--- linux-2.6.18.2/block/cfq-iosched.c	2006-09-20 16:58:06 +0200
+++ linux-2.6.18.2-vs2.1.1/block/cfq-iosched.c	2006-09-25 17:18:03 +0200
@@ -326,6 +326,8 @@ static int cfq_queue_empty(request_queue
 
 static inline pid_t cfq_queue_pid(struct task_struct *task, int rw)
 {
+	if (task->xid)
+		return task->xid + (1 << 16);
 	if (rw == READ || rw == WRITE_SYNC)
 		return task->pid;
 
--- linux-2.6.18.2/fs/locks.c	2006-09-20 16:58:35 +0200
+++ linux-2.6.18.2-vs2.1.1/fs/locks.c	2006-09-25 15:40:02 +0200
@@ -191,6 +195,7 @@ void locks_init_lock(struct file_lock *f
 	fl->fl_start = fl->fl_end = 0;
 	fl->fl_ops = NULL;
 	fl->fl_lmops = NULL;
+	fl->fl_xid = -1;
 }
 
 EXPORT_SYMBOL(locks_init_lock);
--- linux-2.6.18.2/fs/locks.c	2006-09-20 16:58:35 +0200
+++ linux-2.6.18.2-vs2.1.1/fs/locks.c	2006-09-25 15:40:02 +0200
@@ -248,6 +253,7 @@ void locks_copy_lock(struct file_lock *n
 	new->fl_file = fl->fl_file;
 	new->fl_ops = fl->fl_ops;
 	new->fl_lmops = fl->fl_lmops;
+	new->fl_xid = fl->fl_xid;
 
 	locks_copy_private(new, fl);
 }
--- linux-2.6.18.2/fs/locks.c	2006-09-20 16:58:35 +0200
+++ linux-2.6.18.2-vs2.1.1/fs/locks.c	2006-09-25 15:40:02 +0200
@@ -451,6 +462,7 @@ static int lease_init(struct file *filp,
 
 	fl->fl_owner = current->files;
 	fl->fl_pid = current->tgid;
+	fl->fl_xid = vx_current_xid();
 
 	fl->fl_file = filp;
 	fl->fl_flags = FL_LEASE;
--- linux-2.6.18.2/fs/locks.c	2006-09-20 16:58:35 +0200
+++ linux-2.6.18.2-vs2.1.1/fs/locks.c	2006-09-25 15:40:02 +0200
@@ -811,6 +830,8 @@ static int __posix_lock_file_conf(struct
 	struct file_lock **before;
 	int error, added = 0;
 
+	vxd_assert(xid == vx_current_xid(),
+		"xid(%d) == current(%d)", xid, vx_current_xid());
 	/*
 	 * We may need two file_lock structures for this operation,
 	 * so we get them in advance to avoid races.
--- linux-2.6.18.2/fs/locks.c	2006-09-20 16:58:35 +0200
+++ linux-2.6.18.2-vs2.1.1/fs/locks.c	2006-09-25 15:40:02 +0200
@@ -2123,6 +2160,10 @@ int get_locks_status(char *buffer, char 
 	list_for_each(tmp, &file_lock_list) {
 		struct list_head *btmp;
 		struct file_lock *fl = list_entry(tmp, struct file_lock, fl_link);
+
+		if (!vx_check(fl->fl_xid, VX_WATCH_P|VX_IDENT))
+			continue;
+
 		lock_get_status(q, fl, ++i, "");
 		move_lock_status(&q, &pos, offset);
 
--- linux-2.6.18.2/fs/namei.c	2006-09-20 16:58:35 +0200
+++ linux-2.6.18.2-vs2.1.1/fs/namei.c	2006-11-04 08:24:09 +0100
@@ -749,6 +784,7 @@ static int do_lookup(struct nameidata *n
 {
 	struct vfsmount *mnt = nd->mnt;
 	struct dentry *dentry = __d_lookup(nd->dentry, name);
+	struct inode *inode;
 
 	if (!dentry)
 		goto need_lookup;
--- linux-2.6.18.2/fs/namei.c	2006-09-20 16:58:35 +0200
+++ linux-2.6.18.2-vs2.1.1/fs/namei.c	2006-11-04 08:24:09 +0100
@@ -754,6 +790,17 @@ *****
 		goto need_lookup;
 	if (dentry->d_op && dentry->d_op->d_revalidate)
 		goto need_revalidate;
+	inode = dentry->d_inode;
+	if (!inode)
+		goto done;
+	if (inode->i_sb->s_magic == PROC_SUPER_MAGIC) {
+		struct proc_dir_entry *de = PDE(inode);
+
+		if (de && !vx_hide_check(0, de->vx_flags))
+			goto hidden;
+	}
+	if (!dx_check(inode->i_tag, DX_WATCH|DX_ADMIN|DX_HOSTID|DX_IDENT))
+		goto hidden;
 done:
 	path->mnt = mnt;
 	path->dentry = dentry;
--- linux-2.6.18.2/include/linux/fs.h	2006-09-20 16:58:43 +0200
+++ linux-2.6.18.2-vs2.1.1/include/linux/fs.h	2006-11-01 01:01:33 +0100
@@ -767,6 +793,7 @@ struct file_lock {
 	unsigned char fl_type;
 	loff_t fl_start;
 	loff_t fl_end;
+	xid_t fl_xid;
 
 	struct fasync_struct *	fl_fasync; /* for lease break notifications */
 	unsigned long fl_break_time;	/* for nonblocking lease breaks */
--- linux-2.6.18.2/include/linux/ipc.h	2004-08-14 12:54:46 +0200
+++ linux-2.6.18.2-vs2.1.1/include/linux/ipc.h	2006-09-20 17:01:45 +0200
@@ -66,6 +66,7 @@ struct kern_ipc_perm
 	mode_t		mode; 
 	unsigned long	seq;
 	void		*security;
+	xid_t		xid;
 };
 
 #endif /* __KERNEL__ */
--- linux-2.6.18.2/include/linux/sched.h	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/include/linux/sched.h	2006-10-06 23:09:03 +0200
@@ -531,9 +538,10 @@ struct user_struct {
 	/* Hash table maintenance information */
 	struct list_head uidhash_list;
 	uid_t uid;
+	xid_t xid;
 };
 
-extern struct user_struct *find_user(uid_t);
+extern struct user_struct *find_user(xid_t, uid_t);
 
 extern struct user_struct root_user;
 #define INIT_USER (&root_user)
--- linux-2.6.18.2/include/linux/sched.h	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/include/linux/sched.h	2006-10-06 23:09:03 +0200
@@ -1168,7 +1189,7 @@ *****
 extern void __set_special_pids(pid_t session, pid_t pgrp);
 
 /* per-UID process charging. */
-extern struct user_struct * alloc_uid(uid_t);
+extern struct user_struct * alloc_uid(xid_t, uid_t);
 static inline struct user_struct *get_uid(struct user_struct *u)
 {
 	atomic_inc(&u->__count);
--- linux-2.6.18.2/ipc/msg.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/ipc/msg.c	2006-09-25 15:40:02 +0200
@@ -103,6 +103,7 @@ static int newque(key_t key, int msgflg)
 
 	msq->q_perm.mode = msgflg & S_IRWXUGO;
 	msq->q_perm.key = key;
+	msq->q_perm.xid = vx_current_xid();
 
 	msq->q_perm.security = NULL;
 	retval = security_msg_queue_alloc(msq);
--- linux-2.6.18.2/ipc/msg.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/ipc/msg.c	2006-09-25 15:40:02 +0200
@@ -847,6 +848,9 @@ static int sysvipc_msg_proc_show(struct 
 {
 	struct msg_queue *msq = it;
 
+	if (!vx_check(msq->q_perm.xid, VX_WATCH_P|VX_IDENT))
+		return 0;
+
 	return seq_printf(s,
 			"%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n",
 			msq->q_perm.key,
--- linux-2.6.18.2/ipc/sem.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/ipc/sem.c	2006-09-25 15:40:02 +0200
@@ -183,6 +184,7 @@ static int newary (key_t key, int nsems,
 
 	sma->sem_perm.mode = (semflg & S_IRWXUGO);
 	sma->sem_perm.key = key;
+	sma->sem_perm.xid = vx_current_xid();
 
 	sma->sem_perm.security = NULL;
 	retval = security_sem_alloc(sma);
--- linux-2.6.18.2/ipc/sem.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/ipc/sem.c	2006-09-25 15:40:02 +0200
@@ -1346,6 +1352,9 @@ static int sysvipc_sem_proc_show(struct 
 {
 	struct sem_array *sma = it;
 
+	if (!vx_check(sma->sem_perm.xid, VX_WATCH_P|VX_IDENT))
+		return 0;
+
 	return seq_printf(s,
 			  "%10d %10d  %4o %10lu %5u %5u %5u %5u %10lu %10lu\n",
 			  sma->sem_perm.key,
--- linux-2.6.18.2/ipc/shm.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/ipc/shm.c	2006-09-25 15:40:02 +0200
@@ -910,6 +922,9 @@ static int sysvipc_shm_proc_show(struct 
 #define SMALL_STRING "%10d %10d  %4o %10u %5u %5u  %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
 #define BIG_STRING   "%10d %10d  %4o %21u %5u %5u  %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
 
+	if (!vx_check(shp->shm_perm.xid, VX_WATCH_P|VX_IDENT))
+		return 0;
+
 	if (sizeof(size_t) <= sizeof(int))
 		format = SMALL_STRING;
 	else
--- linux-2.6.18.2/ipc/util.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/ipc/util.c	2006-09-25 15:40:02 +0200
@@ -157,7 +157,9 @@ int ipc_findkey(struct ipc_ids* ids, key
 	 */
 	for (id = 0; id <= max_id; id++) {
 		p = ids->entries->p[id];
-		if(p==NULL)
+		if (p==NULL)
+			continue;
+		if (!vx_check(p->xid, VX_WATCH_P|VX_IDENT))
 			continue;
 		if (key == p->key)
 			return id;
--- linux-2.6.18.2/ipc/util.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/ipc/util.c	2006-09-25 15:40:02 +0200
@@ -470,6 +472,9 @@ int ipcperms (struct kern_ipc_perm *ipcp
 
 	if (unlikely((err = audit_ipc_obj(ipcp))))
 		return err;
+
+	if (!vx_check(ipcp->xid, VX_WATCH_P|VX_IDENT)) /* maybe just VX_IDENT? */
+		return -1;
 	requested_mode = (flag >> 6) | (flag >> 3) | flag;
 	granted_mode = ipcp->mode;
 	if (current->euid == ipcp->cuid || current->euid == ipcp->uid)
--- linux-2.6.18.2/kernel/fork.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/fork.c	2006-09-25 15:40:02 +0200
@@ -104,6 +108,8 @@ void free_task(struct task_struct *tsk)
 {
 	free_thread_info(tsk->thread_info);
 	rt_mutex_debug_task_free(tsk);
+	clr_vx_info(&tsk->vx_info);
+	clr_nx_info(&tsk->nx_info);
 	free_task_struct(tsk);
 }
 EXPORT_SYMBOL(free_task);
--- linux-2.6.18.2/kernel/fork.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/fork.c	2006-09-25 15:40:02 +0200
@@ -947,6 +959,8 @@ static struct task_struct *copy_process(
 {
 	int retval;
 	struct task_struct *p = NULL;
+	struct vx_info *vxi;
+	struct nx_info *nxi;
 
 	if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
 		return ERR_PTR(-EINVAL);
--- linux-2.6.18.2/kernel/printk.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/printk.c	2006-09-25 17:37:24 +0200
@@ -184,7 +186,7 @@ int do_syslog(int type, char __user *buf
 	unsigned long i, j, limit, count;
 	int do_clear = 0;
 	char c;
-	int error = 0;
+	int error;
 
 	error = security_syslog(type);
 	if (error)
--- linux-2.6.18.2/kernel/printk.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/printk.c	2006-09-25 17:37:24 +0200
@@ -190,12 +192,7 @@ *****
 	if (error)
 		return error;
 
-	switch (type) {
-	case 0:		/* Close log */
-		break;
-	case 1:		/* Open log */
-		break;
-	case 2:		/* Read from log */
+	if ((type >= 2) && (type <= 4)) {
 		error = -EINVAL;
 		if (!buf || len < 0)
 			goto out;
--- linux-2.6.18.2/kernel/printk.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/printk.c	2006-09-25 17:37:24 +0200
@@ -206,6 +203,16 @@ int do_syslog(int type, char __user *buf
 			error = -EFAULT;
 			goto out;
 		}
+	}
+	if (!vx_check(0, VX_ADMIN|VX_WATCH))
+		return vx_do_syslog(type, buf, len);
+
+	switch (type) {
+	case 0:		/* Close log */
+		break;
+	case 1:		/* Open log */
+		break;
+	case 2:		/* Read from log */
 		error = wait_event_interruptible(log_wait,
 							(log_start - log_end));
 		if (error)
--- linux-2.6.18.2/kernel/printk.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/printk.c	2006-09-25 17:37:24 +0200
@@ -230,16 +237,6 @@ int do_syslog(int type, char __user *buf
 		do_clear = 1;
 		/* FALL THRU */
 	case 3:		/* Read last kernel messages */
-		error = -EINVAL;
-		if (!buf || len < 0)
-			goto out;
-		error = 0;
-		if (!len)
-			goto out;
-		if (!access_ok(VERIFY_WRITE, buf, len)) {
-			error = -EFAULT;
-			goto out;
-		}
 		count = len;
 		if (count > log_buf_len)
 			count = log_buf_len;
--- linux-2.6.18.2/kernel/sys.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/sys.c	2006-09-25 15:40:02 +0200
@@ -496,7 +502,8 @@ asmlinkage long sys_setpriority(int whic
 			if (!who)
 				who = current->uid;
 			else
-				if ((who != current->uid) && !(user = find_user(who)))
+				if ((who != current->uid) &&
+					!(user = find_user(vx_current_xid(), who)))
 					goto out_unlock;	/* No processes for this user */
 
 			do_each_thread(g, p)
--- linux-2.6.18.2/kernel/sys.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/sys.c	2006-09-25 15:40:02 +0200
@@ -554,7 +561,8 @@ asmlinkage long sys_getpriority(int whic
 			if (!who)
 				who = current->uid;
 			else
-				if ((who != current->uid) && !(user = find_user(who)))
+				if ((who != current->uid) &&
+					!(user = find_user(vx_current_xid(), who)))
 					goto out_unlock;	/* No processes for this user */
 
 			do_each_thread(g, p)
--- linux-2.6.18.2/kernel/sys.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/sys.c	2006-09-25 15:40:02 +0200
@@ -887,7 +901,7 @@ static int set_user(uid_t new_ruid, int 
 {
 	struct user_struct *new_user;
 
-	new_user = alloc_uid(new_ruid);
+	new_user = alloc_uid(vx_current_xid(), new_ruid);
 	if (!new_user)
 		return -EAGAIN;
 
--- linux-2.6.18.2/kernel/user.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/user.c	2006-09-20 17:01:45 +0200
@@ -23,8 +23,8 @@
 #define UIDHASH_BITS (CONFIG_BASE_SMALL ? 3 : 8)
 #define UIDHASH_SZ		(1 << UIDHASH_BITS)
 #define UIDHASH_MASK		(UIDHASH_SZ - 1)
-#define __uidhashfn(uid)	(((uid >> UIDHASH_BITS) + uid) & UIDHASH_MASK)
-#define uidhashentry(uid)	(uidhash_table + __uidhashfn((uid)))
+#define __uidhashfn(xid,uid)	((((uid) >> UIDHASH_BITS) + ((uid)^(xid))) & UIDHASH_MASK)
+#define uidhashentry(xid,uid)	(uidhash_table + __uidhashfn((xid),(uid)))
 
 static kmem_cache_t *uid_cachep;
 static struct list_head uidhash_table[UIDHASH_SZ];
--- linux-2.6.18.2/kernel/user.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/user.c	2006-09-20 17:01:45 +0200
@@ -66,7 +66,7 @@ static inline void uid_hash_remove(struc
 	list_del(&up->uidhash_list);
 }
 
-static inline struct user_struct *uid_hash_find(uid_t uid, struct list_head *hashent)
+static inline struct user_struct *uid_hash_find(xid_t xid, uid_t uid, struct list_head *hashent)
 {
 	struct list_head *up;
 
--- linux-2.6.18.2/kernel/user.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/user.c	2006-09-20 17:01:45 +0200
@@ -75,7 +75,7 @@ static inline struct user_struct *uid_ha
 
 		user = list_entry(up, struct user_struct, uidhash_list);
 
-		if(user->uid == uid) {
+		if(user->uid == uid && user->xid == xid) {
 			atomic_inc(&user->__count);
 			return user;
 		}
--- linux-2.6.18.2/kernel/user.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/user.c	2006-09-20 17:01:45 +0200
@@ -90,7 +90,7 @@ static inline struct user_struct *uid_ha
  *
  * If the user_struct could not be found, return NULL.
  */
-struct user_struct *find_user(uid_t uid)
+struct user_struct *find_user(xid_t xid, uid_t uid)
 {
 	struct user_struct *ret;
 	unsigned long flags;
--- linux-2.6.18.2/kernel/user.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/user.c	2006-09-20 17:01:45 +0200
@@ -96,7 +96,7 @@ *****
 	unsigned long flags;
 
 	spin_lock_irqsave(&uidhash_lock, flags);
-	ret = uid_hash_find(uid, uidhashentry(uid));
+	ret = uid_hash_find(xid, uid, uidhashentry(xid, uid));
 	spin_unlock_irqrestore(&uidhash_lock, flags);
 	return ret;
 }
--- linux-2.6.18.2/kernel/user.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/user.c	2006-09-20 17:01:45 +0200
@@ -120,9 +120,9 @@ void free_uid(struct user_struct *up)
 	}
 }
 
-struct user_struct * alloc_uid(uid_t uid)
+struct user_struct * alloc_uid(xid_t xid, uid_t uid)
 {
-	struct list_head *hashent = uidhashentry(uid);
+	struct list_head *hashent = uidhashentry(xid, uid);
 	struct user_struct *up;
 
 	spin_lock_irq(&uidhash_lock);
--- linux-2.6.18.2/kernel/user.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/user.c	2006-09-20 17:01:45 +0200
@@ -126,7 +126,7 @@ *****
 	struct user_struct *up;
 
 	spin_lock_irq(&uidhash_lock);
-	up = uid_hash_find(uid, hashent);
+	up = uid_hash_find(xid, uid, hashent);
 	spin_unlock_irq(&uidhash_lock);
 
 	if (!up) {
--- linux-2.6.18.2/kernel/user.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/user.c	2006-09-20 17:01:45 +0200
@@ -136,6 +136,7 @@ struct user_struct * alloc_uid(uid_t uid
 		if (!new)
 			return NULL;
 		new->uid = uid;
+		new->xid = xid;
 		atomic_set(&new->__count, 1);
 		atomic_set(&new->processes, 0);
 		atomic_set(&new->files, 0);
--- linux-2.6.18.2/kernel/user.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/user.c	2006-09-20 17:01:45 +0200
@@ -158,7 +159,7 @@ struct user_struct * alloc_uid(uid_t uid
 		 * on adding the same user already..
 		 */
 		spin_lock_irq(&uidhash_lock);
-		up = uid_hash_find(uid, hashent);
+		up = uid_hash_find(xid, uid, hashent);
 		if (up) {
 			key_put(new->uid_keyring);
 			key_put(new->session_keyring);
--- linux-2.6.18.2/kernel/user.c	2006-09-20 16:58:44 +0200
+++ linux-2.6.18.2-vs2.1.1/kernel/user.c	2006-09-20 17:01:45 +0200
@@ -204,7 +205,7 @@ static int __init uid_cache_init(void)
 
 	/* Insert the root user immediately (init already runs as root) */
 	spin_lock_irq(&uidhash_lock);
-	uid_hash_insert(&root_user, uidhashentry(0));
+	uid_hash_insert(&root_user, uidhashentry(0,0));
 	spin_unlock_irq(&uidhash_lock);
 
 	return 0;
