--- linux-2.6.11-rc1/Makefile	2005-01-14 12:35:29 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/Makefile	2005-01-15 20:18:16 +0100
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 11
-EXTRAVERSION =-rc1
+EXTRAVERSION = -rc1-vs1.9.4-rc2
 NAME=Woozy Numbat
 
 # *DOCUMENTATION*
--- linux-2.6.11-rc1/arch/alpha/Kconfig	2005-01-14 12:35:29 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/alpha/Kconfig	2005-01-15 11:27:51 +0100
@@ -598,6 +598,8 @@ source "arch/alpha/oprofile/Kconfig"
 
 source "arch/alpha/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/arm/Kconfig	2005-01-14 12:35:29 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/arm/Kconfig	2005-01-15 11:27:51 +0100
@@ -745,6 +745,8 @@ source "drivers/mmc/Kconfig"
 
 source "arch/arm/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/arm26/Kconfig	2005-01-14 12:35:30 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/arm26/Kconfig	2005-01-15 11:27:51 +0100
@@ -220,6 +220,8 @@ source "drivers/usb/Kconfig"
 
 source "arch/arm26/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/cris/Kconfig	2005-01-14 12:35:30 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/cris/Kconfig	2005-01-15 11:27:51 +0100
@@ -173,6 +173,8 @@ source "drivers/usb/Kconfig"
 
 source "arch/cris/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/h8300/Kconfig	2005-01-14 12:35:31 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/h8300/Kconfig	2005-01-15 11:27:51 +0100
@@ -187,6 +187,8 @@ source "fs/Kconfig"
 
 source "arch/h8300/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/i386/Kconfig	2005-01-14 12:35:31 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/i386/Kconfig	2005-01-15 11:27:51 +0100
@@ -1209,6 +1257,8 @@ source "arch/i386/oprofile/Kconfig"
 
 source "arch/i386/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
Files linux-2.6.11-rc1/arch/i386/kernel/.smp.c.swp and linux-2.6.11-rc1-vs1.9.4-rc2/arch/i386/kernel/.smp.c.swp differ
--- linux-2.6.11-rc1/arch/ia64/Kconfig	2005-01-14 12:35:31 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/ia64/Kconfig	2005-01-15 11:27:51 +0100
@@ -401,6 +401,8 @@ source "arch/ia64/oprofile/Kconfig"
 
 source "arch/ia64/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/m68k/Kconfig	2005-01-14 12:35:31 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/m68k/Kconfig	2005-01-15 11:27:52 +0100
@@ -663,6 +663,8 @@ source "fs/Kconfig"
 
 source "arch/m68k/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/m68knommu/Kconfig	2005-01-14 12:35:41 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/m68knommu/Kconfig	2005-01-15 11:27:52 +0100
@@ -574,6 +574,8 @@ source "fs/Kconfig"
 
 source "arch/m68knommu/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/mips/Kconfig	2005-01-14 12:35:41 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/mips/Kconfig	2005-01-15 11:27:52 +0100
@@ -1585,6 +1585,8 @@ source "fs/Kconfig"
 
 source "arch/mips/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/parisc/Kconfig	2005-01-14 12:35:41 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/parisc/Kconfig	2005-01-15 11:27:52 +0100
@@ -194,6 +194,8 @@ source "arch/parisc/oprofile/Kconfig"
 
 source "arch/parisc/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/ppc/Kconfig	2005-01-14 12:35:41 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/ppc/Kconfig	2005-01-15 11:27:52 +0100
@@ -1285,6 +1285,8 @@ source "arch/ppc/oprofile/Kconfig"
 
 source "arch/ppc/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/ppc64/Kconfig	2005-01-14 12:35:42 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/ppc64/Kconfig	2005-01-15 11:27:52 +0100
@@ -379,6 +379,8 @@ source "arch/ppc64/oprofile/Kconfig"
 
 source "arch/ppc64/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 config KEYS_COMPAT
--- linux-2.6.11-rc1/arch/s390/Kconfig	2005-01-14 12:35:42 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/s390/Kconfig	2005-01-15 11:27:52 +0100
@@ -473,6 +473,8 @@ source "arch/s390/oprofile/Kconfig"
 
 source "arch/s390/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/sh/Kconfig	2005-01-14 12:35:42 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/sh/Kconfig	2005-01-15 11:27:52 +0100
@@ -788,6 +788,8 @@ source "arch/sh/oprofile/Kconfig"
 
 source "arch/sh/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/sparc/Kconfig	2005-01-14 12:35:43 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/sparc/Kconfig	2005-01-15 11:27:52 +0100
@@ -384,6 +384,8 @@ source "drivers/char/watchdog/Kconfig"
 
 source "arch/sparc/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/sparc64/Kconfig	2005-01-14 12:35:43 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/sparc64/Kconfig	2005-01-15 11:27:52 +0100
@@ -603,6 +603,8 @@ source "arch/sparc64/oprofile/Kconfig"
 
 source "arch/sparc64/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/um/Kconfig	2005-01-14 12:35:43 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/um/Kconfig	2005-01-15 11:27:52 +0100
@@ -256,6 +256,8 @@ source "net/Kconfig"
 
 source "fs/Kconfig"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/v850/Kconfig	2005-01-14 12:35:43 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/v850/Kconfig	2005-01-15 11:27:52 +0100
@@ -307,6 +307,8 @@ source "drivers/usb/Kconfig"
 
 source "arch/v850/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/arch/x86_64/Kconfig	2005-01-14 12:35:43 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/arch/x86_64/Kconfig	2005-01-15 11:27:52 +0100
@@ -461,6 +461,8 @@ source "arch/x86_64/oprofile/Kconfig"
 
 source "arch/x86_64/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
--- linux-2.6.11-rc1/include/linux/capability.h	2004-08-14 12:55:09 +0200
+++ linux-2.6.11-rc1-vs1.9.4-rc2/include/linux/capability.h	2005-01-15 11:27:52 +0100
@@ -235,6 +235,7 @@ typedef __u32 kernel_cap_t;
 /* Allow enabling/disabling tagged queuing on SCSI controllers and sending
    arbitrary SCSI commands */
 /* Allow setting encryption key on loopback filesystem */
+/* Allow the selection of a security context */
 
 #define CAP_SYS_ADMIN        21
 
--- linux-2.6.11-rc1/include/linux/capability.h	2004-08-14 12:55:09 +0200
+++ linux-2.6.11-rc1-vs1.9.4-rc2/include/linux/capability.h	2005-01-15 11:27:52 +0100
@@ -284,6 +285,11 @@ typedef __u32 kernel_cap_t;
 
 #define CAP_LEASE            28
 
+/* Allow context manipulations */
+/* Allow changing context info on files */
+
+#define CAP_CONTEXT	     29
+
 #ifdef __KERNEL__
 /* 
  * Bounding set
--- linux-2.6.11-rc1/include/linux/init_task.h	2005-01-14 12:35:58 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/include/linux/init_task.h	2005-01-15 11:27:52 +0100
@@ -112,6 +112,10 @@ extern struct group_info init_groups;
 	.proc_lock	= SPIN_LOCK_UNLOCKED,				\
 	.switch_lock	= SPIN_LOCK_UNLOCKED,				\
 	.journal_info	= NULL,						\
+	.xid		= 0,						\
+	.vx_info	= NULL,						\
+	.nid		= 0,						\
+	.nx_info	= NULL,						\
 }
 
 
--- linux-2.6.11-rc1/include/linux/sched.h	2005-01-14 12:35:58 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/include/linux/sched.h	2005-01-15 11:27:52 +0100
@@ -644,6 +648,14 @@ struct task_struct {
 	void *security;
 	struct audit_context *audit_context;
 
+/* vserver context data */
+	xid_t xid;
+	struct vx_info *vx_info;
+
+/* vserver network data */
+	nid_t nid;
+	struct nx_info *nx_info;
+
 /* Thread group tracking */
    	u32 parent_exec_id;
    	u32 self_exec_id;
--- linux-2.6.11-rc1/include/linux/sched.h	2005-01-14 12:35:58 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/include/linux/sched.h	2005-01-15 11:27:52 +0100
@@ -897,15 +915,28 @@ static inline int sas_ss_flags(unsigned 
 #ifdef CONFIG_SECURITY
 /* code is in security.c */
 extern int capable(int cap);
+extern int vx_capable(int cap, int ccap);
 #else
 static inline int capable(int cap)
 {
+	if (vx_check_bit(VXC_CAP_MASK, cap) && !vx_mcaps(1L << cap))
+		return 0;
 	if (cap_raised(current->cap_effective, cap)) {
 		current->flags |= PF_SUPERPRIV;
 		return 1;
 	}
 	return 0;
 }
+
+static inline int vx_capable(int cap, int ccap)
+{
+	if (cap_raised(current->cap_effective, cap) &&
+		vx_ccaps(ccap)) {
+		current->flags |= PF_SUPERPRIV;
+		return 1;
+	}
+	return 0;
+}
 #endif
 
 /*
--- linux-2.6.11-rc1/include/linux/types.h	2004-12-25 01:55:30 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/include/linux/types.h	2005-01-15 11:27:52 +0100
@@ -36,6 +36,8 @@ typedef __kernel_uid32_t	uid_t;
 typedef __kernel_gid32_t	gid_t;
 typedef __kernel_uid16_t        uid16_t;
 typedef __kernel_gid16_t        gid16_t;
+typedef unsigned int		xid_t;
+typedef unsigned int		nid_t;
 
 #ifdef CONFIG_UID16
 /* This is defined by include/asm-{arch}/posix_types.h */
--- linux-2.6.11-rc1/kernel/Makefile	2004-12-25 01:55:30 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/Makefile	2005-01-15 11:27:52 +0100
@@ -9,6 +9,9 @@ obj-y     = sched.o fork.o exec_domain.o
 	    rcupdate.o intermodule.o extable.o params.o posix-timers.o \
 	    kthread.o wait.o kfifo.o sys_ni.o
 
+subdir-y	+= vserver
+obj-y	  += vserver/vserver.o
+
 obj-$(CONFIG_FUTEX) += futex.o
 obj-$(CONFIG_GENERIC_ISA_DMA) += dma.o
 obj-$(CONFIG_SMP) += cpu.o spinlock.o
--- linux-2.6.11-rc1/kernel/fork.c	2005-01-14 12:36:00 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/fork.c	2005-01-15 12:42:27 +0100
@@ -82,6 +85,8 @@ static kmem_cache_t *task_struct_cachep;
 void free_task(struct task_struct *tsk)
 {
 	free_thread_info(tsk->thread_info);
+	clr_vx_info(&tsk->vx_info);
+	clr_nx_info(&tsk->nx_info);
 	free_task_struct(tsk);
 }
 EXPORT_SYMBOL(free_task);
--- linux-2.6.11-rc1/kernel/fork.c	2005-01-14 12:36:00 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/fork.c	2005-01-15 12:42:27 +0100
@@ -796,6 +804,7 @@ static task_t *copy_process(unsigned lon
 {
 	int retval;
 	struct task_struct *p = NULL;
+	struct vx_info *vxi;
 
 	if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
 		return ERR_PTR(-EINVAL);
--- linux-2.6.11-rc1/kernel/fork.c	2005-01-14 12:36:00 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/fork.c	2005-01-15 12:42:27 +0100
@@ -824,12 +833,32 @@ static task_t *copy_process(unsigned lon
 	if (!p)
 		goto fork_out;
 
+	p->vx_info = NULL;
+	set_vx_info(&p->vx_info, current->vx_info);
+	p->nx_info = NULL;
+	set_nx_info(&p->nx_info, current->nx_info);
+
+	/* check vserver memory */
+	if (p->mm && !(clone_flags & CLONE_VM)) {
+		if (vx_vmpages_avail(p->mm, p->mm->total_vm))
+			vx_pages_add(p->mm->mm_vx_info, RLIMIT_AS, p->mm->total_vm);
+		else
+			goto bad_fork_free;
+	}
+	if (p->mm && vx_flags(VXF_FORK_RSS, 0)) {
+		if (!vx_rsspages_avail(p->mm, p->mm->rss))
+			goto bad_fork_cleanup_vm;
+	}
+
 	retval = -EAGAIN;
+	if (!vx_nproc_avail(1))
+		goto bad_fork_cleanup_vm;
+
 	if (atomic_read(&p->user->processes) >=
 			p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
 		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
 				p->user != &root_user)
-			goto bad_fork_free;
+			goto bad_fork_cleanup_vm;
 	}
 
 	atomic_inc(&p->user->__count);
--- linux-2.6.11-rc1/kernel/fork.c	2005-01-14 12:36:00 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/fork.c	2005-01-15 12:42:27 +0100
@@ -1078,6 +1113,9 @@ bad_fork_cleanup_count:
 	put_group_info(p->group_info);
 	atomic_dec(&p->user->processes);
 	free_uid(p->user);
+bad_fork_cleanup_vm:
+	if (p->mm && !(clone_flags & CLONE_VM))
+		vx_pages_sub(p->mm->mm_vx_info, RLIMIT_AS, p->mm->total_vm);
 bad_fork_free:
 	free_task(p);
 	goto fork_out;
--- linux-2.6.11-rc1/kernel/sched.c	2005-01-14 12:36:00 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/sched.c	2005-01-15 16:26:21 +0100
@@ -3141,6 +3232,8 @@ asmlinkage long sys_nice(int increment)
 	 * and we have a single winner.
 	 */
 	if (increment < 0) {
+		if (vx_flags(VXF_IGNEG_NICE, 0))
+			return 0;
 		if (!capable(CAP_SYS_NICE))
 			return -EPERM;
 		if (increment < -40)
--- linux-2.6.11-rc1/kernel/sys.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/sys.c	2005-01-15 12:54:14 +0100
@@ -226,7 +228,10 @@ static int set_one_prio(struct task_stru
 		goto out;
 	}
 	if (niceval < task_nice(p) && !capable(CAP_SYS_NICE)) {
-		error = -EACCES;
+		if (vx_flags(VXF_IGNEG_NICE, 0))
+			error = 0;
+		else
+			error = -EACCES;
 		goto out;
 	}
 	no_nice = security_task_setnice(p, niceval);
--- linux-2.6.11-rc1/kernel/vserver/Kconfig	1970-01-01 01:00:00 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/vserver/Kconfig	2005-01-15 11:27:52 +0100
@@ -0,0 +1,114 @@
+#
+# Linux VServer configuration
+#
+
+menu "Linux VServer"
+
+config	VSERVER_LEGACY
+	bool	"Enable Legacy Kernel API"
+	default y
+	help
+	  This enables the legacy API used in vs1.xx, which allows
+	  to use older tools (for migration purposes).
+
+config	VSERVER_PROC_SECURE
+	bool	"Enable Proc Security"
+	depends on PROC_FS
+	default y
+	help
+	  Hide proc entries by default for xid>1
+
+config	VSERVER_HARDCPU
+	bool	"Enable Hard CPU Limits"
+	depends on EXPERIMENTAL
+	default n
+	help
+	  Activate the Hard CPU Limits
+
+config	VSERVER_HARDCPU_IDLE
+	bool	"Limit the IDLE task"
+	depends on VSERVER_HARDCPU
+	default n
+	help
+	  Limit the idle slices, so the the next context
+	  will be scheduled as soon as possible.
+	  might improve interactivity/latency but
+	  increases scheduling overhead.
+
+choice
+	prompt	"Persistent Inode Context Tagging"
+	default	INOXID_UGID24
+	help
+	  This adds persistent context information to filesystems
+	  mounted with the tagxid option. Tagging is a requirement
+	  for per context disk limits and per context quota.
+
+
+config	INOXID_NONE
+	bool	"Disabled"
+	help
+	  no context information is store for inodes
+
+config	INOXID_UID16
+	bool	"UID16/GID32"
+	help
+	  reduces UID to 16 bit, but leaves GID at 32 bit.
+
+config	INOXID_GID16
+	bool	"UID32/GID16"
+	help
+	  reduces GID to 16 bit, but leaves UID at 32 bit.
+
+config	INOXID_UGID24
+	bool	"UID24/GID24"
+	help
+	  uses the upper 8bit from UID and GID for XID tagging
+	  which leaves 24bit for UID/GID each, which should be
+	  more than sufficient for normal use.
+
+config	INOXID_INTERN
+	bool	"UID32/GID32"
+	help
+	  this uses otherwise reserved inode fields in the on
+	  disk representation, which limits the use to a few
+	  filesystems (currently ext2 and ext3)
+
+config	INOXID_RUNTIME
+	bool	"Runtime"
+	depends on EXPERIMENTAL
+	help
+	  inodes are tagged when first accessed, this doesn't
+	  require any persistant information, but might give
+	  funny results for mixed access.
+
+endchoice
+
+config	VSERVER_DEBUG
+	bool	"Compile Debugging Code"
+	default n
+	help
+	  Set this to yes if you want to be able to activate
+	  debugging output at runtime. It adds a probably small
+	  overhead (~ ??%) to all vserver related functions and
+	  increases the kernel size by about 20k.
+
+config	VSERVER_HISTORY
+	bool	"Compile History Tracing"
+	depends on VSERVER_DEBUG
+	default n
+	help
+	  Set this to yes if you want to record the history of
+	  linux-vserver activities, so they can be replayed on
+	  a kernel panic (oops)
+
+config	VSERVER_HISTORY_SIZE
+	int "Per CPU History Size (32-65536)"
+	depends on VSERVER_HISTORY
+	range 32 65536
+	default 64
+	help
+	  This allows you to specify the number of entries in
+	  the per CPU history buffer.
+
+endmenu
+
--- linux-2.6.11-rc1/kernel/vserver/Makefile	1970-01-01 01:00:00 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/vserver/Makefile	2005-01-15 11:27:52 +0100
@@ -0,0 +1,14 @@
+#
+# Makefile for the Linux vserver routines.
+#
+
+
+obj-y		+= vserver.o
+
+vserver-y	:= switch.o context.o namespace.o sched.o network.o inode.o \
+		   limit.o cvirt.o signal.o proc.o helper.o init.o dlimit.o
+
+vserver-$(CONFIG_VSERVER_DEBUG) += sysctl.o
+vserver-$(CONFIG_VSERVER_LEGACY) += legacy.o
+vserver-$(CONFIG_VSERVER_HISTORY) += history.o
+
--- linux-2.6.11-rc1/kernel/vserver/init.c	1970-01-01 01:00:00 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/vserver/init.c	2005-01-15 11:27:52 +0100
@@ -0,0 +1,44 @@
+/*
+ *  linux/kernel/init.c
+ *
+ *  Virtual Server Init
+ *
+ *  Copyright (C) 2004  Herbert Pötzl
+ *
+ *  V0.01  basic structure
+ *
+ */
+
+#include <linux/config.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/module.h>
+
+int	vserver_register_sysctl(void);
+void	vserver_unregister_sysctl(void);
+
+
+static int __init init_vserver(void)
+{
+	int ret = 0;
+
+#ifdef	CONFIG_VSERVER_DEBUG
+	vserver_register_sysctl();
+#endif
+	return ret;
+}
+
+
+static void __exit exit_vserver(void)
+{
+
+#ifdef	CONFIG_VSERVER_DEBUG
+	vserver_unregister_sysctl();
+#endif
+	return;
+}
+
+
+module_init(init_vserver);
+module_exit(exit_vserver);
+
--- linux-2.6.11-rc1/security/commoncap.c	2005-01-14 12:36:02 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/security/commoncap.c	2005-01-15 11:27:52 +0100
@@ -142,7 +142,7 @@ void cap_bprm_apply_creds (struct linux_
 	/* Derived from fs/exec.c:compute_creds. */
 	kernel_cap_t new_permitted, working;
 
-	new_permitted = cap_intersect (bprm->cap_permitted, cap_bset);
+	new_permitted = cap_intersect (bprm->cap_permitted, vx_current_bcaps());
 	working = cap_intersect (bprm->cap_inheritable,
 				 current->cap_inheritable);
 	new_permitted = cap_combine (new_permitted, working);
--- linux-2.6.11-rc1/security/security.c	2005-01-14 12:36:02 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/security/security.c	2005-01-15 11:27:52 +0100
@@ -185,6 +185,8 @@ int mod_unreg_security(const char *name,
  */
 int capable(int cap)
 {
+	if (vx_check_bit(VXC_CAP_MASK, cap) && !vx_mcaps(1L << cap))
+		return 0;
 	if (security_ops->capable(current, cap)) {
 		/* capability denied */
 		return 0;
--- linux-2.6.11-rc1/security/security.c	2005-01-14 12:36:02 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/security/security.c	2005-01-15 11:27:52 +0100
@@ -195,9 +197,24 @@ int capable(int cap)
 	return 1;
 }
 
+int vx_capable(int cap, int ccap)
+{
+	if (security_ops->capable(current, cap)) {
+		/* capability denied */
+		return 0;
+	}
+	if (!vx_ccaps(ccap))
+		return 0;
+
+	/* capability granted */
+	current->flags |= PF_SUPERPRIV;
+	return 1;
+}
+
 EXPORT_SYMBOL_GPL(register_security);
 EXPORT_SYMBOL_GPL(unregister_security);
 EXPORT_SYMBOL_GPL(mod_reg_security);
 EXPORT_SYMBOL_GPL(mod_unreg_security);
 EXPORT_SYMBOL(capable);
+EXPORT_SYMBOL(vx_capable);
 EXPORT_SYMBOL(security_ops);
