--- linux-2.6.18.2/drivers/block/loop.c	2006-09-20 16:58:07 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/block/loop.c	2006-09-25 15:40:02 +0200
@@ -815,6 +817,7 @@ static int loop_set_fd(struct loop_devic
 	lo->lo_blocksize = lo_blocksize;
 	lo->lo_device = bdev;
 	lo->lo_flags = lo_flags;
+	lo->lo_xid = vx_current_xid();
 	lo->lo_backing_file = file;
 	lo->transfer = transfer_none;
 	lo->ioctl = NULL;
--- linux-2.6.18.2/drivers/block/loop.c	2006-09-20 16:58:07 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/block/loop.c	2006-09-25 15:40:02 +0200
@@ -922,6 +927,7 @@ static int loop_clr_fd(struct loop_devic
 	lo->lo_sizelimit = 0;
 	lo->lo_encrypt_key_size = 0;
 	lo->lo_flags = 0;
+	lo->lo_xid = 0;
 	memset(lo->lo_encrypt_key, 0, LO_KEY_SIZE);
 	memset(lo->lo_crypt_name, 0, LO_NAME_SIZE);
 	memset(lo->lo_file_name, 0, LO_NAME_SIZE);
--- linux-2.6.18.2/drivers/block/loop.c	2006-09-20 16:58:07 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/block/loop.c	2006-09-25 15:40:02 +0200
@@ -943,7 +949,7 @@ loop_set_status(struct loop_device *lo, 
 	struct loop_func_table *xfer;
 
 	if (lo->lo_encrypt_key_size && lo->lo_key_owner != current->uid &&
-	    !capable(CAP_SYS_ADMIN))
+	    !vx_capable(CAP_SYS_ADMIN, VXC_ADMIN_CLOOP))
 		return -EPERM;
 	if (lo->lo_state != Lo_bound)
 		return -ENXIO;
--- linux-2.6.18.2/drivers/block/loop.c	2006-09-20 16:58:07 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/block/loop.c	2006-09-25 15:40:02 +0200
@@ -1023,7 +1029,8 @@ loop_get_status(struct loop_device *lo, 
 	memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE);
 	info->lo_encrypt_type =
 		lo->lo_encryption ? lo->lo_encryption->number : 0;
-	if (lo->lo_encrypt_key_size && capable(CAP_SYS_ADMIN)) {
+	if (lo->lo_encrypt_key_size &&
+		vx_capable(CAP_SYS_ADMIN, VXC_ADMIN_CLOOP)) {
 		info->lo_encrypt_key_size = lo->lo_encrypt_key_size;
 		memcpy(info->lo_encrypt_key, lo->lo_encrypt_key,
 		       lo->lo_encrypt_key_size);
--- linux-2.6.18.2/drivers/block/loop.c	2006-09-20 16:58:07 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/block/loop.c	2006-09-25 15:40:02 +0200
@@ -1178,6 +1185,9 @@ static int lo_open(struct inode *inode, 
 {
 	struct loop_device *lo = inode->i_bdev->bd_disk->private_data;
 
+	if (!vx_check(lo->lo_xid, VX_WATCH_P|VX_IDENT))
+		return -EACCES;
+
 	mutex_lock(&lo->lo_ctl_mutex);
 	lo->lo_refcnt++;
 	mutex_unlock(&lo->lo_ctl_mutex);
--- linux-2.6.18.2/drivers/md/dm-ioctl.c	2006-09-20 16:58:18 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/md/dm-ioctl.c	2006-09-25 17:18:55 +0200
@@ -100,7 +100,8 @@ static struct hash_cell *__get_name_cell
 	unsigned int h = hash_str(str);
 
 	list_for_each_entry (hc, _name_buckets + h, name_list)
-		if (!strcmp(hc->name, str)) {
+		if (vx_check(dm_get_xid(hc->md), VX_WATCH_P|VX_IDENT) &&
+			!strcmp(hc->name, str)) {
 			dm_get(hc->md);
 			return hc;
 		}
--- linux-2.6.18.2/drivers/md/dm-ioctl.c	2006-09-20 16:58:18 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/md/dm-ioctl.c	2006-09-25 17:18:55 +0200
@@ -114,7 +115,8 @@ static struct hash_cell *__get_uuid_cell
 	unsigned int h = hash_str(str);
 
 	list_for_each_entry (hc, _uuid_buckets + h, uuid_list)
-		if (!strcmp(hc->uuid, str)) {
+		if (vx_check(dm_get_xid(hc->md), VX_WATCH_P|VX_IDENT) &&
+			!strcmp(hc->uuid, str)) {
 			dm_get(hc->md);
 			return hc;
 		}
--- linux-2.6.18.2/drivers/md/dm-ioctl.c	2006-09-20 16:58:18 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/md/dm-ioctl.c	2006-09-25 17:18:55 +0200
@@ -349,6 +351,9 @@ typedef int (*ioctl_fn)(struct dm_ioctl 
 
 static int remove_all(struct dm_ioctl *param, size_t param_size)
 {
+	if (!vx_check(0, VX_ADMIN))
+		return -EPERM;
+
 	dm_hash_remove_all(1);
 	param->data_size = 0;
 	return 0;
--- linux-2.6.18.2/drivers/md/dm-ioctl.c	2006-09-20 16:58:18 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/md/dm-ioctl.c	2006-09-25 17:18:55 +0200
@@ -396,6 +401,8 @@ static int list_devices(struct dm_ioctl 
 	 */
 	for (i = 0; i < NUM_BUCKETS; i++) {
 		list_for_each_entry (hc, _name_buckets + i, name_list) {
+			if (!vx_check(dm_get_xid(hc->md), VX_WATCH_P|VX_IDENT))
+				continue;
 			needed += sizeof(struct dm_name_list);
 			needed += strlen(hc->name) + 1;
 			needed += ALIGN_MASK;
--- linux-2.6.18.2/drivers/md/dm-ioctl.c	2006-09-20 16:58:18 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/md/dm-ioctl.c	2006-09-25 17:18:55 +0200
@@ -419,6 +426,8 @@ static int list_devices(struct dm_ioctl 
 	 */
 	for (i = 0; i < NUM_BUCKETS; i++) {
 		list_for_each_entry (hc, _name_buckets + i, name_list) {
+			if (!vx_check(dm_get_xid(hc->md), VX_WATCH_P|VX_IDENT))
+				continue;
 			if (old_nl)
 				old_nl->next = (uint32_t) ((void *) nl -
 							   (void *) old_nl);
--- linux-2.6.18.2/drivers/md/dm-ioctl.c	2006-09-20 16:58:18 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/md/dm-ioctl.c	2006-09-25 17:18:55 +0200
@@ -606,9 +615,12 @@ static struct hash_cell *__find_device_h
 		return __get_name_cell(param->name);
 
 	md = dm_get_md(huge_decode_dev(param->dev));
-	if (md)
-		mdptr = dm_get_mdptr(md);
-
+	if (md) {
+		if (vx_check(dm_get_xid(md), VX_WATCH_P|VX_IDENT))
+			mdptr = dm_get_mdptr(md);
+		else
+			dm_put(md);
+	}
 	return mdptr;
 }
 
--- linux-2.6.18.2/drivers/md/dm-ioctl.c	2006-09-20 16:58:18 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/md/dm-ioctl.c	2006-09-25 17:18:55 +0200
@@ -1400,8 +1412,8 @@ static int ctl_ioctl(struct inode *inode
 	ioctl_fn fn = NULL;
 	size_t param_size;
 
-	/* only root can play with this */
-	if (!capable(CAP_SYS_ADMIN))
+	/* only root and certain contexts can play with this */
+	if (!vx_capable(CAP_SYS_ADMIN, VXC_ADMIN_MAPPER))
 		return -EACCES;
 
 	if (_IOC_TYPE(command) != DM_IOCTL)
--- linux-2.6.18.2/drivers/md/dm.c	2006-09-20 16:58:19 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/md/dm.c	2006-09-25 17:21:03 +0200
@@ -74,6 +74,7 @@ struct mapped_device {
 	rwlock_t map_lock;
 	atomic_t holders;
 	atomic_t open_count;
+	xid_t xid;
 
 	unsigned long flags;
 
--- linux-2.6.18.2/drivers/md/dm.c	2006-09-20 16:58:19 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/md/dm.c	2006-09-25 17:21:03 +0200
@@ -225,6 +226,7 @@ static void __exit dm_exit(void)
 static int dm_blk_open(struct inode *inode, struct file *file)
 {
 	struct mapped_device *md;
+	int ret = -ENXIO;
 
 	spin_lock(&_minor_lock);
 
--- linux-2.6.18.2/drivers/md/dm.c	2006-09-20 16:58:19 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/md/dm.c	2006-09-25 17:21:03 +0200
@@ -233,18 +235,19 @@ static int dm_blk_open(struct inode *ino
 		goto out;
 
 	if (test_bit(DMF_FREEING, &md->flags) ||
-	    test_bit(DMF_DELETING, &md->flags)) {
-		md = NULL;
+	    test_bit(DMF_DELETING, &md->flags))
 		goto out;
-	}
 
+	ret = -EACCES;
+	if (!vx_check(md->xid, VX_IDENT))
+		goto out;
+
 	dm_get(md);
 	atomic_inc(&md->open_count);
-
+	ret = 0;
 out:
 	spin_unlock(&_minor_lock);
-
-	return md ? 0 : -ENXIO;
+	return ret;
 }
 
 static int dm_blk_close(struct inode *inode, struct file *file)
--- linux-2.6.18.2/drivers/md/dm.c	2006-09-20 16:58:19 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/md/dm.c	2006-09-25 17:21:03 +0200
@@ -401,6 +404,14 @@ int dm_set_geometry(struct mapped_device
 	return 0;
 }
 
+/*
+ * Get the xid associated with a dm device
+ */
+xid_t dm_get_xid(struct mapped_device *md)
+{
+	return md->xid;
+}
+
 /*-----------------------------------------------------------------
  * CRUD START:
  *   A more elegant soln is in the works that uses the queue
--- linux-2.6.18.2/drivers/md/dm.c	2006-09-20 16:58:19 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/md/dm.c	2006-09-25 17:21:03 +0200
@@ -900,6 +911,7 @@ static struct mapped_device *alloc_dev(i
 	atomic_set(&md->holders, 1);
 	atomic_set(&md->open_count, 0);
 	atomic_set(&md->event_nr, 0);
+	md->xid = vx_current_xid();
 
 	md->queue = blk_alloc_queue(GFP_KERNEL);
 	if (!md->queue)
--- linux-2.6.18.2/drivers/md/dm.h	2006-09-20 16:58:19 +0200
+++ linux-2.6.18.2-vs2.1.1/drivers/md/dm.h	2006-09-25 15:40:02 +0200
@@ -67,6 +67,8 @@ void dm_put_target_type(struct target_ty
 int dm_target_iterate(void (*iter_func)(struct target_type *tt,
 					void *param), void *param);
 
+xid_t dm_get_xid(struct mapped_device *md);
+
 /*-----------------------------------------------------------------
  * Useful inlines.
  *---------------------------------------------------------------*/
--- linux-2.6.18.2/include/linux/loop.h	2006-06-18 04:55:19 +0200
+++ linux-2.6.18.2-vs2.1.1/include/linux/loop.h	2006-09-25 15:40:02 +0200
@@ -45,6 +45,7 @@ struct loop_device {
 	struct loop_func_table *lo_encryption;
 	__u32           lo_init[2];
 	uid_t		lo_key_owner;	/* Who set the key */
+	xid_t		lo_xid;
 	int		(*ioctl)(struct loop_device *, int cmd, 
 				 unsigned long arg); 
 
