--- linux-2.6.11-rc1/fs/devpts/inode.c	2005-01-14 12:35:55 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/fs/devpts/inode.c	2005-01-15 12:33:11 +0100
@@ -115,8 +187,9 @@ devpts_fill_super(struct super_block *s,
 	inode->i_uid = inode->i_gid = 0;
 	inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR;
 	inode->i_op = &simple_dir_inode_operations;
-	inode->i_fop = &simple_dir_operations;
+	inode->i_fop = &devpts_dir_operations;
 	inode->i_nlink = 2;
+	inode->i_xid = vx_current_xid();
 
 	devpts_root = s->s_root = d_alloc_root(inode);
 	if (s->s_root)
--- linux-2.6.11-rc1/fs/devpts/inode.c	2005-01-14 12:35:55 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/fs/devpts/inode.c	2005-01-15 12:33:11 +0100
@@ -175,6 +248,7 @@ int devpts_pty_new(struct tty_struct *tt
 	inode->i_gid = config.setgid ? config.gid : current->fsgid;
 	inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
 	init_special_inode(inode, S_IFCHR|config.mode, device);
+	inode->i_xid = vx_current_xid();
 	inode->i_op = &devpts_file_inode_operations;
 	inode->u.generic_ip = tty;
 
--- linux-2.6.11-rc1/include/linux/ipc.h	2004-08-14 12:54:46 +0200
+++ linux-2.6.11-rc1-vs1.9.4-rc2/include/linux/ipc.h	2005-01-15 11:27:52 +0100
@@ -66,6 +66,7 @@ struct kern_ipc_perm
 	mode_t		mode; 
 	unsigned long	seq;
 	void		*security;
+	xid_t		xid;
 };
 
 #endif /* __KERNEL__ */
--- linux-2.6.11-rc1/include/linux/sched.h	2005-01-14 12:35:58 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/include/linux/sched.h	2005-01-15 11:27:52 +0100
@@ -380,9 +383,10 @@ struct user_struct {
 	/* Hash table maintenance information */
 	struct list_head uidhash_list;
 	uid_t uid;
+	xid_t xid;
 };
 
-extern struct user_struct *find_user(uid_t);
+extern struct user_struct *find_user(xid_t, uid_t);
 
 extern struct user_struct root_user;
 #define INIT_USER (&root_user)
--- linux-2.6.11-rc1/ipc/msg.c	2004-12-25 01:55:30 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/ipc/msg.c	2005-01-15 11:27:52 +0100
@@ -97,6 +97,7 @@ static int newque (key_t key, int msgflg
 
 	msq->q_perm.mode = (msgflg & S_IRWXUGO);
 	msq->q_perm.key = key;
+	msq->q_perm.xid = vx_current_xid();
 
 	msq->q_perm.security = NULL;
 	retval = security_msg_queue_alloc(msq);
--- linux-2.6.11-rc1/ipc/msg.c	2004-12-25 01:55:30 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/ipc/msg.c	2005-01-15 11:27:52 +0100
@@ -817,7 +818,11 @@ static int sysvipc_msg_read_proc(char *b
 	for(i = 0; i <= msg_ids.max_id; i++) {
 		struct msg_queue * msq;
 		msq = msg_lock(i);
-		if(msq != NULL) {
+		if (msq) {
+			if (!vx_check(msq->q_perm.xid, VX_IDENT)) {
+				msg_unlock(msq);
+				continue;
+			}
 			len += sprintf(buffer + len, "%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n",
 				msq->q_perm.key,
 				msg_buildid(i,msq->q_perm.seq),
--- linux-2.6.11-rc1/ipc/sem.c	2005-01-14 12:36:00 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/ipc/sem.c	2005-01-15 11:27:52 +0100
@@ -176,6 +176,7 @@ static int newary (key_t key, int nsems,
 
 	sma->sem_perm.mode = (semflg & S_IRWXUGO);
 	sma->sem_perm.key = key;
+	sma->sem_perm.xid = vx_current_xid();
 
 	sma->sem_perm.security = NULL;
 	retval = security_sem_alloc(sma);
--- linux-2.6.11-rc1/ipc/sem.c	2005-01-14 12:36:00 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/ipc/sem.c	2005-01-15 11:27:52 +0100
@@ -1344,7 +1345,11 @@ static int sysvipc_sem_read_proc(char *b
 	for(i = 0; i <= sem_ids.max_id; i++) {
 		struct sem_array *sma;
 		sma = sem_lock(i);
-		if(sma) {
+		if (sma) {
+			if (!vx_check(sma->sem_perm.xid, VX_IDENT)) {
+				sem_unlock(sma);
+				continue;
+			}
 			len += sprintf(buffer + len, "%10d %10d  %4o %10lu %5u %5u %5u %5u %10lu %10lu\n",
 				sma->sem_perm.key,
 				sem_buildid(i,sma->sem_perm.seq),
--- linux-2.6.11-rc1/ipc/shm.c	2004-12-25 01:55:30 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/ipc/shm.c	2005-01-15 11:27:52 +0100
@@ -193,6 +193,7 @@ static int newseg (key_t key, int shmflg
 		return -ENOMEM;
 
 	shp->shm_perm.key = key;
+	shp->shm_perm.xid = vx_current_xid();
 	shp->shm_flags = (shmflg & S_IRWXUGO);
 	shp->mlock_user = NULL;
 
--- linux-2.6.11-rc1/ipc/shm.c	2004-12-25 01:55:30 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/ipc/shm.c	2005-01-15 11:27:52 +0100
@@ -865,11 +866,15 @@ static int sysvipc_shm_read_proc(char *b
 		struct shmid_kernel* shp;
 
 		shp = shm_lock(i);
-		if(shp!=NULL) {
+		if (shp) {
 #define SMALL_STRING "%10d %10d  %4o %10u %5u %5u  %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
 #define BIG_STRING   "%10d %10d  %4o %21u %5u %5u  %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
 			char *format;
 
+			if (!vx_check(shp->shm_perm.xid, VX_IDENT)) {
+				shm_unlock(shp);
+				continue;
+			}
 			if (sizeof(size_t) <= sizeof(int))
 				format = SMALL_STRING;
 			else
--- linux-2.6.11-rc1/ipc/util.c	2004-12-25 01:55:30 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/ipc/util.c	2005-01-15 11:27:52 +0100
@@ -107,7 +107,9 @@ int ipc_findkey(struct ipc_ids* ids, key
 	 */
 	for (id = 0; id <= max_id; id++) {
 		p = ids->entries->p[id];
-		if(p==NULL)
+		if (p==NULL)
+			continue;
+		if (!vx_check(p->xid, VX_IDENT))
 			continue;
 		if (key == p->key)
 			return id;
--- linux-2.6.11-rc1/ipc/util.c	2004-12-25 01:55:30 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/ipc/util.c	2005-01-15 11:27:52 +0100
@@ -420,6 +422,8 @@ int ipcperms (struct kern_ipc_perm *ipcp
 {	/* flag will most probably be 0 or S_...UGO from <linux/stat.h> */
 	int requested_mode, granted_mode;
 
+	if (!vx_check(ipcp->xid, VX_ADMIN|VX_IDENT)) /* maybe just VX_IDENT? */
+		return -1;
 	requested_mode = (flag >> 6) | (flag >> 3) | flag;
 	granted_mode = ipcp->mode;
 	if (current->euid == ipcp->cuid || current->euid == ipcp->uid)
--- linux-2.6.11-rc1/kernel/printk.c	2005-01-14 12:36:00 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/printk.c	2005-01-15 11:27:52 +0100
@@ -251,7 +251,10 @@ int do_syslog(int type, char __user * bu
 	unsigned long i, j, limit, count;
 	int do_clear = 0;
 	char c;
-	int error = 0;
+	int error = -EPERM;
+
+	if (!vx_check(0, VX_ADMIN|VX_WATCH))
+		return error;
 
 	error = security_syslog(type);
 	if (error)
--- linux-2.6.11-rc1/kernel/sys.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/sys.c	2005-01-15 12:54:14 +0100
@@ -278,7 +283,8 @@ asmlinkage long sys_setpriority(int whic
 			if (!who)
 				who = current->uid;
 			else
-				if ((who != current->uid) && !(user = find_user(who)))
+				if ((who != current->uid) &&
+					!(user = find_user(vx_current_xid(), who)))
 					goto out_unlock;	/* No processes for this user */
 
 			do_each_thread(g, p)
--- linux-2.6.11-rc1/kernel/sys.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/sys.c	2005-01-15 12:54:14 +0100
@@ -336,7 +342,8 @@ asmlinkage long sys_getpriority(int whic
 			if (!who)
 				who = current->uid;
 			else
-				if ((who != current->uid) && !(user = find_user(who)))
+				if ((who != current->uid) &&
+					!(user = find_user(vx_current_xid(), who)))
 					goto out_unlock;	/* No processes for this user */
 
 			do_each_thread(g, p)
--- linux-2.6.11-rc1/kernel/sys.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/sys.c	2005-01-15 12:54:14 +0100
@@ -578,7 +589,7 @@ static int set_user(uid_t new_ruid, int 
 {
 	struct user_struct *new_user;
 
-	new_user = alloc_uid(new_ruid);
+	new_user = alloc_uid(vx_current_xid(), new_ruid);
 	if (!new_user)
 		return -EAGAIN;
 
--- linux-2.6.11-rc1/kernel/user.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/user.c	2005-01-15 11:27:52 +0100
@@ -21,8 +21,8 @@
 #define UIDHASH_BITS		8
 #define UIDHASH_SZ		(1 << UIDHASH_BITS)
 #define UIDHASH_MASK		(UIDHASH_SZ - 1)
-#define __uidhashfn(uid)	(((uid >> UIDHASH_BITS) + uid) & UIDHASH_MASK)
-#define uidhashentry(uid)	(uidhash_table + __uidhashfn((uid)))
+#define __uidhashfn(xid,uid)	((((uid) >> UIDHASH_BITS) + ((uid)^(xid))) & UIDHASH_MASK)
+#define uidhashentry(xid,uid)	(uidhash_table + __uidhashfn((xid),(uid)))
 
 static kmem_cache_t *uid_cachep;
 static struct list_head uidhash_table[UIDHASH_SZ];
--- linux-2.6.11-rc1/kernel/user.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/user.c	2005-01-15 11:27:52 +0100
@@ -54,7 +54,7 @@ static inline void uid_hash_remove(struc
 	list_del(&up->uidhash_list);
 }
 
-static inline struct user_struct *uid_hash_find(uid_t uid, struct list_head *hashent)
+static inline struct user_struct *uid_hash_find(xid_t xid, uid_t uid, struct list_head *hashent)
 {
 	struct list_head *up;
 
--- linux-2.6.11-rc1/kernel/user.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/user.c	2005-01-15 11:27:52 +0100
@@ -63,7 +63,7 @@ static inline struct user_struct *uid_ha
 
 		user = list_entry(up, struct user_struct, uidhash_list);
 
-		if(user->uid == uid) {
+		if(user->uid == uid && user->xid == xid) {
 			atomic_inc(&user->__count);
 			return user;
 		}
--- linux-2.6.11-rc1/kernel/user.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/user.c	2005-01-15 11:27:52 +0100
@@ -78,12 +78,12 @@ static inline struct user_struct *uid_ha
  *
  * If the user_struct could not be found, return NULL.
  */
-struct user_struct *find_user(uid_t uid)
+struct user_struct *find_user(xid_t xid, uid_t uid)
 {
 	struct user_struct *ret;
 
 	spin_lock(&uidhash_lock);
-	ret = uid_hash_find(uid, uidhashentry(uid));
+	ret = uid_hash_find(xid, uid, uidhashentry(xid, uid));
 	spin_unlock(&uidhash_lock);
 	return ret;
 }
--- linux-2.6.11-rc1/kernel/user.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/user.c	2005-01-15 11:27:52 +0100
@@ -99,13 +99,13 @@ void free_uid(struct user_struct *up)
 	}
 }
 
-struct user_struct * alloc_uid(uid_t uid)
+struct user_struct * alloc_uid(xid_t xid, uid_t uid)
 {
-	struct list_head *hashent = uidhashentry(uid);
+	struct list_head *hashent = uidhashentry(xid, uid);
 	struct user_struct *up;
 
 	spin_lock(&uidhash_lock);
-	up = uid_hash_find(uid, hashent);
+	up = uid_hash_find(xid, uid, hashent);
 	spin_unlock(&uidhash_lock);
 
 	if (!up) {
--- linux-2.6.11-rc1/kernel/user.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/user.c	2005-01-15 11:27:52 +0100
@@ -115,6 +115,7 @@ struct user_struct * alloc_uid(uid_t uid
 		if (!new)
 			return NULL;
 		new->uid = uid;
+		new->xid = xid;
 		atomic_set(&new->__count, 1);
 		atomic_set(&new->processes, 0);
 		atomic_set(&new->files, 0);
--- linux-2.6.11-rc1/kernel/user.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/user.c	2005-01-15 11:27:52 +0100
@@ -133,7 +134,7 @@ struct user_struct * alloc_uid(uid_t uid
 		 * on adding the same user already..
 		 */
 		spin_lock(&uidhash_lock);
-		up = uid_hash_find(uid, hashent);
+		up = uid_hash_find(xid, uid, hashent);
 		if (up) {
 			key_put(new->uid_keyring);
 			key_put(new->session_keyring);
--- linux-2.6.11-rc1/kernel/user.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/kernel/user.c	2005-01-15 11:27:52 +0100
@@ -179,7 +180,7 @@ static int __init uid_cache_init(void)
 
 	/* Insert the root user immediately (init already runs as root) */
 	spin_lock(&uidhash_lock);
-	uid_hash_insert(&root_user, uidhashentry(0));
+	uid_hash_insert(&root_user, uidhashentry(0,0));
 	spin_unlock(&uidhash_lock);
 
 	return 0;
--- linux-2.6.11-rc1/net/core/dev.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/net/core/dev.c	2005-01-15 11:27:52 +0100
@@ -1893,6 +1894,9 @@ static int dev_ifconf(char __user *arg)
 
 	total = 0;
 	for (dev = dev_base; dev; dev = dev->next) {
+		if (vx_flags(VXF_HIDE_NETIF, 0) &&
+			!dev_in_nx_info(dev, current->nx_info))
+			continue;
 		for (i = 0; i < NPROTO; i++) {
 			if (gifconf_list[i]) {
 				int done;
--- linux-2.6.11-rc1/net/core/dev.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/net/core/dev.c	2005-01-15 11:27:52 +0100
@@ -1953,6 +1957,10 @@ void dev_seq_stop(struct seq_file *seq, 
 
 static void dev_seq_printf_stats(struct seq_file *seq, struct net_device *dev)
 {
+	struct nx_info *nxi = current->nx_info;
+
+	if (vx_flags(VXF_HIDE_NETIF, 0) && !dev_in_nx_info(dev, nxi))
+		return;
 	if (dev->get_stats) {
 		struct net_device_stats *stats = dev->get_stats(dev);
 
--- linux-2.6.11-rc1/net/core/rtnetlink.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/net/core/rtnetlink.c	2005-01-15 11:27:52 +0100
@@ -251,6 +251,9 @@ int rtnetlink_dump_ifinfo(struct sk_buff
 	for (dev=dev_base, idx=0; dev; dev = dev->next, idx++) {
 		if (idx < s_idx)
 			continue;
+		if (vx_info_flags(skb->sk->sk_vx_info, VXF_HIDE_NETIF, 0) &&
+			!dev_in_nx_info(dev, skb->sk->sk_nx_info))
+			continue;
 		if (rtnetlink_fill_ifinfo(skb, dev, RTM_NEWLINK, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq, 0) <= 0)
 			break;
 	}
--- linux-2.6.11-rc1/net/core/rtnetlink.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/net/core/rtnetlink.c	2005-01-15 11:27:52 +0100
@@ -431,6 +434,9 @@ void rtmsg_ifinfo(int type, struct net_d
 			       sizeof(struct rtnl_link_ifmap) +
 			       sizeof(struct rtnl_link_stats) + 128);
 
+	if (vx_flags(VXF_HIDE_NETIF, 0) &&
+		!dev_in_nx_info(dev, current->nx_info))
+		return;
 	skb = alloc_skb(size, GFP_KERNEL);
 	if (!skb)
 		return;
--- linux-2.6.11-rc1/net/ipv4/devinet.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/net/ipv4/devinet.c	2005-01-15 11:27:52 +0100
@@ -596,6 +623,9 @@ int devinet_ioctl(unsigned int cmd, void
 	ret = -EADDRNOTAVAIL;
 	if (!ifa && cmd != SIOCSIFADDR && cmd != SIOCSIFFLAGS)
 		goto done;
+	if (vx_flags(VXF_HIDE_NETIF, 0) &&
+		!ifa_in_nx_info(ifa, current->nx_info))
+		goto done;
 
 	switch(cmd) {
 	case SIOCGIFADDR:	/* Get interface address */
--- linux-2.6.11-rc1/net/ipv4/devinet.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/net/ipv4/devinet.c	2005-01-15 11:27:52 +0100
@@ -739,6 +769,9 @@ static int inet_gifconf(struct net_devic
 		goto out;
 
 	for (; ifa; ifa = ifa->ifa_next) {
+		if (vx_flags(VXF_HIDE_NETIF, 0) &&
+			!ifa_in_nx_info(ifa, current->nx_info))
+			continue;
 		if (!buf) {
 			done += sizeof(ifr);
 			continue;
--- linux-2.6.11-rc1/net/ipv4/devinet.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/net/ipv4/devinet.c	2005-01-15 11:27:52 +0100
@@ -1045,6 +1078,7 @@ static int inet_dump_ifaddr(struct sk_bu
 	struct net_device *dev;
 	struct in_device *in_dev;
 	struct in_ifaddr *ifa;
+	struct sock *sk = skb->sk;
 	int s_ip_idx, s_idx = cb->args[0];
 
 	s_ip_idx = ip_idx = cb->args[1];
--- linux-2.6.11-rc1/net/ipv4/devinet.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/net/ipv4/devinet.c	2005-01-15 11:27:52 +0100
@@ -1062,6 +1096,9 @@ static int inet_dump_ifaddr(struct sk_bu
 
 		for (ifa = in_dev->ifa_list, ip_idx = 0; ifa;
 		     ifa = ifa->ifa_next, ip_idx++) {
+			if (sk && vx_info_flags(sk->sk_vx_info, VXF_HIDE_NETIF, 0) &&
+				!ifa_in_nx_info(ifa, sk->sk_nx_info))
+				continue;
 			if (ip_idx < s_ip_idx)
 				continue;
 			if (inet_fill_ifaddr(skb, ifa, NETLINK_CB(cb->skb).pid,
--- linux-2.6.11-rc1/net/ipv4/fib_hash.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/net/ipv4/fib_hash.c	2005-01-15 11:27:52 +0100
@@ -955,6 +955,8 @@ static unsigned fib_flag_trans(int type,
 	return flags;
 }
 
+extern int dev_in_nx_info(struct net_device *, struct nx_info *);
+
 /* 
  *	This outputs /proc/net/route.
  *
--- linux-2.6.11-rc1/net/ipv4/fib_hash.c	2005-01-14 12:36:01 +0100
+++ linux-2.6.11-rc1-vs1.9.4-rc2/net/ipv4/fib_hash.c	2005-01-15 11:27:52 +0100
@@ -985,7 +987,8 @@ static int fib_seq_show(struct seq_file 
 	prefix	= f->fn_key;
 	mask	= FZ_MASK(iter->zone);
 	flags	= fib_flag_trans(fa->fa_type, mask, fi);
-	if (fi)
+	if (fi && (!vx_flags(VXF_HIDE_NETIF, 0) ||
+		dev_in_nx_info(fi->fib_dev, current->nx_info)))
 		snprintf(bf, sizeof(bf),
 			 "%s\t%08X\t%08X\t%04X\t%d\t%u\t%d\t%08X\t%d\t%u\t%u",
 			 fi->fib_dev ? fi->fib_dev->name : "*", prefix,
