diff -NurpPbB --minimal linux-2.6.19.7-vs2.2.0/include/linux/vs_network.h linux-2.6.19.7-vs2.2.0-z1/include/linux/vs_network.h
--- linux-2.6.19.7-vs2.2.0/include/linux/vs_network.h	2007-04-01 04:19:33 +0200
+++ linux-2.6.19.7-vs2.2.0-z1/include/linux/vs_network.h	2007-04-24 04:24:23 +0200
@@ -178,6 +176,12 @@ static inline void exit_nx_info(struct t
 }
 
 
+#ifdef CONFIG_NETWORK_SECMARK
+#define skb_tag secmark
+#else
+#define skb_tag nfmark
+#endif
+
 #else
 #warning duplicate inclusion
 #endif
diff -NurpPbB --minimal linux-2.6.19.7-vs2.2.0/include/linux/vserver/base.h linux-2.6.19.7-vs2.2.0-z1/include/linux/vserver/base.h
--- linux-2.6.19.7-vs2.2.0/include/linux/vserver/base.h	2007-04-01 04:19:33 +0200
+++ linux-2.6.19.7-vs2.2.0-z1/include/linux/vserver/base.h	2007-04-24 05:14:39 +0200
@@ -219,6 +219,9 @@ static inline int __vs_check(int cid, in
 #define vx_capable(b,c) (capable(b) || \
 	(cap_raised(current->cap_effective,b) && vx_ccaps(c)))
 
+#define nx_capable(b,c) (capable(b) || \
+	(cap_raised(current->cap_effective,b) && nx_ncaps(c)))
+
 
 #define vx_current_initpid(n) \
 	(current->vx_info && \
diff -NurpPbB --minimal linux-2.6.19.7-vs2.2.0/include/linux/vserver/network.h linux-2.6.19.7-vs2.2.0-z1/include/linux/vserver/network.h
--- linux-2.6.19.7-vs2.2.0/include/linux/vserver/network.h	2007-04-01 04:19:35 +0200
+++ linux-2.6.19.7-vs2.2.0-z1/include/linux/vserver/network.h	2007-04-24 05:51:53 +0200
@@ -26,6 +26,13 @@
 #define NXF_INIT_SET		(NXF_STATE_ADMIN)
 
 
+/* network caps */
+
+#define NXC_RAW_ICMP		0x00000100
+#define NXC_RAW_SOCKET		0x00000200
+#define NXC_RAW_SEND		0x00000400
+
+
 /* address types */
 
 #define NXA_TYPE_IPV4		1
diff -NurpPbB --minimal linux-2.6.19.7-vs2.2.0/include/net/raw.h linux-2.6.19.7-vs2.2.0-z1/include/net/raw.h
--- linux-2.6.19.7-vs2.2.0/include/net/raw.h	2006-09-20 16:58:44 +0200
+++ linux-2.6.19.7-vs2.2.0-z1/include/net/raw.h	2007-04-24 03:50:47 +0200
@@ -36,7 +36,7 @@ extern rwlock_t raw_v4_lock;
 
 extern struct sock *__raw_v4_lookup(struct sock *sk, unsigned short num,
 				    __be32 raddr, __be32 laddr,
-				    int dif);
+				    int dif, int tag);
 
 extern int raw_v4_input(struct sk_buff *skb, struct iphdr *iph, int hash);
 
diff -NurpPbB --minimal linux-2.6.19.7-vs2.2.0/net/core/sock.c linux-2.6.19.7-vs2.2.0-z1/net/core/sock.c
--- linux-2.6.19.7-vs2.2.0/net/core/sock.c	2007-04-01 04:19:35 +0200
+++ linux-2.6.19.7-vs2.2.0-z1/net/core/sock.c	2007-04-24 05:53:04 +0200
@@ -549,7 +549,7 @@ set_rcvbuf:
 			char devname[IFNAMSIZ]; 
 
 			/* Sorry... */ 
-			if (!capable(CAP_NET_RAW)) {
+			if (!nx_capable(CAP_NET_RAW, NXC_RAW_SOCKET)) {
 				ret = -EPERM;
 				break;
 			}
diff -NurpPbB --minimal linux-2.6.19.7-vs2.2.0/net/ipv4/icmp.c linux-2.6.19.7-vs2.2.0-z1/net/ipv4/icmp.c
--- linux-2.6.19.7-vs2.2.0/net/ipv4/icmp.c	2006-11-30 21:19:45 +0100
+++ linux-2.6.19.7-vs2.2.0-z1/net/ipv4/icmp.c	2007-04-24 05:33:25 +0200
@@ -701,8 +701,8 @@ static void icmp_unreach(struct sk_buff 
 	read_lock(&raw_v4_lock);
 	if ((raw_sk = sk_head(&raw_v4_htable[hash])) != NULL) {
 		while ((raw_sk = __raw_v4_lookup(raw_sk, protocol, iph->daddr,
-						 iph->saddr,
-						 skb->dev->ifindex)) != NULL) {
+						 iph->saddr, skb->dev->ifindex,
+						 skb->skb_tag)) != NULL) {
 			raw_err(raw_sk, skb, info);
 			raw_sk = sk_next(raw_sk);
 			iph = (struct iphdr *)skb->data;
diff -NurpPbB --minimal linux-2.6.19.7-vs2.2.0/net/ipv4/ip_options.c linux-2.6.19.7-vs2.2.0-z1/net/ipv4/ip_options.c
--- linux-2.6.19.7-vs2.2.0/net/ipv4/ip_options.c	2006-11-30 21:19:45 +0100
+++ linux-2.6.19.7-vs2.2.0-z1/net/ipv4/ip_options.c	2007-04-24 05:56:57 +0200
@@ -407,7 +407,7 @@ int ip_options_compile(struct ip_options
 					optptr[2] += 8;
 					break;
 				      default:
-					if (!skb && !capable(CAP_NET_RAW)) {
+					if (!skb && !nx_capable(CAP_NET_RAW, NXC_RAW_SOCKET)) {
 						pp_ptr = optptr + 3;
 						goto error;
 					}
@@ -443,7 +443,7 @@ int ip_options_compile(struct ip_options
 				opt->router_alert = optptr - iph;
 			break;
 		      case IPOPT_CIPSO:
-			if ((!skb && !capable(CAP_NET_RAW)) || opt->cipso) {
+			if ((!skb && !nx_capable(CAP_NET_RAW, NXC_RAW_SOCKET)) || opt->cipso) {
 				pp_ptr = optptr;
 				goto error;
 			}
@@ -456,7 +456,7 @@ int ip_options_compile(struct ip_options
 		      case IPOPT_SEC:
 		      case IPOPT_SID:
 		      default:
-			if (!skb && !capable(CAP_NET_RAW)) {
+			if (!skb && !nx_capable(CAP_NET_RAW, NXC_RAW_SOCKET)) {
 				pp_ptr = optptr;
 				goto error;
 			}
diff -NurpPbB --minimal linux-2.6.19.7-vs2.2.0/net/ipv4/raw.c linux-2.6.19.7-vs2.2.0-z1/net/ipv4/raw.c
--- linux-2.6.19.7-vs2.2.0/net/ipv4/raw.c	2007-04-01 04:19:48 +0200
+++ linux-2.6.19.7-vs2.2.0-z1/net/ipv4/raw.c	2007-04-24 05:57:54 +0200
@@ -113,8 +113,11 @@ static inline int raw_addr_match (
 	struct nx_info *nxi,
 	uint32_t addr,
 	uint32_t saddr,
-	uint32_t baddr)
+	uint32_t baddr,
+	uint32_t tag)
 {
+	if (nxi && !((tag == 1) || (nxi->nx_id == tag)))
+		return 0;
 	if (addr && (saddr == addr || baddr == addr))
 		return 1;
 	if (!saddr)
@@ -124,7 +127,7 @@ static inline int raw_addr_match (
 
 struct sock *__raw_v4_lookup(struct sock *sk, unsigned short num,
 			     __be32 raddr, __be32 laddr,
-			     int dif)
+			     int dif, int tag)
 {
 	struct hlist_node *node;
 
@@ -134,7 +137,7 @@ struct sock *__raw_v4_lookup(struct sock
 		if (inet->num == num 					&&
 		    !(inet->daddr && inet->daddr != raddr) 		&&
 		    raw_addr_match(sk->sk_nx_info, laddr,
-			inet->rcv_saddr, inet->rcv_saddr2)		&&
+			inet->rcv_saddr, inet->rcv_saddr2, tag)		&&
 		    !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
 			goto found; /* gotcha */
 	}
@@ -183,7 +186,7 @@ int raw_v4_input(struct sk_buff *skb, st
 		goto out;
 	sk = __raw_v4_lookup(__sk_head(head), iph->protocol,
 			     iph->saddr, iph->daddr,
-			     skb->dev->ifindex);
+			     skb->dev->ifindex, skb->skb_tag);
 
 	while (sk) {
 		delivered = 1;
@@ -196,7 +199,7 @@ int raw_v4_input(struct sk_buff *skb, st
 		}
 		sk = __raw_v4_lookup(sk_next(sk), iph->protocol,
 				     iph->saddr, iph->daddr,
-				     skb->dev->ifindex);
+				     skb->dev->ifindex, skb->skb_tag);
 	}
 out:
 	read_unlock(&raw_v4_lock);
@@ -335,7 +338,7 @@ static int raw_send_hdrinc(struct sock *
 	}
 
 	err = -EPERM;
-	if (!nx_check(0, VS_ADMIN) && !capable(CAP_NET_RAW)
+	if (!nx_check(0, VS_ADMIN) && !nx_capable(CAP_NET_RAW, NXC_RAW_SOCKET)
 		&& (!addr_in_nx_info(sk->sk_nx_info, iph->saddr)))
 		goto error_free;
 
diff -NurpPbB --minimal linux-2.6.19.7-vs2.2.0/net/packet/af_packet.c linux-2.6.19.7-vs2.2.0-z1/net/packet/af_packet.c
--- linux-2.6.19.7-vs2.2.0/net/packet/af_packet.c	2007-02-06 02:42:31 +0100
+++ linux-2.6.19.7-vs2.2.0-z1/net/packet/af_packet.c	2007-04-24 06:06:46 +0200
@@ -77,6 +77,7 @@
 #include <linux/poll.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/vs_network.h>
 
 #ifdef CONFIG_INET
 #include <net/inet_common.h>
@@ -985,7 +986,7 @@ static int packet_create(struct socket *
 	struct packet_sock *po;
 	int err;
 
-	if (!capable(CAP_NET_RAW))
+	if (!nx_capable(CAP_NET_RAW, NXC_RAW_SEND))
 		return -EPERM;
 	if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW
 #ifdef CONFIG_SOCK_PACKET
