct path path;
 	ssize_t error;
 	unsigned int lookup_flags = 0;
+
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 retry:
 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
 	if (error)
@@ -522,9 +552,15 @@ retry:
 SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name,
 		void __user *, value, size_t, size)
 {
-	struct fd f = fdget(fd);
+	struct fd f;
 	ssize_t error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+	f = fdget(fd);
 	if (!f.file)
 		return error;
 	audit_inode(NULL, f.file->f_path.dentry, 0);
@@ -577,6 +613,12 @@ SYSCALL_DEFINE3(listxattr, const char __
 	struct path path;
 	ssize_t error;
 	unsigned int lookup_flags = LOOKUP_FOLLOW;
+
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 retry:
 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
 	if (error)
@@ -596,6 +638,12 @@ SYSCALL_DEFINE3(llistxattr, const char _
 	struct path path;
 	ssize_t error;
 	unsigned int lookup_flags = 0;
+
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 retry:
 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
 	if (error)
@@ -611,9 +659,15 @@ retry:
 
 SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size)
 {
-	struct fd f = fdget(fd);
+	struct fd f;
 	ssize_t error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+	f = fdget(fd);
 	if (!f.file)
 		return error;
 	audit_inode(NULL, f.file->f_path.dentry, 0);
@@ -646,6 +700,12 @@ SYSCALL_DEFINE2(removexattr, const char
 	struct path path;
 	int error;
 	unsigned int lookup_flags = LOOKUP_FOLLOW;
+
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 retry:
 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
 	if (error)
@@ -669,6 +729,12 @@ SYSCALL_DEFINE2(lremovexattr, const char
 	struct path path;
 	int error;
 	unsigned int lookup_flags = 0;
+
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 retry:
 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
 	if (error)
@@ -688,10 +754,16 @@ retry:
 
 SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name)
 {
-	struct fd f = fdget(fd);
+	struct fd f;
 	struct dentry *dentry;
 	int error = -EBADF;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+	f = fdget(fd);
 	if (!f.file)
 		return error;
 	dentry = f.file->f_path.dentry;
diff -ruNp linux-3.12.6/include/linux/sched.h linux-3.12.6-cher1/include/linux/sched.h
--- linux-3.12.6/include/linux/sched.h	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/include/linux/sched.h	2013-12-24 13:58:59.413817501 +0400
@@ -1020,6 +1020,17 @@ enum perf_event_task_context {
 	perf_nr_task_contexts,
 };
 
+/* sandbox flags */
+enum {
+	SBOX_NO_SYSCALLS  = 1,   /* disable most "dangerous" syscalls */
+	SBOX_NO_EXEC      = 2,   /* disable exec syscall */
+	SBOX_MEMLIMITON   = 4,   /* enable memory limit check */
+	SBOX_WAS_MEMLIMIT = 8,   /* memory limit happened?  */
+	SBOX_WAS_SECURITY = 16,  /* was security violation? */
+	SBOX_TLON         = 32,  /* enable kernel time limit check */
+	SBOX_WAS_TL       = 64   /* was time limit? */
+};
+
 struct task_struct {
 	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
 	void *stack;
@@ -1411,8 +1422,19 @@ struct task_struct {
 	unsigned int	sequential_io;
 	unsigned int	sequential_io_avg;
 #endif
+
+	/* sandbox flags */
+	int sbox_flags;
 };
 
+#define SBOX_IS_RESTRICTED() unlikely(current->sbox_flags & SBOX_NO_SYSCALLS)
+#define SBOX_SET_SECURITY_ERR() do { current->sbox_flags |= SBOX_WAS_SECURITY; printk(KERN_ERR "%s: %s: %s: %d: security violation\n", current->comm, __FUNCTION__, __FILE__, __LINE__); } while (0)
+#define SBOX_SET_TL_ERR() (current->sbox_flags |= SBOX_WAS_TL)
+
+#define SBOX_IS_MEMLIMIT_ERR(p) (p->sbox_flags & SBOX_WAS_MEMLIMIT)
+#define SBOX_IS_SECURITY_ERR(p) (p->sbox_flags & SBOX_WAS_SECURITY)
+#define SBOX_IS_TL_ERR(p) (p->sbox_flags & SBOX_WAS_TL)
+
 /* Future-safe accessor for struct task_struct's cpus_allowed. */
 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
 
diff -ruNp linux-3.12.6/include/uapi/linux/ptrace.h linux-3.12.6-cher1/include/uapi/linux/ptrace.h
--- linux-3.12.6/include/uapi/linux/ptrace.h	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/include/uapi/linux/ptrace.h	2013-12-24 13:58:59.413817501 +0400
@@ -49,6 +49,10 @@
 #define PTRACE_GETREGSET	0x4204
 #define PTRACE_SETREGSET	0x4205
 
+#define PTRACE_MEMLIMIT         0x4280
+#define PTRACE_NO_SYSCALLS      0x4281
+#define PTRACE_TIMELIMIT        0x4282
+
 #define PTRACE_SEIZE		0x4206
 #define PTRACE_INTERRUPT	0x4207
 #define PTRACE_LISTEN		0x4208
diff -ruNp linux-3.12.6/ipc/compat.c linux-3.12.6-cher1/ipc/compat.c
--- linux-3.12.6/ipc/compat.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/ipc/compat.c	2013-12-24 13:58:59.413817501 +0400
@@ -335,6 +335,10 @@ COMPAT_SYSCALL_DEFINE6(ipc, u32, call, i
 	int version;
 	u32 pad;
 
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 	version = call >> 16; /* hack for backward compatibility */
 	call &= 0xffff;
 
diff -ruNp linux-3.12.6/ipc/mqueue.c linux-3.12.6-cher1/ipc/mqueue.c
--- linux-3.12.6/ipc/mqueue.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/ipc/mqueue.c	2013-12-24 13:58:59.414817513 +0400
@@ -788,6 +788,11 @@ SYSCALL_DEFINE4(mq_open, const char __us
 	struct dentry *root = mnt->mnt_root;
 	int ro;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_attr && copy_from_user(&attr, u_attr, sizeof(struct mq_attr)))
 		return -EFAULT;
 
@@ -865,6 +870,11 @@ SYSCALL_DEFINE1(mq_unlink, const char __
 	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
 	struct vfsmount *mnt = ipc_ns->mq_mnt;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	name = getname(u_name);
 	if (IS_ERR(name))
 		return PTR_ERR(name);
@@ -966,6 +976,11 @@ SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqd
 	struct posix_msg_tree_node *new_leaf = NULL;
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_abs_timeout) {
 		int res = prepare_timeout(u_abs_timeout, &expires, &ts);
 		if (res)
@@ -1085,6 +1100,11 @@ SYSCALL_DEFINE5(mq_timedreceive, mqd_t,
 	struct timespec ts;
 	struct posix_msg_tree_node *new_leaf = NULL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_abs_timeout) {
 		int res = prepare_timeout(u_abs_timeout, &expires, &ts);
 		if (res)
@@ -1190,6 +1210,11 @@ SYSCALL_DEFINE2(mq_notify, mqd_t, mqdes,
 	struct mqueue_inode_info *info;
 	struct sk_buff *nc;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_notification) {
 		if (copy_from_user(&notification, u_notification,
 					sizeof(struct sigevent)))
@@ -1321,6 +1346,11 @@ SYSCALL_DEFINE3(mq_getsetattr, mqd_t, mq
 	struct inode *inode;
 	struct mqueue_inode_info *info;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (u_mqstat != NULL) {
 		if (copy_from_user(&mqstat, u_mqstat, sizeof(struct mq_attr)))
 			return -EFAULT;
diff -ruNp linux-3.12.6/ipc/msg.c linux-3.12.6-cher1/ipc/msg.c
--- linux-3.12.6/ipc/msg.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/ipc/msg.c	2013-12-24 13:58:59.414817513 +0400
@@ -303,6 +303,11 @@ SYSCALL_DEFINE2(msgget, key_t, key, int,
 	struct ipc_ops msg_ops;
 	struct ipc_params msg_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	msg_ops.getnew = newque;
@@ -584,6 +589,11 @@ SYSCALL_DEFINE3(msgctl, int, msqid, int,
 	int version;
 	struct ipc_namespace *ns;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (msqid < 0 || cmd < 0)
 		return -EINVAL;
 
@@ -773,6 +783,11 @@ SYSCALL_DEFINE4(msgsnd, int, msqid, stru
 {
 	long mtype;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(mtype, &msgp->mtype))
 		return -EFAULT;
 	return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
@@ -1035,6 +1050,11 @@ out_unlock1:
 SYSCALL_DEFINE5(msgrcv, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
 		long, msgtyp, int, msgflg)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_msgrcv(msqid, msgp, msgsz, msgtyp, msgflg, do_msg_fill);
 }
 
diff -ruNp linux-3.12.6/ipc/sem.c linux-3.12.6-cher1/ipc/sem.c
--- linux-3.12.6/ipc/sem.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/ipc/sem.c	2013-12-24 13:58:59.415817525 +0400
@@ -568,6 +568,11 @@ SYSCALL_DEFINE3(semget, key_t, key, int,
 	struct ipc_ops sem_ops;
 	struct ipc_params sem_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	if (nsems < 0 || nsems > ns->sc_semmsl)
@@ -1560,6 +1565,11 @@ SYSCALL_DEFINE4(semctl, int, semid, int,
 	struct ipc_namespace *ns;
 	void __user *p = (void __user *)arg;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (semid < 0)
 		return -EINVAL;
 
@@ -1773,6 +1783,11 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
 	struct ipc_namespace *ns;
 	struct list_head tasks;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	if (nsops < 1 || semid < 0)
diff -ruNp linux-3.12.6/ipc/shm.c linux-3.12.6-cher1/ipc/shm.c
--- linux-3.12.6/ipc/shm.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/ipc/shm.c	2013-12-24 13:58:59.415817525 +0400
@@ -613,6 +613,11 @@ SYSCALL_DEFINE3(shmget, key_t, key, size
 	struct ipc_ops shm_ops;
 	struct ipc_params shm_params;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ns = current->nsproxy->ipc_ns;
 
 	shm_ops.getnew = newseg;
@@ -945,6 +950,11 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int,
 	if (cmd < 0 || shmid < 0)
 		return -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	version = ipc_parse_version(&cmd);
 	ns = current->nsproxy->ipc_ns;
 
@@ -1208,6 +1218,11 @@ SYSCALL_DEFINE3(shmat, int, shmid, char
 	unsigned long ret;
 	long err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = do_shmat(shmid, shmaddr, shmflg, &ret, SHMLBA);
 	if (err)
 		return err;
@@ -1230,6 +1245,11 @@ SYSCALL_DEFINE1(shmdt, char __user *, sh
 	struct vm_area_struct *next;
 #endif
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (addr & ~PAGE_MASK)
 		return retval;
 
diff -ruNp linux-3.12.6/ipc/syscall.c linux-3.12.6-cher1/ipc/syscall.c
--- linux-3.12.6/ipc/syscall.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/ipc/syscall.c	2013-12-24 13:58:59.415817525 +0400
@@ -18,6 +18,11 @@ SYSCALL_DEFINE6(ipc, unsigned int, call,
 {
 	int version, ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	version = call >> 16; /* hack for backward compatibility */
 	call &= 0xffff;
 
diff -ruNp linux-3.12.6/kernel/acct.c linux-3.12.6-cher1/kernel/acct.c
--- linux-3.12.6/kernel/acct.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/acct.c	2013-12-24 13:58:59.415817525 +0400
@@ -256,6 +256,11 @@ SYSCALL_DEFINE1(acct, const char __user
 {
 	int error = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_PACCT))
 		return -EPERM;
 
diff -ruNp linux-3.12.6/kernel/capability.c linux-3.12.6-cher1/kernel/capability.c
--- linux-3.12.6/kernel/capability.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/capability.c	2013-12-24 13:58:59.415817525 +0400
@@ -238,6 +238,11 @@ SYSCALL_DEFINE2(capset, cap_user_header_
 	int ret;
 	pid_t pid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ret = cap_validate_magic(header, &tocopy);
 	if (ret != 0)
 		return ret;
diff -ruNp linux-3.12.6/kernel/compat.c linux-3.12.6-cher1/kernel/compat.c
--- linux-3.12.6/kernel/compat.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/compat.c	2013-12-24 13:58:59.415817525 +0400
@@ -133,6 +133,11 @@ asmlinkage long compat_sys_settimeofday(
 	struct timespec kts;
 	struct timezone ktz;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (tv) {
 		if (compat_get_timeval_convert(&kts, tv))
 			return -EFAULT;
@@ -296,6 +301,11 @@ COMPAT_SYSCALL_DEFINE2(getitimer, int, w
 	struct itimerval kit;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = do_getitimer(which, &kit);
 	if (!error && put_compat_itimerval(it, &kit))
 		error = -EFAULT;
@@ -309,6 +319,11 @@ COMPAT_SYSCALL_DEFINE3(setitimer, int, w
 	struct itimerval kin, kout;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (in) {
 		if (get_compat_itimerval(&kin, in))
 			return -EFAULT;
@@ -330,6 +345,11 @@ static compat_clock_t clock_t_to_compat_
 
 asmlinkage long compat_sys_times(struct compat_tms __user *tbuf)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (tbuf) {
 		struct tms tms;
 		struct compat_tms tmp;
@@ -390,6 +410,10 @@ COMPAT_SYSCALL_DEFINE3(sigprocmask, int,
 
 	old_set = current->blocked.sig[0];
 
+        if (SBOX_IS_RESTRICTED()) {
+                nset = NULL;
+        }
+
 	if (nset) {
 		if (get_user(new_set, nset))
 			return -EFAULT;
@@ -429,6 +453,9 @@ asmlinkage long compat_sys_setrlimit(uns
 {
 	struct rlimit r;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!access_ok(VERIFY_READ, rlim, sizeof(*rlim)) ||
 	    __get_user(r.rlim_cur, &rlim->rlim_cur) ||
 	    __get_user(r.rlim_max, &rlim->rlim_max))
@@ -603,6 +630,11 @@ asmlinkage long compat_sys_sched_setaffi
 	cpumask_var_t new_mask;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!alloc_cpumask_var(&new_mask, GFP_KERNEL))
 		return -ENOMEM;
 
@@ -668,6 +700,11 @@ long compat_sys_timer_create(clockid_t w
 {
 	struct sigevent __user *event = NULL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (timer_event_spec) {
 		struct sigevent kevent;
 
@@ -688,6 +725,11 @@ long compat_sys_timer_settime(timer_t ti
 	mm_segment_t oldfs;
 	struct itimerspec newts, oldts;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!new)
 		return -EINVAL;
 	if (get_compat_itimerspec(&newts, new))
@@ -710,6 +752,11 @@ long compat_sys_timer_gettime(timer_t ti
 	mm_segment_t oldfs;
 	struct itimerspec ts;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	oldfs = get_fs();
 	set_fs(KERNEL_DS);
 	err = sys_timer_gettime(timer_id,
@@ -727,6 +774,11 @@ long compat_sys_clock_settime(clockid_t
 	mm_segment_t oldfs;
 	struct timespec ts;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_compat_timespec(&ts, tp))
 		return -EFAULT;
 	oldfs = get_fs();
@@ -744,6 +796,11 @@ long compat_sys_clock_gettime(clockid_t
 	mm_segment_t oldfs;
 	struct timespec ts;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	oldfs = get_fs();
 	set_fs(KERNEL_DS);
 	err = sys_clock_gettime(which_clock,
@@ -761,6 +818,11 @@ long compat_sys_clock_adjtime(clockid_t
 	mm_segment_t oldfs;
 	int err, ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = compat_get_timex(&txc, utp);
 	if (err)
 		return err;
@@ -784,6 +846,11 @@ long compat_sys_clock_getres(clockid_t w
 	mm_segment_t oldfs;
 	struct timespec ts;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	oldfs = get_fs();
 	set_fs(KERNEL_DS);
 	err = sys_clock_getres(which_clock,
@@ -1031,6 +1098,11 @@ asmlinkage long compat_sys_stime(compat_
 	struct timespec tv;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(tv.tv_sec, tptr))
 		return -EFAULT;
 
@@ -1051,6 +1123,11 @@ asmlinkage long compat_sys_adjtimex(stru
 	struct timex txc;
 	int err, ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = compat_get_timex(&txc, utp);
 	if (err)
 		return err;
@@ -1074,6 +1151,11 @@ asmlinkage long compat_sys_move_pages(pi
 	const void __user * __user *pages;
 	int i;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	pages = compat_alloc_user_space(nr_pages * sizeof(void *));
 	for (i = 0; i < nr_pages; i++) {
 		compat_uptr_t p;
@@ -1096,6 +1178,11 @@ asmlinkage long compat_sys_migrate_pages
 	unsigned long nr_bits;
 	unsigned long size;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	nr_bits = min_t(unsigned long, maxnode - 1, MAX_NUMNODES);
 	size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 	if (old_nodes) {
diff -ruNp linux-3.12.6/kernel/events/core.c linux-3.12.6-cher1/kernel/events/core.c
--- linux-3.12.6/kernel/events/core.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/events/core.c	2013-12-24 13:58:59.417817549 +0400
@@ -6934,6 +6934,11 @@ SYSCALL_DEFINE5(perf_event_open,
 	int move_group = 0;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* for future expandability... */
 	if (flags & ~PERF_FLAG_ALL)
 		return -EINVAL;
diff -ruNp linux-3.12.6/kernel/exec_domain.c linux-3.12.6-cher1/kernel/exec_domain.c
--- linux-3.12.6/kernel/exec_domain.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/exec_domain.c	2013-12-24 13:58:59.417817549 +0400
@@ -183,6 +183,9 @@ SYSCALL_DEFINE1(personality, unsigned in
 {
 	unsigned int old = current->personality;
 
+        if (SBOX_IS_RESTRICTED())
+                return old;
+
 	if (personality != 0xffffffff)
 		set_personality(personality);
 
diff -ruNp linux-3.12.6/kernel/exit.c linux-3.12.6-cher1/kernel/exit.c
--- linux-3.12.6/kernel/exit.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/exit.c	2013-12-24 13:58:59.418817561 +0400
@@ -1116,8 +1116,16 @@ static int wait_task_zombie(struct wait_
 		? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
 	status = (p->signal->flags & SIGNAL_GROUP_EXIT)
 		? p->signal->group_exit_code : p->exit_code;
-	if (!retval && wo->wo_stat)
-		retval = put_user(status, wo->wo_stat);
+	if (!retval && wo->wo_stat) {
+                int newstatus = status;
+                if (SBOX_IS_MEMLIMIT_ERR(p))
+                        newstatus |= 0x10000;
+                if (SBOX_IS_SECURITY_ERR(p))
+                        newstatus |= 0x20000;
+                if (SBOX_IS_TL_ERR(p))
+                        newstatus |= 0x40000;
+		retval = put_user(newstatus, wo->wo_stat);
+        }
 
 	infop = wo->wo_info;
 	if (!retval && infop)
@@ -1251,8 +1259,16 @@ unlock_sig:
 
 	retval = wo->wo_rusage
 		? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
-	if (!retval && wo->wo_stat)
-		retval = put_user((exit_code << 8) | 0x7f, wo->wo_stat);
+	if (!retval && wo->wo_stat) {
+                int newstatus = (exit_code << 8) | 0x7f;
+                if (SBOX_IS_MEMLIMIT_ERR(p))
+                        newstatus |= 0x10000;
+                if (SBOX_IS_SECURITY_ERR(p))
+                        newstatus |= 0x20000;
+                if (SBOX_IS_TL_ERR(p))
+                        newstatus |= 0x40000;
+		retval = put_user(newstatus, wo->wo_stat);
+        }
 
 	infop = wo->wo_info;
 	if (!retval && infop)
diff -ruNp linux-3.12.6/kernel/fork.c linux-3.12.6-cher1/kernel/fork.c
--- linux-3.12.6/kernel/fork.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/fork.c	2013-12-24 13:58:59.418817561 +0400
@@ -1575,6 +1575,11 @@ long do_fork(unsigned long clone_flags,
 	int trace = 0;
 	long nr;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/*
 	 * Determine whether and which event to report to ptracer.  When
 	 * called from kernel_thread or CLONE_UNTRACED is explicitly
@@ -1810,6 +1815,11 @@ SYSCALL_DEFINE1(unshare, unsigned long,
 	int do_sysvsem = 0;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/*
 	 * If unsharing a user namespace must also unshare the thread.
 	 */
diff -ruNp linux-3.12.6/kernel/groups.c linux-3.12.6-cher1/kernel/groups.c
--- linux-3.12.6/kernel/groups.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/groups.c	2013-12-24 13:58:59.418817561 +0400
@@ -233,6 +233,11 @@ SYSCALL_DEFINE2(setgroups, int, gidsetsi
 	struct group_info *group_info;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!ns_capable(current_user_ns(), CAP_SETGID))
 		return -EPERM;
 	if ((unsigned)gidsetsize > NGROUPS_MAX)
diff -ruNp linux-3.12.6/kernel/kcmp.c linux-3.12.6-cher1/kernel/kcmp.c
--- linux-3.12.6/kernel/kcmp.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/kcmp.c	2013-12-24 13:58:59.418817561 +0400
@@ -99,6 +99,11 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t
 	struct task_struct *task1, *task2;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	rcu_read_lock();
 
 	/*
diff -ruNp linux-3.12.6/kernel/kexec.c linux-3.12.6-cher1/kernel/kexec.c
--- linux-3.12.6/kernel/kexec.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/kexec.c	2013-12-24 13:58:59.419817573 +0400
@@ -941,6 +941,11 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
 	struct kimage **dest_image, *image;
 	int result;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* We only trust the superuser with rebooting the system. */
 	if (!capable(CAP_SYS_BOOT))
 		return -EPERM;
@@ -1047,6 +1052,11 @@ asmlinkage long compat_sys_kexec_load(un
 	struct kexec_segment out, __user *ksegments;
 	unsigned long i, result;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Don't allow clients that don't understand the native
 	 * architecture to do anything.
 	 */
diff -ruNp linux-3.12.6/kernel/module.c linux-3.12.6-cher1/kernel/module.c
--- linux-3.12.6/kernel/module.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/module.c	2013-12-24 13:58:59.419817573 +0400
@@ -835,6 +835,11 @@ SYSCALL_DEFINE2(delete_module, const cha
 	char name[MODULE_NAME_LEN];
 	int ret, forced = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_MODULE) || modules_disabled)
 		return -EPERM;
 
@@ -3354,6 +3359,11 @@ SYSCALL_DEFINE3(init_module, void __user
 	int err;
 	struct load_info info = { };
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = may_init_module();
 	if (err)
 		return err;
@@ -3373,6 +3383,11 @@ SYSCALL_DEFINE3(finit_module, int, fd, c
 	int err;
 	struct load_info info = { };
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	err = may_init_module();
 	if (err)
 		return err;
diff -ruNp linux-3.12.6/kernel/nsproxy.c linux-3.12.6-cher1/kernel/nsproxy.c
--- linux-3.12.6/kernel/nsproxy.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/nsproxy.c	2013-12-24 13:58:59.419817573 +0400
@@ -234,6 +234,11 @@ SYSCALL_DEFINE2(setns, int, fd, int, nst
 	struct file *file;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	file = proc_ns_fget(fd);
 	if (IS_ERR(file))
 		return PTR_ERR(file);
diff -ruNp linux-3.12.6/kernel/posix-cpu-timers.c linux-3.12.6-cher1/kernel/posix-cpu-timers.c
--- linux-3.12.6/kernel/posix-cpu-timers.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/posix-cpu-timers.c	2013-12-24 13:58:59.419817573 +0400
@@ -921,6 +921,8 @@ static void check_thread_timers(struct t
 			 * At the hard limit, we just die.
 			 * No need to calculate anything else now.
 			 */
+                        if ((tsk->sbox_flags & SBOX_TLON))
+                                tsk->sbox_flags |= SBOX_WAS_TL;
 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
 			return;
 		}
@@ -1027,6 +1029,8 @@ static void check_process_timers(struct
 			 * At the hard limit, we just die.
 			 * No need to calculate anything else now.
 			 */
+                        if ((tsk->sbox_flags & SBOX_TLON))
+                                tsk->sbox_flags |= SBOX_WAS_TL;
 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
 			return;
 		}
diff -ruNp linux-3.12.6/kernel/printk/printk.c linux-3.12.6-cher1/kernel/printk/printk.c
--- linux-3.12.6/kernel/printk/printk.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/printk/printk.c	2013-12-24 13:58:59.421817598 +0400
@@ -1253,6 +1253,9 @@ out:
 
 SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
 	return do_syslog(type, buf, len, SYSLOG_FROM_READER);
 }
 
diff -ruNp linux-3.12.6/kernel/ptrace.c linux-3.12.6-cher1/kernel/ptrace.c
--- linux-3.12.6/kernel/ptrace.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/ptrace.c	2013-12-24 13:58:59.421817598 +0400
@@ -1039,6 +1039,24 @@ SYSCALL_DEFINE4(ptrace, long, request, l
 	struct task_struct *child;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+        if (request == PTRACE_MEMLIMIT) {
+                current->sbox_flags |= SBOX_MEMLIMITON;
+                return 0;
+        }
+        if (request == PTRACE_NO_SYSCALLS) {
+                current->sbox_flags |= SBOX_NO_SYSCALLS;
+                return 0;
+        }
+        if (request == PTRACE_TIMELIMIT) {
+                current->sbox_flags |= SBOX_TLON;
+                return 0;
+        }
+
 	if (request == PTRACE_TRACEME) {
 		ret = ptrace_traceme();
 		if (!ret)
@@ -1186,6 +1204,24 @@ asmlinkage long compat_sys_ptrace(compat
 	struct task_struct *child;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+        if (request == PTRACE_MEMLIMIT) {
+                current->sbox_flags |= SBOX_MEMLIMITON;
+                return 0;
+        }
+        if (request == PTRACE_NO_SYSCALLS) {
+                current->sbox_flags |= SBOX_NO_SYSCALLS;
+                return 0;
+        }
+        if (request == PTRACE_TIMELIMIT) {
+                current->sbox_flags |= SBOX_TLON;
+                return 0;
+        }
+
 	if (request == PTRACE_TRACEME) {
 		ret = ptrace_traceme();
 		goto out;
diff -ruNp linux-3.12.6/kernel/reboot.c linux-3.12.6-cher1/kernel/reboot.c
--- linux-3.12.6/kernel/reboot.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/reboot.c	2013-12-24 13:58:59.421817598 +0400
@@ -199,10 +199,16 @@ static DEFINE_MUTEX(reboot_mutex);
 SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
 		void __user *, arg)
 {
-	struct pid_namespace *pid_ns = task_active_pid_ns(current);
+        struct pid_namespace *pid_ns = NULL;
 	char buffer[256];
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+	pid_ns = task_active_pid_ns(current);
 	/* We only trust the superuser with rebooting the system. */
 	if (!ns_capable(pid_ns->user_ns, CAP_SYS_BOOT))
 		return -EPERM;
diff -ruNp linux-3.12.6/kernel/sched/core.c linux-3.12.6-cher1/kernel/sched/core.c
--- linux-3.12.6/kernel/sched/core.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/sched/core.c	2013-12-24 13:58:59.422817610 +0400
@@ -3149,6 +3149,9 @@ SYSCALL_DEFINE1(nice, int, increment)
 {
 	long nice, retval;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/*
 	 * Setpriority might change our priority at the same moment.
 	 * We don't have to worry. Conceptually one call occurs first
@@ -3503,6 +3506,11 @@ do_sched_setscheduler(pid_t pid, int pol
 SYSCALL_DEFINE3(sched_setscheduler, pid_t, pid, int, policy,
 		struct sched_param __user *, param)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* negative values for policy are not valid */
 	if (policy < 0)
 		return -EINVAL;
@@ -3519,6 +3527,11 @@ SYSCALL_DEFINE3(sched_setscheduler, pid_
  */
 SYSCALL_DEFINE2(sched_setparam, pid_t, pid, struct sched_param __user *, param)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_sched_setscheduler(pid, -1, param);
 }
 
@@ -3690,6 +3703,11 @@ SYSCALL_DEFINE3(sched_setaffinity, pid_t
 	cpumask_var_t new_mask;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!alloc_cpumask_var(&new_mask, GFP_KERNEL))
 		return -ENOMEM;
 
diff -ruNp linux-3.12.6/kernel/signal.c linux-3.12.6-cher1/kernel/signal.c
--- linux-3.12.6/kernel/signal.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/signal.c	2013-12-24 13:58:59.423817622 +0400
@@ -2607,6 +2607,10 @@ SYSCALL_DEFINE4(rt_sigprocmask, int, how
 	sigset_t old_set, new_set;
 	int error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                nset = NULL;
+        }
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		return -EINVAL;
@@ -2638,6 +2642,10 @@ COMPAT_SYSCALL_DEFINE4(rt_sigprocmask, i
 #ifdef __BIG_ENDIAN
 	sigset_t old_set = current->blocked;
 
+        if (SBOX_IS_RESTRICTED()) {
+                nset = NULL;
+        }
+
 	/* XXX: Don't preclude handling different sized sigset_t's.  */
 	if (sigsetsize != sizeof(sigset_t))
 		return -EINVAL;
@@ -2910,6 +2918,14 @@ SYSCALL_DEFINE2(kill, pid_t, pid, int, s
 {
 	struct siginfo info;
 
+        if (SBOX_IS_RESTRICTED()) {
+                if (!pid) pid = current->pid;
+                if (pid != current->pid) {
+                        SBOX_SET_SECURITY_ERR();
+                        return -EPERM;
+                }
+        }
+
 	info.si_signo = sig;
 	info.si_errno = 0;
 	info.si_code = SI_USER;
@@ -2978,6 +2994,11 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
 	if (pid <= 0 || tgid <= 0)
 		return -EINVAL;
 
+        if (SBOX_IS_RESTRICTED() && current->pid != tgid) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_tkill(tgid, pid, sig);
 }
 
@@ -2994,6 +3015,11 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int,
 	if (pid <= 0)
 		return -EINVAL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	return do_tkill(0, pid, sig);
 }
 
@@ -3201,6 +3227,10 @@ out:
 }
 SYSCALL_DEFINE2(sigaltstack,const stack_t __user *,uss, stack_t __user *,uoss)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 	return do_sigaltstack(uss, uoss, current_user_stack_pointer());
 }
 
@@ -3228,6 +3258,10 @@ COMPAT_SYSCALL_DEFINE2(sigaltstack,
 	int ret;
 	mm_segment_t seg;
 
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 	if (uss_ptr) {
 		compat_stack_t uss32;
 
@@ -3300,6 +3334,10 @@ SYSCALL_DEFINE3(sigprocmask, int, how, o
 	old_sigset_t old_set, new_set;
 	sigset_t new_blocked;
 
+        if (SBOX_IS_RESTRICTED()) {
+                nset = NULL;
+        }
+
 	old_set = current->blocked.sig[0];
 
 	if (nset) {
@@ -3511,6 +3549,10 @@ SYSCALL_DEFINE1(ssetmask, int, newmask)
 	int old = current->blocked.sig[0];
 	sigset_t newset;
 
+        if (SBOX_IS_RESTRICTED()) {
+                return old;
+        }
+
 	siginitset(&newset, newmask);
 	set_current_blocked(&newset);
 
diff -ruNp linux-3.12.6/kernel/sys.c linux-3.12.6-cher1/kernel/sys.c
--- linux-3.12.6/kernel/sys.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/sys.c	2013-12-24 13:58:59.423817622 +0400
@@ -170,6 +170,11 @@ SYSCALL_DEFINE3(setpriority, int, which,
 	struct pid *pgrp;
 	kuid_t uid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (which > PRIO_USER || which < PRIO_PROCESS)
 		goto out;
 
@@ -320,6 +325,11 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
 	int retval;
 	kgid_t krgid, kegid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	krgid = make_kgid(ns, rgid);
 	kegid = make_kgid(ns, egid);
 
@@ -377,6 +387,11 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
 	int retval;
 	kgid_t kgid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	kgid = make_kgid(ns, gid);
 	if (!gid_valid(kgid))
 		return -EINVAL;
@@ -453,6 +468,11 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
 	int retval;
 	kuid_t kruid, keuid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	kruid = make_kuid(ns, ruid);
 	keuid = make_kuid(ns, euid);
 
@@ -524,6 +544,11 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
 	int retval;
 	kuid_t kuid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	kuid = make_kuid(ns, uid);
 	if (!uid_valid(kuid))
 		return -EINVAL;
@@ -571,6 +596,11 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
 	int retval;
 	kuid_t kruid, keuid, ksuid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	kruid = make_kuid(ns, ruid);
 	keuid = make_kuid(ns, euid);
 	ksuid = make_kuid(ns, suid);
@@ -656,6 +686,11 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
 	int retval;
 	kgid_t krgid, kegid, ksgid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	krgid = make_kgid(ns, rgid);
 	kegid = make_kgid(ns, egid);
 	ksgid = make_kgid(ns, sgid);
@@ -731,6 +766,11 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
 	uid_t old_fsuid;
 	kuid_t kuid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	old = current_cred();
 	old_fsuid = from_kuid_munged(old->user_ns, old->fsuid);
 
@@ -770,6 +810,11 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
 	gid_t old_fsgid;
 	kgid_t kgid;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	old = current_cred();
 	old_fsgid = from_kgid_munged(old->user_ns, old->fsgid);
 
@@ -906,6 +951,11 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid
 	struct pid *pgrp;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!pid)
 		pid = task_pid_vnr(group_leader);
 	if (!pgid)
@@ -1053,6 +1103,11 @@ SYSCALL_DEFINE0(setsid)
 	pid_t session = pid_vnr(sid);
 	int err = -EPERM;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	write_lock_irq(&tasklist_lock);
 	/* Fail if I am already a session leader */
 	if (group_leader->signal->leader)
@@ -1199,6 +1254,11 @@ SYSCALL_DEFINE2(sethostname, char __user
 	int errno;
 	char tmp[__NEW_UTS_LEN];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!ns_capable(current->nsproxy->uts_ns->user_ns, CAP_SYS_ADMIN))
 		return -EPERM;
 
@@ -1250,6 +1310,11 @@ SYSCALL_DEFINE2(setdomainname, char __us
 	int errno;
 	char tmp[__NEW_UTS_LEN];
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!ns_capable(current->nsproxy->uts_ns->user_ns, CAP_SYS_ADMIN))
 		return -EPERM;
 	if (len < 0 || len > __NEW_UTS_LEN)
@@ -1437,6 +1502,15 @@ SYSCALL_DEFINE4(prlimit64, pid_t, pid, u
 	struct task_struct *tsk;
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                if (!pid) pid = current->pid;
+                if (pid != current->pid) {
+                        SBOX_SET_SECURITY_ERR();
+                        return -EPERM;
+                }
+                new_rlim = NULL;
+        }
+
 	if (new_rlim) {
 		if (copy_from_user(&new64, new_rlim, sizeof(new64)))
 			return -EFAULT;
@@ -1474,6 +1548,10 @@ SYSCALL_DEFINE2(setrlimit, unsigned int,
 {
 	struct rlimit new_rlim;
 
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 	if (copy_from_user(&new_rlim, rlim, sizeof(*rlim)))
 		return -EFAULT;
 	return do_prlimit(current, resource, &new_rlim, NULL);
@@ -1627,6 +1705,10 @@ COMPAT_SYSCALL_DEFINE2(getrusage, int, w
 
 SYSCALL_DEFINE1(umask, int, mask)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                return current->fs->umask;
+        }
+
 	mask = xchg(&current->fs->umask, mask & S_IRWXUGO);
 	return mask;
 }
@@ -1843,6 +1925,11 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
 	unsigned char comm[sizeof(me->comm)];
 	long error;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	error = security_task_prctl(option, arg2, arg3, arg4, arg5);
 	if (error != -ENOSYS)
 		return error;
@@ -2088,6 +2175,10 @@ SYSCALL_DEFINE1(sysinfo, struct sysinfo
 {
 	struct sysinfo val;
 
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 	do_sysinfo(&val);
 
 	if (copy_to_user(info, &val, sizeof(struct sysinfo)))
@@ -2118,6 +2209,10 @@ COMPAT_SYSCALL_DEFINE1(sysinfo, struct c
 {
 	struct sysinfo s;
 
+        if (SBOX_IS_RESTRICTED()) {
+                return -EPERM;
+        }
+
 	do_sysinfo(&s);
 
 	/* Check to see if any memory value is too large for 32-bit and scale
diff -ruNp linux-3.12.6/kernel/sysctl_binary.c linux-3.12.6-cher1/kernel/sysctl_binary.c
--- linux-3.12.6/kernel/sysctl_binary.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/sysctl_binary.c	2013-12-24 13:58:59.423817622 +0400
@@ -1422,6 +1422,11 @@ SYSCALL_DEFINE1(sysctl, struct __sysctl_
 	size_t oldlen = 0;
 	ssize_t result;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_from_user(&tmp, args, sizeof(tmp)))
 		return -EFAULT;
 
@@ -1465,6 +1470,11 @@ COMPAT_SYSCALL_DEFINE1(sysctl, struct co
 	size_t oldlen = 0;
 	ssize_t result;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (copy_from_user(&tmp, args, sizeof(tmp)))
 		return -EFAULT;
 
diff -ruNp linux-3.12.6/kernel/time.c linux-3.12.6-cher1/kernel/time.c
--- linux-3.12.6/kernel/time.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/time.c	2013-12-24 13:58:59.423817622 +0400
@@ -83,6 +83,11 @@ SYSCALL_DEFINE1(stime, time_t __user *,
 	struct timespec tv;
 	int err;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (get_user(tv.tv_sec, tptr))
 		return -EFAULT;
 
@@ -192,6 +197,11 @@ SYSCALL_DEFINE2(settimeofday, struct tim
 	struct timespec	new_ts;
 	struct timezone new_tz;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (tv) {
 		if (copy_from_user(&user_tv, tv, sizeof(*tv)))
 			return -EFAULT;
@@ -211,6 +221,11 @@ SYSCALL_DEFINE1(adjtimex, struct timex _
 	struct timex txc;		/* Local copy of parameter */
 	int ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Copy the user data space into the kernel copy
 	 * structure. But bear in mind that the structures
 	 * may change
diff -ruNp linux-3.12.6/kernel/uid16.c linux-3.12.6-cher1/kernel/uid16.c
--- linux-3.12.6/kernel/uid16.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/kernel/uid16.c	2013-12-24 13:58:59.424817634 +0400
@@ -176,6 +176,11 @@ SYSCALL_DEFINE2(setgroups16, int, gidset
 	struct group_info *group_info;
 	int retval;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!ns_capable(current_user_ns(), CAP_SETGID))
 		return -EPERM;
 	if ((unsigned)gidsetsize > NGROUPS_MAX)
diff -ruNp linux-3.12.6/Makefile linux-3.12.6-cher1/Makefile
--- linux-3.12.6/Makefile	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/Makefile	2013-12-24 13:59:14.490000524 +0400
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 12
 SUBLEVEL = 6
-EXTRAVERSION =
+EXTRAVERSION = -cher1
 NAME = One Giant Leap for Frogkind
 
 # *DOCUMENTATION*
diff -ruNp linux-3.12.6/mm/fadvise.c linux-3.12.6-cher1/mm/fadvise.c
--- linux-3.12.6/mm/fadvise.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/mm/fadvise.c	2013-12-24 13:58:59.425817646 +0400
@@ -27,7 +27,7 @@
  */
 SYSCALL_DEFINE4(fadvise64_64, int, fd, loff_t, offset, loff_t, len, int, advice)
 {
-	struct fd f = fdget(fd);
+	struct fd f;
 	struct address_space *mapping;
 	struct backing_dev_info *bdi;
 	loff_t endbyte;			/* inclusive */
@@ -36,6 +36,10 @@ SYSCALL_DEFINE4(fadvise64_64, int, fd, l
 	unsigned long nrpages;
 	int ret = 0;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
+	f = fdget(fd);
 	if (!f.file)
 		return -EBADF;
 
diff -ruNp linux-3.12.6/mm/fremap.c linux-3.12.6-cher1/mm/fremap.c
--- linux-3.12.6/mm/fremap.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/mm/fremap.c	2013-12-24 13:58:59.425817646 +0400
@@ -136,6 +136,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
 	int has_write_lock = 0;
 	vm_flags_t vm_flags = 0;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (prot)
 		return err;
 	/*
diff -ruNp linux-3.12.6/mm/madvise.c linux-3.12.6-cher1/mm/madvise.c
--- linux-3.12.6/mm/madvise.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/mm/madvise.c	2013-12-24 13:58:59.425817646 +0400
@@ -472,6 +472,9 @@ SYSCALL_DEFINE3(madvise, unsigned long,
 	size_t len;
 	struct blk_plug plug;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 #ifdef CONFIG_MEMORY_FAILURE
 	if (behavior == MADV_HWPOISON || behavior == MADV_SOFT_OFFLINE)
 		return madvise_hwpoison(behavior, start, start+len_in);
diff -ruNp linux-3.12.6/mm/mempolicy.c linux-3.12.6-cher1/mm/mempolicy.c
--- linux-3.12.6/mm/mempolicy.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/mm/mempolicy.c	2013-12-24 13:58:59.426817658 +0400
@@ -1400,6 +1400,9 @@ SYSCALL_DEFINE6(mbind, unsigned long, st
 	int err;
 	unsigned short mode_flags;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	mode_flags = mode & MPOL_MODE_FLAGS;
 	mode &= ~MPOL_MODE_FLAGS;
 	if (mode >= MPOL_MAX)
@@ -1421,6 +1424,9 @@ SYSCALL_DEFINE3(set_mempolicy, int, mode
 	nodemask_t nodes;
 	unsigned short flags;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	flags = mode & MPOL_MODE_FLAGS;
 	mode &= ~MPOL_MODE_FLAGS;
 	if ((unsigned int)mode >= MPOL_MAX)
@@ -1446,6 +1452,9 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
 	nodemask_t *new;
 	NODEMASK_SCRATCH(scratch);
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!scratch)
 		return -ENOMEM;
 
@@ -1537,6 +1546,9 @@ SYSCALL_DEFINE5(get_mempolicy, int __use
 	int uninitialized_var(pval);
 	nodemask_t nodes;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (nmask != NULL && maxnode < MAX_NUMNODES)
 		return -EINVAL;
 
@@ -1566,6 +1578,9 @@ asmlinkage long compat_sys_get_mempolicy
 	unsigned long nr_bits, alloc_size;
 	DECLARE_BITMAP(bm, MAX_NUMNODES);
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
@@ -1594,6 +1609,9 @@ asmlinkage long compat_sys_set_mempolicy
 	unsigned long nr_bits, alloc_size;
 	DECLARE_BITMAP(bm, MAX_NUMNODES);
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
@@ -1618,6 +1636,9 @@ asmlinkage long compat_sys_mbind(compat_
 	unsigned long nr_bits, alloc_size;
 	nodemask_t bm;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
diff -ruNp linux-3.12.6/mm/migrate.c linux-3.12.6-cher1/mm/migrate.c
--- linux-3.12.6/mm/migrate.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/mm/migrate.c	2013-12-24 13:58:59.426817658 +0400
@@ -1380,6 +1380,9 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
 	int err;
 	nodemask_t task_nodes;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check flags */
 	if (flags & ~(MPOL_MF_MOVE|MPOL_MF_MOVE_ALL))
 		return -EINVAL;
diff -ruNp linux-3.12.6/mm/mincore.c linux-3.12.6-cher1/mm/mincore.c
--- linux-3.12.6/mm/mincore.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/mm/mincore.c	2013-12-24 13:58:59.426817658 +0400
@@ -271,6 +271,9 @@ SYSCALL_DEFINE3(mincore, unsigned long,
 	unsigned long pages;
 	unsigned char *tmp;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	/* Check the start address: needs to be page-aligned.. */
  	if (start & ~PAGE_CACHE_MASK)
 		return -EINVAL;
diff -ruNp linux-3.12.6/mm/mlock.c linux-3.12.6-cher1/mm/mlock.c
--- linux-3.12.6/mm/mlock.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/mm/mlock.c	2013-12-24 13:58:59.426817658 +0400
@@ -684,6 +684,9 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
 	unsigned long lock_limit;
 	int error = -ENOMEM;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!can_do_mlock())
 		return -EPERM;
 
@@ -712,6 +715,9 @@ SYSCALL_DEFINE2(munlock, unsigned long,
 {
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	down_write(&current->mm->mmap_sem);
 	len = PAGE_ALIGN(len + (start & ~PAGE_MASK));
 	start &= PAGE_MASK;
@@ -751,6 +757,9 @@ SYSCALL_DEFINE1(mlockall, int, flags)
 	unsigned long lock_limit;
 	int ret = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (!flags || (flags & ~(MCL_CURRENT | MCL_FUTURE)))
 		goto out;
 
@@ -781,6 +790,9 @@ SYSCALL_DEFINE0(munlockall)
 {
 	int ret;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	down_write(&current->mm->mmap_sem);
 	ret = do_mlockall(0);
 	up_write(&current->mm->mmap_sem);
diff -ruNp linux-3.12.6/mm/mmap.c linux-3.12.6-cher1/mm/mmap.c
--- linux-3.12.6/mm/mmap.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/mm/mmap.c	2013-12-24 13:58:59.428817682 +0400
@@ -201,6 +201,9 @@ int __vm_enough_memory(struct mm_struct
 error:
 	vm_unacct_memory(pages);
 
+        if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+        }
 	return -ENOMEM;
 }
 
@@ -534,8 +537,9 @@ static int find_vma_links(struct mm_stru
 
 		if (vma_tmp->vm_end > addr) {
 			/* Fail if an existing vma overlaps the area */
-			if (vma_tmp->vm_start < end)
+			if (vma_tmp->vm_start < end) {
 				return -ENOMEM;
+                        }
 			__rb_link = &__rb_parent->rb_left;
 		} else {
 			rb_prev = __rb_parent;
@@ -744,8 +748,12 @@ again:			remove_next = 1 + (end > next->
 		 * shrinking vma had, to cover any anon pages imported.
 		 */
 		if (exporter && exporter->anon_vma && !importer->anon_vma) {
-			if (anon_vma_clone(importer, exporter))
+			if (anon_vma_clone(importer, exporter)) {
+                                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                                }
 				return -ENOMEM;
+                        }
 			importer->anon_vma = exporter->anon_vma;
 		}
 	}
@@ -1232,8 +1240,12 @@ unsigned long do_mmap_pgoff(struct file
                return -EOVERFLOW;
 
 	/* Too many mappings? */
-	if (mm->map_count > sysctl_max_map_count)
+	if (mm->map_count > sysctl_max_map_count) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
 	/* Obtain the address to map to. we verify (or select) it and ensure
 	 * that it represents a valid section of the address space.
@@ -1496,16 +1508,24 @@ unsigned long mmap_region(struct file *f
 
 		nr_pages = count_vma_pages_range(mm, addr, addr + len);
 
-		if (!may_expand_vm(mm, (len >> PAGE_SHIFT) - nr_pages))
+		if (!may_expand_vm(mm, (len >> PAGE_SHIFT) - nr_pages)) {
+                        if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                                current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                        }
 			return -ENOMEM;
+                }
 	}
 
 	/* Clear old maps */
 	error = -ENOMEM;
 munmap_back:
 	if (find_vma_links(mm, addr, addr + len, &prev, &rb_link, &rb_parent)) {
-		if (do_munmap(mm, addr, len))
+		if (do_munmap(mm, addr, len)) {
+                        if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                                current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                        }
 			return -ENOMEM;
+                }
 		goto munmap_back;
 	}
 
@@ -1514,8 +1534,12 @@ munmap_back:
 	 */
 	if (accountable_mapping(file, vm_flags)) {
 		charged = len >> PAGE_SHIFT;
-		if (security_vm_enough_memory_mm(mm, charged))
+		if (security_vm_enough_memory_mm(mm, charged)) {
+                        if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                                current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                        }
 			return -ENOMEM;
+                }
 		vm_flags |= VM_ACCOUNT;
 	}
 
@@ -1533,6 +1557,9 @@ munmap_back:
 	 */
 	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
 	if (!vma) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		error = -ENOMEM;
 		goto unacct_error;
 	}
@@ -1652,16 +1679,28 @@ unsigned long unmapped_area(struct vm_un
 
 	/* Adjust search length to account for worst case alignment overhead */
 	length = info->length + info->align_mask;
-	if (length < info->length)
+	if (length < info->length) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
 	/* Adjust search limits by the desired length */
-	if (info->high_limit < length)
+	if (info->high_limit < length) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 	high_limit = info->high_limit - length;
 
-	if (info->low_limit > high_limit)
+	if (info->low_limit > high_limit) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 	low_limit = info->low_limit + length;
 
 	/* Check if rbtree root looks promising */
@@ -1687,8 +1726,12 @@ unsigned long unmapped_area(struct vm_un
 		gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0;
 check_current:
 		/* Check if current node has a suitable gap */
-		if (gap_start > high_limit)
+		if (gap_start > high_limit) {
+                        if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                                current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                        }
 			return -ENOMEM;
+                }
 		if (gap_end >= low_limit && gap_end - gap_start >= length)
 			goto found;
 
@@ -1722,8 +1765,12 @@ check_highest:
 	/* Check highest gap, which does not precede any rbtree node */
 	gap_start = mm->highest_vm_end;
 	gap_end = ULONG_MAX;  /* Only for VM_BUG_ON below */
-	if (gap_start > high_limit)
+	if (gap_start > high_limit) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
 found:
 	/* We found a suitable gap. Clip it with the original low_limit. */
@@ -1746,20 +1793,32 @@ unsigned long unmapped_area_topdown(stru
 
 	/* Adjust search length to account for worst case alignment overhead */
 	length = info->length + info->align_mask;
-	if (length < info->length)
+	if (length < info->length) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
 	/*
 	 * Adjust search limits by the desired length.
 	 * See implementation comment at top of unmapped_area().
 	 */
 	gap_end = info->high_limit;
-	if (gap_end < length)
-		return -ENOMEM;
+	if (gap_end < length) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
+                return -ENOMEM;
+        }
 	high_limit = gap_end - length;
 
-	if (info->low_limit > high_limit)
+	if (info->low_limit > high_limit) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 	low_limit = info->low_limit + length;
 
 	/* Check highest gap, which does not precede any rbtree node */
@@ -1768,11 +1827,19 @@ unsigned long unmapped_area_topdown(stru
 		goto found_highest;
 
 	/* Check if rbtree root looks promising */
-	if (RB_EMPTY_ROOT(&mm->mm_rb))
+	if (RB_EMPTY_ROOT(&mm->mm_rb)) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 	vma = rb_entry(mm->mm_rb.rb_node, struct vm_area_struct, vm_rb);
-	if (vma->rb_subtree_gap < length)
+	if (vma->rb_subtree_gap < length) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
 	while (true) {
 		/* Visit right subtree if it looks promising */
@@ -1790,8 +1857,12 @@ unsigned long unmapped_area_topdown(stru
 check_current:
 		/* Check if current node has a suitable gap */
 		gap_end = vma->vm_start;
-		if (gap_end < low_limit)
+		if (gap_end < low_limit) {
+                        if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                                current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                        }
 			return -ENOMEM;
+                }
 		if (gap_start <= high_limit && gap_end - gap_start >= length)
 			goto found;
 
@@ -1809,8 +1880,12 @@ check_current:
 		/* Go back up the rbtree to find next candidate node */
 		while (true) {
 			struct rb_node *prev = &vma->vm_rb;
-			if (!rb_parent(prev))
+			if (!rb_parent(prev)) {
+                                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                                }
 				return -ENOMEM;
+                        }
 			vma = rb_entry(rb_parent(prev),
 				       struct vm_area_struct, vm_rb);
 			if (prev == vma->vm_rb.rb_right) {
@@ -2040,12 +2115,20 @@ static int acct_stack_growth(struct vm_a
 	unsigned long new_start;
 
 	/* address space limit tests */
-	if (!may_expand_vm(mm, grow))
+	if (!may_expand_vm(mm, grow)) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
 	/* Stack limit test */
-	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur)) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
 	/* mlock limit tests */
 	if (vma->vm_flags & VM_LOCKED) {
@@ -2054,8 +2137,12 @@ static int acct_stack_growth(struct vm_a
 		locked = mm->locked_vm + grow;
 		limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
 		limit >>= PAGE_SHIFT;
-		if (locked > limit && !capable(CAP_IPC_LOCK))
+		if (locked > limit && !capable(CAP_IPC_LOCK)) {
+                        if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                                current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                        }
 			return -ENOMEM;
+                }
 	}
 
 	/* Check to ensure the stack will not grow into a hugetlb-only region */
@@ -2068,8 +2155,12 @@ static int acct_stack_growth(struct vm_a
 	 * Overcommit..  This must be the final test, as it will
 	 * update security statistics.
 	 */
-	if (security_vm_enough_memory_mm(mm, grow))
+	if (security_vm_enough_memory_mm(mm, grow)) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
 	/* Ok, everything looks good - let it rip */
 	if (vma->vm_flags & VM_LOCKED)
@@ -2094,8 +2185,12 @@ int expand_upwards(struct vm_area_struct
 	 * We must make sure the anon_vma is allocated
 	 * so that the anon_vma locking is not a noop.
 	 */
-	if (unlikely(anon_vma_prepare(vma)))
+	if (unlikely(anon_vma_prepare(vma))) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 	vma_lock_anon_vma(vma);
 
 	/*
@@ -2108,6 +2203,9 @@ int expand_upwards(struct vm_area_struct
 		address = PAGE_ALIGN(address+4);
 	else {
 		vma_unlock_anon_vma(vma);
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
 	}
 	error = 0;
@@ -2167,8 +2265,12 @@ int expand_downwards(struct vm_area_stru
 	 * We must make sure the anon_vma is allocated
 	 * so that the anon_vma locking is not a noop.
 	 */
-	if (unlikely(anon_vma_prepare(vma)))
+	if (unlikely(anon_vma_prepare(vma))) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
 	address &= PAGE_MASK;
 	error = security_mmap_addr(address);
@@ -2242,8 +2344,12 @@ int expand_stack(struct vm_area_struct *
 	address &= PAGE_MASK;
 	next = vma->vm_next;
 	if (next && next->vm_start == address + PAGE_SIZE) {
-		if (!(next->vm_flags & VM_GROWSUP))
+		if (!(next->vm_flags & VM_GROWSUP)) {
+                        if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                                current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                        }
 			return -ENOMEM;
+                }
 	}
 	return expand_upwards(vma, address);
 }
@@ -2271,8 +2377,12 @@ int expand_stack(struct vm_area_struct *
 	address &= PAGE_MASK;
 	prev = vma->vm_prev;
 	if (prev && prev->vm_end == address) {
-		if (!(prev->vm_flags & VM_GROWSDOWN))
+		if (!(prev->vm_flags & VM_GROWSDOWN)) {
+                        if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                                current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                        }
 			return -ENOMEM;
+                }
 	}
 	return expand_downwards(vma, address);
 }
@@ -2617,20 +2727,36 @@ static unsigned long do_brk(unsigned lon
 	 */
  munmap_back:
 	if (find_vma_links(mm, addr, addr + len, &prev, &rb_link, &rb_parent)) {
-		if (do_munmap(mm, addr, len))
+		if (do_munmap(mm, addr, len)) {
+                        if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                                current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                        }
 			return -ENOMEM;
+                }
 		goto munmap_back;
 	}
 
 	/* Check against address space limits *after* clearing old maps... */
-	if (!may_expand_vm(mm, len >> PAGE_SHIFT))
+	if (!may_expand_vm(mm, len >> PAGE_SHIFT)) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
-	if (mm->map_count > sysctl_max_map_count)
+	if (mm->map_count > sysctl_max_map_count) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
-	if (security_vm_enough_memory_mm(mm, len >> PAGE_SHIFT))
+	if (security_vm_enough_memory_mm(mm, len >> PAGE_SHIFT)) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
+        }
 
 	/* Can we just expand an old private anonymous mapping? */
 	vma = vma_merge(mm, prev, addr, addr + len, flags,
@@ -2644,6 +2770,9 @@ static unsigned long do_brk(unsigned lon
 	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
 	if (!vma) {
 		vm_unacct_memory(len >> PAGE_SHIFT);
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		return -ENOMEM;
 	}
 
diff -ruNp linux-3.12.6/mm/mremap.c linux-3.12.6-cher1/mm/mremap.c
--- linux-3.12.6/mm/mremap.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/mm/mremap.c	2013-12-24 13:58:59.428817682 +0400
@@ -362,8 +362,12 @@ static struct vm_area_struct *vma_to_res
 			goto Eagain;
 	}
 
-	if (!may_expand_vm(mm, (new_len - old_len) >> PAGE_SHIFT))
+	if (!may_expand_vm(mm, (new_len - old_len) >> PAGE_SHIFT)) {
+                if ((current->sbox_flags & SBOX_MEMLIMITON)) {
+                        current->sbox_flags |= SBOX_WAS_MEMLIMIT;
+                }
 		goto Enomem;
+        }
 
 	if (vma->vm_flags & VM_ACCOUNT) {
 		unsigned long charged = (new_len - old_len) >> PAGE_SHIFT;
diff -ruNp linux-3.12.6/mm/msync.c linux-3.12.6-cher1/mm/msync.c
--- linux-3.12.6/mm/msync.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/mm/msync.c	2013-12-24 13:58:59.428817682 +0400
@@ -36,6 +36,9 @@ SYSCALL_DEFINE3(msync, unsigned long, st
 	int unmapped_error = 0;
 	int error = -EINVAL;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	if (flags & ~(MS_ASYNC | MS_INVALIDATE | MS_SYNC))
 		goto out;
 	if (start & ~PAGE_MASK)
diff -ruNp linux-3.12.6/mm/process_vm_access.c linux-3.12.6-cher1/mm/process_vm_access.c
--- linux-3.12.6/mm/process_vm_access.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/mm/process_vm_access.c	2013-12-24 13:58:59.428817682 +0400
@@ -399,6 +399,8 @@ SYSCALL_DEFINE6(process_vm_readv, pid_t,
 		unsigned long, liovcnt, const struct iovec __user *, rvec,
 		unsigned long, riovcnt,	unsigned long, flags)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 	return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 0);
 }
 
@@ -407,6 +409,8 @@ SYSCALL_DEFINE6(process_vm_writev, pid_t
 		unsigned long, liovcnt, const struct iovec __user *, rvec,
 		unsigned long, riovcnt,	unsigned long, flags)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 	return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 1);
 }
 
@@ -464,6 +468,8 @@ compat_sys_process_vm_readv(compat_pid_t
 			    unsigned long riovcnt,
 			    unsigned long flags)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 	return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
 				    riovcnt, flags, 0);
 }
@@ -476,6 +482,8 @@ compat_sys_process_vm_writev(compat_pid_
 			     unsigned long riovcnt,
 			     unsigned long flags)
 {
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
 	return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
 				    riovcnt, flags, 1);
 }
diff -ruNp linux-3.12.6/mm/readahead.c linux-3.12.6-cher1/mm/readahead.c
--- linux-3.12.6/mm/readahead.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/mm/readahead.c	2013-12-24 13:58:59.428817682 +0400
@@ -581,6 +581,9 @@ SYSCALL_DEFINE3(readahead, int, fd, loff
 	ssize_t ret;
 	struct fd f;
 
+        if (SBOX_IS_RESTRICTED())
+                return -EPERM;
+
 	ret = -EBADF;
 	f = fdget(fd);
 	if (f.file) {
diff -ruNp linux-3.12.6/mm/swapfile.c linux-3.12.6-cher1/mm/swapfile.c
--- linux-3.12.6/mm/swapfile.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/mm/swapfile.c	2013-12-24 13:58:59.429817695 +0400
@@ -1826,6 +1826,11 @@ SYSCALL_DEFINE1(swapoff, const char __us
 	int err;
 	unsigned int old_block_size;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
@@ -2365,6 +2370,11 @@ SYSCALL_DEFINE2(swapon, const char __use
 	struct page *page = NULL;
 	struct inode *inode = NULL;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (swap_flags & ~SWAP_FLAGS_VALID)
 		return -EINVAL;
 
diff -ruNp linux-3.12.6/net/compat.c linux-3.12.6-cher1/net/compat.c
--- linux-3.12.6/net/compat.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/net/compat.c	2013-12-24 13:58:59.430817707 +0400
@@ -388,8 +388,14 @@ asmlinkage long compat_sys_setsockopt(in
 				char __user *optval, unsigned int optlen)
 {
 	int err;
-	struct socket *sock = sockfd_lookup(fd, &err);
+	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
+	sock = sockfd_lookup(fd, &err);
 	if (sock) {
 		err = security_socket_setsockopt(sock, level, optname);
 		if (err) {
@@ -508,8 +514,14 @@ asmlinkage long compat_sys_getsockopt(in
 				char __user *optval, int __user *optlen)
 {
 	int err;
-	struct socket *sock = sockfd_lookup(fd, &err);
+	struct socket *sock;
+
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
 
+	sock = sockfd_lookup(fd, &err);
 	if (sock) {
 		err = security_socket_getsockopt(sock, level, optname);
 		if (err) {
@@ -737,6 +749,11 @@ static unsigned char nas[21] = {
 
 asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & MSG_CMSG_COMPAT)
 		return -EINVAL;
 	return __sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
@@ -745,6 +762,11 @@ asmlinkage long compat_sys_sendmsg(int f
 asmlinkage long compat_sys_sendmmsg(int fd, struct compat_mmsghdr __user *mmsg,
 				    unsigned int vlen, unsigned int flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & MSG_CMSG_COMPAT)
 		return -EINVAL;
 	return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
@@ -753,6 +775,11 @@ asmlinkage long compat_sys_sendmmsg(int
 
 asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & MSG_CMSG_COMPAT)
 		return -EINVAL;
 	return __sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
@@ -777,6 +804,11 @@ asmlinkage long compat_sys_recvmmsg(int
 	int datagrams;
 	struct timespec ktspec;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & MSG_CMSG_COMPAT)
 		return -EINVAL;
 
@@ -806,6 +838,11 @@ asmlinkage long compat_sys_socketcall(in
 	u32 a[6];
 	u32 a0, a1;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (call < SYS_SOCKET || call > SYS_SENDMMSG)
 		return -EINVAL;
 	if (copy_from_user(a, args, nas[call]))
diff -ruNp linux-3.12.6/net/socket.c linux-3.12.6-cher1/net/socket.c
--- linux-3.12.6/net/socket.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/net/socket.c	2013-12-24 13:58:59.431817719 +0400
@@ -1372,6 +1372,11 @@ SYSCALL_DEFINE3(socket, int, family, int
 	struct socket *sock;
 	int flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* Check the SOCK_* constants for consistency.  */
 	BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
@@ -1415,6 +1420,11 @@ SYSCALL_DEFINE4(socketpair, int, family,
 	struct file *newfile1, *newfile2;
 	int flags;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	flags = type & ~SOCK_TYPE_MASK;
 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
 		return -EINVAL;
@@ -1509,6 +1519,11 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
 	struct sockaddr_storage address;
 	int err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock) {
 		err = move_addr_to_kernel(umyaddr, addrlen, &address);
@@ -1538,6 +1553,11 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
 	int err, fput_needed;
 	int somaxconn;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock) {
 		somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
@@ -1573,6 +1593,11 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
 	int err, len, newfd, fput_needed;
 	struct sockaddr_storage address;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
 		return -EINVAL;
 
@@ -1671,6 +1696,11 @@ SYSCALL_DEFINE3(connect, int, fd, struct
 	struct sockaddr_storage address;
 	int err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1703,6 +1733,11 @@ SYSCALL_DEFINE3(getsockname, int, fd, st
 	struct sockaddr_storage address;
 	int len, err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1734,6 +1769,11 @@ SYSCALL_DEFINE3(getpeername, int, fd, st
 	struct sockaddr_storage address;
 	int len, err, fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_getpeername(sock);
@@ -1770,6 +1810,11 @@ SYSCALL_DEFINE6(sendto, int, fd, void __
 	struct iovec iov;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (len > INT_MAX)
 		len = INT_MAX;
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
@@ -1829,6 +1874,11 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void
 	int err, err2;
 	int fput_needed;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (size > INT_MAX)
 		size = INT_MAX;
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
@@ -1882,6 +1932,11 @@ SYSCALL_DEFINE5(setsockopt, int, fd, int
 	int err, fput_needed;
 	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (optlen < 0)
 		return -EINVAL;
 
@@ -1916,6 +1971,11 @@ SYSCALL_DEFINE5(getsockopt, int, fd, int
 	int err, fput_needed;
 	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_getsockopt(sock, level, optname);
@@ -1945,6 +2005,11 @@ SYSCALL_DEFINE2(shutdown, int, fd, int,
 	int err, fput_needed;
 	struct socket *sock;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (sock != NULL) {
 		err = security_socket_shutdown(sock, how);
@@ -2114,6 +2179,11 @@ out:
 
 SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & MSG_CMSG_COMPAT)
 		return -EINVAL;
 	return __sys_sendmsg(fd, msg, flags);
@@ -2182,6 +2252,11 @@ int __sys_sendmmsg(int fd, struct mmsghd
 SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
 		unsigned int, vlen, unsigned int, flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & MSG_CMSG_COMPAT)
 		return -EINVAL;
 	return __sys_sendmmsg(fd, mmsg, vlen, flags);
@@ -2303,6 +2378,11 @@ out:
 SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
 		unsigned int, flags)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & MSG_CMSG_COMPAT)
 		return -EINVAL;
 	return __sys_recvmsg(fd, msg, flags);
@@ -2423,6 +2503,11 @@ SYSCALL_DEFINE5(recvmmsg, int, fd, struc
 	int datagrams;
 	struct timespec timeout_sys;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (flags & MSG_CMSG_COMPAT)
 		return -EINVAL;
 
@@ -2468,6 +2553,11 @@ SYSCALL_DEFINE2(socketcall, int, call, u
 	int err;
 	unsigned int len;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	if (call < 1 || call > SYS_SENDMMSG)
 		return -EINVAL;
 
diff -ruNp linux-3.12.6/security/keys/keyctl.c linux-3.12.6-cher1/security/keys/keyctl.c
--- linux-3.12.6/security/keys/keyctl.c	2013-12-20 19:51:33.000000000 +0400
+++ linux-3.12.6-cher1/security/keys/keyctl.c	2013-12-24 13:58:59.433817743 +0400
@@ -67,6 +67,11 @@ SYSCALL_DEFINE5(add_key, const char __us
 	long ret;
 	bool vm;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	ret = -EINVAL;
 	if (plen > 1024 * 1024 - 1)
 		goto error;
@@ -167,6 +172,11 @@ SYSCALL_DEFINE4(request_key, const char
 	char type[32], *description, *callout_info;
 	long ret;
 
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	/* pull the type into kernel space */
 	ret = key_get_type_from_user(type, _type, sizeof(type));
 	if (ret < 0)
@@ -1570,6 +1580,11 @@ error_keyring:
 SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
 		unsigned long, arg4, unsigned long, arg5)
 {
+        if (SBOX_IS_RESTRICTED()) {
+                SBOX_SET_SECURITY_ERR();
+                return -EPERM;
+        }
+
 	switch (option) {
 	case KEYCTL_GET_KEYRING_ID:
 		return keyctl_get_keyring_ID((key_serial_t) arg2,
