--- linux-2.6.11.11/fs/devpts/inode.c	2005-03-02 12:38:44 +0100
+++ linux-2.6.11.11-vs2.0-rc3/fs/devpts/inode.c	2005-06-01 14:34:17 +0200
@@ -115,8 +185,9 @@ devpts_fill_super(struct super_block *s,
 	inode->i_uid = inode->i_gid = 0;
 	inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR;
 	inode->i_op = &simple_dir_inode_operations;
-	inode->i_fop = &simple_dir_operations;
+	inode->i_fop = &devpts_dir_operations;
 	inode->i_nlink = 2;
+	inode->i_xid = vx_current_xid();
 
 	devpts_root = s->s_root = d_alloc_root(inode);
 	if (s->s_root)
--- linux-2.6.11.11/fs/devpts/inode.c	2005-03-02 12:38:44 +0100
+++ linux-2.6.11.11-vs2.0-rc3/fs/devpts/inode.c	2005-06-01 14:34:17 +0200
@@ -175,6 +246,7 @@ int devpts_pty_new(struct tty_struct *tt
 	inode->i_gid = config.setgid ? config.gid : current->fsgid;
 	inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
 	init_special_inode(inode, S_IFCHR|config.mode, device);
+	inode->i_xid = vx_current_xid();
 	inode->i_op = &devpts_file_inode_operations;
 	inode->u.generic_ip = tty;
 
--- linux-2.6.11.11/include/linux/ipc.h	2004-08-14 12:54:46 +0200
+++ linux-2.6.11.11-vs2.0-rc3/include/linux/ipc.h	2005-06-01 14:34:17 +0200
@@ -66,6 +66,7 @@ struct kern_ipc_perm
 	mode_t		mode; 
 	unsigned long	seq;
 	void		*security;
+	xid_t		xid;
 };
 
 #endif /* __KERNEL__ */
--- linux-2.6.11.11/include/linux/sched.h	2005-03-02 12:38:53 +0100
+++ linux-2.6.11.11-vs2.0-rc3/include/linux/sched.h	2005-06-01 14:34:17 +0200
@@ -380,9 +383,10 @@ struct user_struct {
 	/* Hash table maintenance information */
 	struct list_head uidhash_list;
 	uid_t uid;
+	xid_t xid;
 };
 
-extern struct user_struct *find_user(uid_t);
+extern struct user_struct *find_user(xid_t, uid_t);
 
 extern struct user_struct root_user;
 #define INIT_USER (&root_user)
--- linux-2.6.11.11/ipc/msg.c	2004-12-25 01:55:30 +0100
+++ linux-2.6.11.11-vs2.0-rc3/ipc/msg.c	2005-06-01 14:34:17 +0200
@@ -97,6 +97,7 @@ static int newque (key_t key, int msgflg
 
 	msq->q_perm.mode = (msgflg & S_IRWXUGO);
 	msq->q_perm.key = key;
+	msq->q_perm.xid = vx_current_xid();
 
 	msq->q_perm.security = NULL;
 	retval = security_msg_queue_alloc(msq);
--- linux-2.6.11.11/ipc/msg.c	2004-12-25 01:55:30 +0100
+++ linux-2.6.11.11-vs2.0-rc3/ipc/msg.c	2005-06-01 14:34:17 +0200
@@ -817,7 +818,11 @@ static int sysvipc_msg_read_proc(char *b
 	for(i = 0; i <= msg_ids.max_id; i++) {
 		struct msg_queue * msq;
 		msq = msg_lock(i);
-		if(msq != NULL) {
+		if (msq) {
+			if (!vx_check(msq->q_perm.xid, VX_IDENT)) {
+				msg_unlock(msq);
+				continue;
+			}
 			len += sprintf(buffer + len, "%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n",
 				msq->q_perm.key,
 				msg_buildid(i,msq->q_perm.seq),
--- linux-2.6.11.11/ipc/sem.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/ipc/sem.c	2005-06-01 14:34:17 +0200
@@ -176,6 +176,7 @@ static int newary (key_t key, int nsems,
 
 	sma->sem_perm.mode = (semflg & S_IRWXUGO);
 	sma->sem_perm.key = key;
+	sma->sem_perm.xid = vx_current_xid();
 
 	sma->sem_perm.security = NULL;
 	retval = security_sem_alloc(sma);
--- linux-2.6.11.11/ipc/sem.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/ipc/sem.c	2005-06-01 14:34:17 +0200
@@ -1344,7 +1345,11 @@ static int sysvipc_sem_read_proc(char *b
 	for(i = 0; i <= sem_ids.max_id; i++) {
 		struct sem_array *sma;
 		sma = sem_lock(i);
-		if(sma) {
+		if (sma) {
+			if (!vx_check(sma->sem_perm.xid, VX_IDENT)) {
+				sem_unlock(sma);
+				continue;
+			}
 			len += sprintf(buffer + len, "%10d %10d  %4o %10lu %5u %5u %5u %5u %10lu %10lu\n",
 				sma->sem_perm.key,
 				sem_buildid(i,sma->sem_perm.seq),
--- linux-2.6.11.11/ipc/shm.c	2004-12-25 01:55:30 +0100
+++ linux-2.6.11.11-vs2.0-rc3/ipc/shm.c	2005-06-01 14:34:17 +0200
@@ -865,11 +877,15 @@ static int sysvipc_shm_read_proc(char *b
 		struct shmid_kernel* shp;
 
 		shp = shm_lock(i);
-		if(shp!=NULL) {
+		if (shp) {
 #define SMALL_STRING "%10d %10d  %4o %10u %5u %5u  %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
 #define BIG_STRING   "%10d %10d  %4o %21u %5u %5u  %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
 			char *format;
 
+			if (!vx_check(shp->shm_perm.xid, VX_IDENT)) {
+				shm_unlock(shp);
+				continue;
+			}
 			if (sizeof(size_t) <= sizeof(int))
 				format = SMALL_STRING;
 			else
--- linux-2.6.11.11/ipc/util.c	2004-12-25 01:55:30 +0100
+++ linux-2.6.11.11-vs2.0-rc3/ipc/util.c	2005-06-01 14:34:17 +0200
@@ -107,7 +107,9 @@ int ipc_findkey(struct ipc_ids* ids, key
 	 */
 	for (id = 0; id <= max_id; id++) {
 		p = ids->entries->p[id];
-		if(p==NULL)
+		if (p==NULL)
+			continue;
+		if (!vx_check(p->xid, VX_IDENT))
 			continue;
 		if (key == p->key)
 			return id;
--- linux-2.6.11.11/ipc/util.c	2004-12-25 01:55:30 +0100
+++ linux-2.6.11.11-vs2.0-rc3/ipc/util.c	2005-06-01 14:34:17 +0200
@@ -420,6 +422,8 @@ int ipcperms (struct kern_ipc_perm *ipcp
 {	/* flag will most probably be 0 or S_...UGO from <linux/stat.h> */
 	int requested_mode, granted_mode;
 
+	if (!vx_check(ipcp->xid, VX_ADMIN|VX_IDENT)) /* maybe just VX_IDENT? */
+		return -1;
 	requested_mode = (flag >> 6) | (flag >> 3) | flag;
 	granted_mode = ipcp->mode;
 	if (current->euid == ipcp->cuid || current->euid == ipcp->uid)
--- linux-2.6.11.11/kernel/printk.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/printk.c	2005-06-01 14:34:17 +0200
@@ -31,6 +31,7 @@
 #include <linux/security.h>
 #include <linux/bootmem.h>
 #include <linux/syscalls.h>
+#include <linux/vserver/cvirt.h>
 
 #include <asm/uaccess.h>
 
--- linux-2.6.11.11/kernel/printk.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/printk.c	2005-06-01 14:34:17 +0200
@@ -251,18 +252,13 @@ int do_syslog(int type, char __user * bu
 	unsigned long i, j, limit, count;
 	int do_clear = 0;
 	char c;
-	int error = 0;
+	int error;
 
 	error = security_syslog(type);
 	if (error)
 		return error;
 
-	switch (type) {
-	case 0:		/* Close log */
-		break;
-	case 1:		/* Open log */
-		break;
-	case 2:		/* Read from log */
+	if ((type >= 2) && (type <= 4)) {
 		error = -EINVAL;
 		if (!buf || len < 0)
 			goto out;
--- linux-2.6.11.11/kernel/printk.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/printk.c	2005-06-01 14:34:17 +0200
@@ -272,6 +268,16 @@ int do_syslog(int type, char __user * bu
 		error = verify_area(VERIFY_WRITE,buf,len);
 		if (error)
 			goto out;
+	}
+	if (!vx_check(0, VX_ADMIN|VX_WATCH))
+		return vx_do_syslog(type, buf, len);
+
+	switch (type) {
+	case 0:		/* Close log */
+		break;
+	case 1:		/* Open log */
+		break;
+	case 2:		/* Read from log */
 		error = wait_event_interruptible(log_wait, (log_start - log_end));
 		if (error)
 			goto out;
--- linux-2.6.11.11/kernel/printk.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/printk.c	2005-06-01 14:34:17 +0200
@@ -295,15 +301,6 @@ int do_syslog(int type, char __user * bu
 		do_clear = 1; 
 		/* FALL THRU */
 	case 3:		/* Read last kernel messages */
-		error = -EINVAL;
-		if (!buf || len < 0)
-			goto out;
-		error = 0;
-		if (!len)
-			goto out;
-		error = verify_area(VERIFY_WRITE,buf,len);
-		if (error)
-			goto out;
 		count = len;
 		if (count > log_buf_len)
 			count = log_buf_len;
--- linux-2.6.11.11/kernel/sys.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/sys.c	2005-06-01 14:34:17 +0200
@@ -278,7 +283,8 @@ asmlinkage long sys_setpriority(int whic
 			if (!who)
 				who = current->uid;
 			else
-				if ((who != current->uid) && !(user = find_user(who)))
+				if ((who != current->uid) &&
+					!(user = find_user(vx_current_xid(), who)))
 					goto out_unlock;	/* No processes for this user */
 
 			do_each_thread(g, p)
--- linux-2.6.11.11/kernel/sys.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/sys.c	2005-06-01 14:34:17 +0200
@@ -336,7 +342,8 @@ asmlinkage long sys_getpriority(int whic
 			if (!who)
 				who = current->uid;
 			else
-				if ((who != current->uid) && !(user = find_user(who)))
+				if ((who != current->uid) &&
+					!(user = find_user(vx_current_xid(), who)))
 					goto out_unlock;	/* No processes for this user */
 
 			do_each_thread(g, p)
--- linux-2.6.11.11/kernel/sys.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/sys.c	2005-06-01 14:34:17 +0200
@@ -578,7 +589,7 @@ static int set_user(uid_t new_ruid, int 
 {
 	struct user_struct *new_user;
 
-	new_user = alloc_uid(new_ruid);
+	new_user = alloc_uid(vx_current_xid(), new_ruid);
 	if (!new_user)
 		return -EAGAIN;
 
--- linux-2.6.11.11/kernel/user.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/user.c	2005-06-01 14:34:17 +0200
@@ -21,8 +21,8 @@
 #define UIDHASH_BITS		8
 #define UIDHASH_SZ		(1 << UIDHASH_BITS)
 #define UIDHASH_MASK		(UIDHASH_SZ - 1)
-#define __uidhashfn(uid)	(((uid >> UIDHASH_BITS) + uid) & UIDHASH_MASK)
-#define uidhashentry(uid)	(uidhash_table + __uidhashfn((uid)))
+#define __uidhashfn(xid,uid)	((((uid) >> UIDHASH_BITS) + ((uid)^(xid))) & UIDHASH_MASK)
+#define uidhashentry(xid,uid)	(uidhash_table + __uidhashfn((xid),(uid)))
 
 static kmem_cache_t *uid_cachep;
 static struct list_head uidhash_table[UIDHASH_SZ];
--- linux-2.6.11.11/kernel/user.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/user.c	2005-06-01 14:34:17 +0200
@@ -54,7 +54,7 @@ static inline void uid_hash_remove(struc
 	list_del(&up->uidhash_list);
 }
 
-static inline struct user_struct *uid_hash_find(uid_t uid, struct list_head *hashent)
+static inline struct user_struct *uid_hash_find(xid_t xid, uid_t uid, struct list_head *hashent)
 {
 	struct list_head *up;
 
--- linux-2.6.11.11/kernel/user.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/user.c	2005-06-01 14:34:17 +0200
@@ -63,7 +63,7 @@ static inline struct user_struct *uid_ha
 
 		user = list_entry(up, struct user_struct, uidhash_list);
 
-		if(user->uid == uid) {
+		if(user->uid == uid && user->xid == xid) {
 			atomic_inc(&user->__count);
 			return user;
 		}
--- linux-2.6.11.11/kernel/user.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/user.c	2005-06-01 14:34:17 +0200
@@ -78,12 +78,12 @@ static inline struct user_struct *uid_ha
  *
  * If the user_struct could not be found, return NULL.
  */
-struct user_struct *find_user(uid_t uid)
+struct user_struct *find_user(xid_t xid, uid_t uid)
 {
 	struct user_struct *ret;
 
 	spin_lock(&uidhash_lock);
-	ret = uid_hash_find(uid, uidhashentry(uid));
+	ret = uid_hash_find(xid, uid, uidhashentry(xid, uid));
 	spin_unlock(&uidhash_lock);
 	return ret;
 }
--- linux-2.6.11.11/kernel/user.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/user.c	2005-06-01 14:34:17 +0200
@@ -99,13 +99,13 @@ void free_uid(struct user_struct *up)
 	}
 }
 
-struct user_struct * alloc_uid(uid_t uid)
+struct user_struct * alloc_uid(xid_t xid, uid_t uid)
 {
-	struct list_head *hashent = uidhashentry(uid);
+	struct list_head *hashent = uidhashentry(xid, uid);
 	struct user_struct *up;
 
 	spin_lock(&uidhash_lock);
-	up = uid_hash_find(uid, hashent);
+	up = uid_hash_find(xid, uid, hashent);
 	spin_unlock(&uidhash_lock);
 
 	if (!up) {
--- linux-2.6.11.11/kernel/user.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/user.c	2005-06-01 14:34:17 +0200
@@ -115,6 +115,7 @@ struct user_struct * alloc_uid(uid_t uid
 		if (!new)
 			return NULL;
 		new->uid = uid;
+		new->xid = xid;
 		atomic_set(&new->__count, 1);
 		atomic_set(&new->processes, 0);
 		atomic_set(&new->files, 0);
--- linux-2.6.11.11/kernel/user.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/user.c	2005-06-01 14:34:17 +0200
@@ -133,7 +134,7 @@ struct user_struct * alloc_uid(uid_t uid
 		 * on adding the same user already..
 		 */
 		spin_lock(&uidhash_lock);
-		up = uid_hash_find(uid, hashent);
+		up = uid_hash_find(xid, uid, hashent);
 		if (up) {
 			key_put(new->uid_keyring);
 			key_put(new->session_keyring);
--- linux-2.6.11.11/kernel/user.c	2005-03-02 12:39:08 +0100
+++ linux-2.6.11.11-vs2.0-rc3/kernel/user.c	2005-06-01 14:34:17 +0200
@@ -179,7 +180,7 @@ static int __init uid_cache_init(void)
 
 	/* Insert the root user immediately (init already runs as root) */
 	spin_lock(&uidhash_lock);
-	uid_hash_insert(&root_user, uidhashentry(0));
+	uid_hash_insert(&root_user, uidhashentry(0,0));
 	spin_unlock(&uidhash_lock);
 
 	return 0;
