[gentoo-commits] proj/hardened-patchset:rsbac commit in: 3.1.5/, 3.0.8/

[Anthony G. Basile]

commit:     e05eddec51d22c65f66a5fbd829c3f2af91db509
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 21 21:10:17 2011 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Dec 21 21:10:17 2011 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=e05eddec

RSBAC: bump to patch-linux-3.1.5-rsbac-1.4.6.diff

---
 3.0.8/0000_README                                  |   56 -
 3.0.8/1007_linux-3.0.8.patch                       | 1472 ---------------
 3.1.5/0000_README                                  |    8 +
 .../4500_patch-linux-3.1.5-rsbac-1.4.6.diff        | 1933 +++++++++++---------
 4 files changed, 1078 insertions(+), 2391 deletions(-)

diff --git a/3.0.8/0000_README b/3.0.8/0000_README
deleted file mode 100644
index 9cfe0c0..0000000
--- a/3.0.8/0000_README
+++ /dev/null
@@ -1,56 +0,0 @@
-README
------------------------------------------------------------------------------
-
-Individual Patch Descriptions:
------------------------------------------------------------------------------
-Patch:	1007_linux-3.0.8.patch
-From:	http://www.kernel.org
-Desc:	Linux 3.0.8
-
-Patch:	4420_grsecurity-2.2.2-3.0.8-201110250925.patch
-From:	http://www.grsecurity.net
-Desc:	hardened-sources base patch from upstream grsecurity
-
-Patch:	4421_grsec-remove-localversion-grsec.patch
-From:	Kerin Millar <kerframil@×××××.com>
-Desc:	Removes grsecurity's localversion-grsec file
-
-Patch:	4422_grsec-mute-warnings.patch
-From:	Alexander Gabert <gaberta@××××××××.de>
-	Gordon Malm <gengor@g.o>
-Desc:	Removes verbose compile warning settings from grsecurity, restores
-	mainline Linux kernel behavior
-
-Patch:	4423_grsec-remove-protected-paths.patch
-From:	Anthony G. Basile <blueness@g.o>
-Desc:	Removes chmod statements from grsecurity/Makefile
-
-Patch:	4425_grsec-pax-without-grsec.patch
-From:	Gordon Malm <gengor@g.o>
-Desc:	Allows PaX features to be selected without enabling GRKERNSEC
-
-Patch:	4430_grsec-kconfig-default-gids.patch
-From:	Kerin Millar <kerframil@×××××.com>
-Desc:	Sets sane(r) default GIDs on various grsecurity group-dependent
-	features
-
-Patch:	4435_grsec-kconfig-gentoo.patch
-From:	Gordon Malm <gengor@g.o>
-	Kerin Millar <kerframil@×××××.com>
-	Anthony G. Basile <blueness@g.o>
-Desc:	Adds Hardened Gentoo [server/workstation/virtualization] security levels,
-	sets Hardened Gentoo [workstation] as default
-
-Patch:	4440_selinux-avc_audit-log-curr_ip.patch
-From:	Gordon Malm <gengor@g.o>
-	Anthony G. Basile <blueness@g.o>
-Desc:	Configurable option to add src IP address to SELinux log messages
-
-Patch:	4445_disable-compat_vdso.patch
-From:	Gordon Malm <gengor@g.o>
-	Kerin Millar <kerframil@×××××.com>
-Desc:	Disables VDSO_COMPAT operation completely
-
-Patch:	4500_rsbac.patch
-From:	Amon Ott <ao@×××××.org>
-Desc:	RSBAC patch from http://www.rsbac.org/

diff --git a/3.0.8/1007_linux-3.0.8.patch b/3.0.8/1007_linux-3.0.8.patch
deleted file mode 100644
index 62a4bb6..0000000
--- a/3.0.8/1007_linux-3.0.8.patch
+++ /dev/null
@@ -1,1472 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 11c4249..9f6e3cd 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 0
--SUBLEVEL = 7
-+SUBLEVEL = 8
- EXTRAVERSION =
- NAME = Sneaky Weasel
- 
-diff --git a/arch/arm/kernel/perf_event_v7.c b/arch/arm/kernel/perf_event_v7.c
-index 4960686..4372763 100644
---- a/arch/arm/kernel/perf_event_v7.c
-+++ b/arch/arm/kernel/perf_event_v7.c
-@@ -264,8 +264,8 @@ static const unsigned armv7_a9_perf_map[PERF_COUNT_HW_MAX] = {
- 	[PERF_COUNT_HW_CPU_CYCLES]	    = ARMV7_PERFCTR_CPU_CYCLES,
- 	[PERF_COUNT_HW_INSTRUCTIONS]	    =
- 					ARMV7_PERFCTR_INST_OUT_OF_RENAME_STAGE,
--	[PERF_COUNT_HW_CACHE_REFERENCES]    = ARMV7_PERFCTR_COHERENT_LINE_HIT,
--	[PERF_COUNT_HW_CACHE_MISSES]	    = ARMV7_PERFCTR_COHERENT_LINE_MISS,
-+	[PERF_COUNT_HW_CACHE_REFERENCES]    = ARMV7_PERFCTR_DCACHE_ACCESS,
-+	[PERF_COUNT_HW_CACHE_MISSES]	    = ARMV7_PERFCTR_DCACHE_REFILL,
- 	[PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = ARMV7_PERFCTR_PC_WRITE,
- 	[PERF_COUNT_HW_BRANCH_MISSES]	    = ARMV7_PERFCTR_PC_BRANCH_MIS_PRED,
- 	[PERF_COUNT_HW_BUS_CYCLES]	    = ARMV7_PERFCTR_CLOCK_CYCLES,
-diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
-index c19571c..4a4eba5 100644
---- a/arch/arm/mm/init.c
-+++ b/arch/arm/mm/init.c
-@@ -473,6 +473,13 @@ static void __init free_unused_memmap(struct meminfo *mi)
- 		 */
- 		bank_start = min(bank_start,
- 				 ALIGN(prev_bank_end, PAGES_PER_SECTION));
-+#else
-+		/*
-+		 * Align down here since the VM subsystem insists that the
-+		 * memmap entries are valid from the bank start aligned to
-+		 * MAX_ORDER_NR_PAGES.
-+		 */
-+		bank_start = round_down(bank_start, MAX_ORDER_NR_PAGES);
- #endif
- 		/*
- 		 * If we had a previous bank, and there is a space
-diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 3032644..87488b9 100644
---- a/arch/x86/mm/init.c
-+++ b/arch/x86/mm/init.c
-@@ -63,9 +63,8 @@ static void __init find_early_table_space(unsigned long end, int use_pse,
- #ifdef CONFIG_X86_32
- 	/* for fixmap */
- 	tables += roundup(__end_of_fixed_addresses * sizeof(pte_t), PAGE_SIZE);
--
--	good_end = max_pfn_mapped << PAGE_SHIFT;
- #endif
-+	good_end = max_pfn_mapped << PAGE_SHIFT;
- 
- 	base = memblock_find_in_range(start, good_end, tables, PAGE_SIZE);
- 	if (base == MEMBLOCK_ERROR)
-diff --git a/crypto/ghash-generic.c b/crypto/ghash-generic.c
-index be44256..7835b8f 100644
---- a/crypto/ghash-generic.c
-+++ b/crypto/ghash-generic.c
-@@ -67,6 +67,9 @@ static int ghash_update(struct shash_desc *desc,
- 	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
- 	u8 *dst = dctx->buffer;
- 
-+	if (!ctx->gf128)
-+		return -ENOKEY;
-+
- 	if (dctx->bytes) {
- 		int n = min(srclen, dctx->bytes);
- 		u8 *pos = dst + (GHASH_BLOCK_SIZE - dctx->bytes);
-@@ -119,6 +122,9 @@ static int ghash_final(struct shash_desc *desc, u8 *dst)
- 	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
- 	u8 *buf = dctx->buffer;
- 
-+	if (!ctx->gf128)
-+		return -ENOKEY;
-+
- 	ghash_flush(ctx, dctx);
- 	memcpy(dst, buf, GHASH_BLOCK_SIZE);
- 
-diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
-index 41841a3..17cef86 100644
---- a/drivers/firewire/sbp2.c
-+++ b/drivers/firewire/sbp2.c
-@@ -1198,6 +1198,10 @@ static int sbp2_remove(struct device *dev)
- {
- 	struct fw_unit *unit = fw_unit(dev);
- 	struct sbp2_target *tgt = dev_get_drvdata(&unit->device);
-+	struct sbp2_logical_unit *lu;
-+
-+	list_for_each_entry(lu, &tgt->lu_list, link)
-+		cancel_delayed_work_sync(&lu->work);
- 
- 	sbp2_target_put(tgt);
- 	return 0;
-diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
-index ebdb0fd..9a0aee2 100644
---- a/drivers/gpu/drm/radeon/atom.c
-+++ b/drivers/gpu/drm/radeon/atom.c
-@@ -277,7 +277,12 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,
- 	case ATOM_ARG_FB:
- 		idx = U8(*ptr);
- 		(*ptr)++;
--		val = gctx->scratch[((gctx->fb_base + idx) / 4)];
-+		if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
-+			DRM_ERROR("ATOM: fb read beyond scratch region: %d vs. %d\n",
-+				  gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
-+			val = 0;
-+		} else
-+			val = gctx->scratch[(gctx->fb_base / 4) + idx];
- 		if (print)
- 			DEBUG("FB[0x%02X]", idx);
- 		break;
-@@ -531,7 +536,11 @@ static void atom_put_dst(atom_exec_context *ctx, int arg, uint8_t attr,
- 	case ATOM_ARG_FB:
- 		idx = U8(*ptr);
- 		(*ptr)++;
--		gctx->scratch[((gctx->fb_base + idx) / 4)] = val;
-+		if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
-+			DRM_ERROR("ATOM: fb write beyond scratch region: %d vs. %d\n",
-+				  gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
-+		} else
-+			gctx->scratch[(gctx->fb_base / 4) + idx] = val;
- 		DEBUG("FB[0x%02X]", idx);
- 		break;
- 	case ATOM_ARG_PLL:
-@@ -1367,11 +1376,13 @@ int atom_allocate_fb_scratch(struct atom_context *ctx)
- 
- 		usage_bytes = firmware_usage->asFirmwareVramReserveInfo[0].usFirmwareUseInKb * 1024;
- 	}
-+	ctx->scratch_size_bytes = 0;
- 	if (usage_bytes == 0)
- 		usage_bytes = 20 * 1024;
- 	/* allocate some scratch memory */
- 	ctx->scratch = kzalloc(usage_bytes, GFP_KERNEL);
- 	if (!ctx->scratch)
- 		return -ENOMEM;
-+	ctx->scratch_size_bytes = usage_bytes;
- 	return 0;
- }
-diff --git a/drivers/gpu/drm/radeon/atom.h b/drivers/gpu/drm/radeon/atom.h
-index a589a55..93cfe20 100644
---- a/drivers/gpu/drm/radeon/atom.h
-+++ b/drivers/gpu/drm/radeon/atom.h
-@@ -137,6 +137,7 @@ struct atom_context {
- 	int cs_equal, cs_above;
- 	int io_mode;
- 	uint32_t *scratch;
-+	int scratch_size_bytes;
- };
- 
- extern int atom_debug;
-diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
-index b7f0726..e2b2d78 100644
---- a/drivers/gpu/drm/ttm/ttm_bo.c
-+++ b/drivers/gpu/drm/ttm/ttm_bo.c
-@@ -392,10 +392,12 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
- 	 * Create and bind a ttm if required.
- 	 */
- 
--	if (!(new_man->flags & TTM_MEMTYPE_FLAG_FIXED) && (bo->ttm == NULL)) {
--		ret = ttm_bo_add_ttm(bo, false);
--		if (ret)
--			goto out_err;
-+	if (!(new_man->flags & TTM_MEMTYPE_FLAG_FIXED)) {
-+		if (bo->ttm == NULL) {
-+			ret = ttm_bo_add_ttm(bo, false);
-+			if (ret)
-+				goto out_err;
-+		}
- 
- 		ret = ttm_tt_set_placement_caching(bo->ttm, mem->placement);
- 		if (ret)
-diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
-index 77dbf40..ae3c6f5 100644
---- a/drivers/gpu/drm/ttm/ttm_bo_util.c
-+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
-@@ -635,13 +635,13 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
- 		if (ret)
- 			return ret;
- 
--		ttm_bo_free_old_node(bo);
- 		if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) &&
- 		    (bo->ttm != NULL)) {
- 			ttm_tt_unbind(bo->ttm);
- 			ttm_tt_destroy(bo->ttm);
- 			bo->ttm = NULL;
- 		}
-+		ttm_bo_free_old_node(bo);
- 	} else {
- 		/**
- 		 * This should help pipeline ordinary buffer moves.
-diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
-index a756ee6..c946d90 100644
---- a/drivers/hid/hid-ids.h
-+++ b/drivers/hid/hid-ids.h
-@@ -568,6 +568,9 @@
- #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE	0x0001
- #define USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE	0x0600
- 
-+#define USB_VENDOR_ID_SIGMA_MICRO	0x1c4f
-+#define USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD	0x0002
-+
- #define USB_VENDOR_ID_SKYCABLE			0x1223
- #define	USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER	0x3F07
- 
-diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
-index 0ec91c1..56d0539 100644
---- a/drivers/hid/hid-magicmouse.c
-+++ b/drivers/hid/hid-magicmouse.c
-@@ -501,9 +501,17 @@ static int magicmouse_probe(struct hid_device *hdev,
- 	}
- 	report->size = 6;
- 
-+	/*
-+	 * Some devices repond with 'invalid report id' when feature
-+	 * report switching it into multitouch mode is sent to it.
-+	 *
-+	 * This results in -EIO from the _raw low-level transport callback,
-+	 * but there seems to be no other way of switching the mode.
-+	 * Thus the super-ugly hacky success check below.
-+	 */
- 	ret = hdev->hid_output_raw_report(hdev, feature, sizeof(feature),
- 			HID_FEATURE_REPORT);
--	if (ret != sizeof(feature)) {
-+	if (ret != -EIO && ret != sizeof(feature)) {
- 		hid_err(hdev, "unable to request touch data (%d)\n", ret);
- 		goto err_stop_hw;
- 	}
-diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
-index 621959d..4bdb5d4 100644
---- a/drivers/hid/usbhid/hid-quirks.c
-+++ b/drivers/hid/usbhid/hid-quirks.c
-@@ -89,6 +89,7 @@ static const struct hid_blacklist {
- 
- 	{ USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH, HID_QUIRK_MULTI_INPUT },
- 	{ USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS, HID_QUIRK_MULTI_INPUT },
-+	{ USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
- 	{ 0, 0 }
- };
- 
-diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
-index f2b377c..36d7f27 100644
---- a/drivers/hwmon/w83627ehf.c
-+++ b/drivers/hwmon/w83627ehf.c
-@@ -390,7 +390,7 @@ temp_from_reg(u16 reg, s16 regval)
- {
- 	if (is_word_sized(reg))
- 		return LM75_TEMP_FROM_REG(regval);
--	return regval * 1000;
-+	return ((s8)regval) * 1000;
- }
- 
- static inline u16
-@@ -398,7 +398,8 @@ temp_to_reg(u16 reg, long temp)
- {
- 	if (is_word_sized(reg))
- 		return LM75_TEMP_TO_REG(temp);
--	return DIV_ROUND_CLOSEST(SENSORS_LIMIT(temp, -127000, 128000), 1000);
-+	return (s8)DIV_ROUND_CLOSEST(SENSORS_LIMIT(temp, -127000, 128000),
-+				     1000);
- }
- 
- /* Some of analog inputs have internal scaling (2x), 8mV is ADC LSB */
-@@ -1715,7 +1716,8 @@ static void w83627ehf_device_remove_files(struct device *dev)
- }
- 
- /* Get the monitoring functions started */
--static inline void __devinit w83627ehf_init_device(struct w83627ehf_data *data)
-+static inline void __devinit w83627ehf_init_device(struct w83627ehf_data *data,
-+						   enum kinds kind)
- {
- 	int i;
- 	u8 tmp, diode;
-@@ -1746,10 +1748,16 @@ static inline void __devinit w83627ehf_init_device(struct w83627ehf_data *data)
- 		w83627ehf_write_value(data, W83627EHF_REG_VBAT, tmp | 0x01);
- 
- 	/* Get thermal sensor types */
--	diode = w83627ehf_read_value(data, W83627EHF_REG_DIODE);
-+	switch (kind) {
-+	case w83627ehf:
-+		diode = w83627ehf_read_value(data, W83627EHF_REG_DIODE);
-+		break;
-+	default:
-+		diode = 0x70;
-+	}
- 	for (i = 0; i < 3; i++) {
- 		if ((tmp & (0x02 << i)))
--			data->temp_type[i] = (diode & (0x10 << i)) ? 1 : 2;
-+			data->temp_type[i] = (diode & (0x10 << i)) ? 1 : 3;
- 		else
- 			data->temp_type[i] = 4; /* thermistor */
- 	}
-@@ -2016,7 +2024,7 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev)
- 	}
- 
- 	/* Initialize the chip */
--	w83627ehf_init_device(data);
-+	w83627ehf_init_device(data, sio_data->kind);
- 
- 	data->vrm = vid_which_vrm();
- 	superio_enter(sio_data->sioreg);
-diff --git a/drivers/media/video/uvc/uvc_entity.c b/drivers/media/video/uvc/uvc_entity.c
-index 48fea37..29e2399 100644
---- a/drivers/media/video/uvc/uvc_entity.c
-+++ b/drivers/media/video/uvc/uvc_entity.c
-@@ -49,7 +49,7 @@ static int uvc_mc_register_entity(struct uvc_video_chain *chain,
- 		if (remote == NULL)
- 			return -EINVAL;
- 
--		source = (UVC_ENTITY_TYPE(remote) != UVC_TT_STREAMING)
-+		source = (UVC_ENTITY_TYPE(remote) == UVC_TT_STREAMING)
- 		       ? (remote->vdev ? &remote->vdev->entity : NULL)
- 		       : &remote->subdev.entity;
- 		if (source == NULL)
-diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
-index d347116..1658575 100644
---- a/drivers/platform/x86/samsung-laptop.c
-+++ b/drivers/platform/x86/samsung-laptop.c
-@@ -601,6 +601,16 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
- 		.callback = dmi_check_cb,
- 	},
- 	{
-+		.ident = "N150/N210/N220",
-+		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR,
-+					"SAMSUNG ELECTRONICS CO., LTD."),
-+			DMI_MATCH(DMI_PRODUCT_NAME, "N150/N210/N220"),
-+			DMI_MATCH(DMI_BOARD_NAME, "N150/N210/N220"),
-+		},
-+		.callback = dmi_check_cb,
-+	},
-+	{
- 		.ident = "N150/N210/N220/N230",
- 		.matches = {
- 			DMI_MATCH(DMI_SYS_VENDOR,
-diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
-index fc7e57b..53e7d72 100644
---- a/fs/cifs/cifsfs.c
-+++ b/fs/cifs/cifsfs.c
-@@ -566,6 +566,12 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
- 		struct inode *dir = dentry->d_inode;
- 		struct dentry *child;
- 
-+		if (!dir) {
-+			dput(dentry);
-+			dentry = ERR_PTR(-ENOENT);
-+			break;
-+		}
-+
- 		/* skip separators */
- 		while (*s == sep)
- 			s++;
-@@ -581,10 +587,6 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
- 		mutex_unlock(&dir->i_mutex);
- 		dput(dentry);
- 		dentry = child;
--		if (!dentry->d_inode) {
--			dput(dentry);
--			dentry = ERR_PTR(-ENOENT);
--		}
- 	} while (!IS_ERR(dentry));
- 	_FreeXid(xid);
- 	kfree(full_path);
-diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
-index 168a80f..5cb8614 100644
---- a/fs/fuse/dev.c
-+++ b/fs/fuse/dev.c
-@@ -258,10 +258,14 @@ void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget,
- 	forget->forget_one.nlookup = nlookup;
- 
- 	spin_lock(&fc->lock);
--	fc->forget_list_tail->next = forget;
--	fc->forget_list_tail = forget;
--	wake_up(&fc->waitq);
--	kill_fasync(&fc->fasync, SIGIO, POLL_IN);
-+	if (fc->connected) {
-+		fc->forget_list_tail->next = forget;
-+		fc->forget_list_tail = forget;
-+		wake_up(&fc->waitq);
-+		kill_fasync(&fc->fasync, SIGIO, POLL_IN);
-+	} else {
-+		kfree(forget);
-+	}
- 	spin_unlock(&fc->lock);
- }
- 
-diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
-index d685752..4e7f64b 100644
---- a/fs/hfsplus/hfsplus_fs.h
-+++ b/fs/hfsplus/hfsplus_fs.h
-@@ -13,6 +13,7 @@
- #include <linux/fs.h>
- #include <linux/mutex.h>
- #include <linux/buffer_head.h>
-+#include <linux/blkdev.h>
- #include "hfsplus_raw.h"
- 
- #define DBG_BNODE_REFS	0x00000001
-@@ -110,7 +111,9 @@ struct hfsplus_vh;
- struct hfs_btree;
- 
- struct hfsplus_sb_info {
-+	void *s_vhdr_buf;
- 	struct hfsplus_vh *s_vhdr;
-+	void *s_backup_vhdr_buf;
- 	struct hfsplus_vh *s_backup_vhdr;
- 	struct hfs_btree *ext_tree;
- 	struct hfs_btree *cat_tree;
-@@ -258,6 +261,15 @@ struct hfsplus_readdir_data {
- 	struct hfsplus_cat_key key;
- };
- 
-+/*
-+ * Find minimum acceptible I/O size for an hfsplus sb.
-+ */
-+static inline unsigned short hfsplus_min_io_size(struct super_block *sb)
-+{
-+	return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev),
-+		     HFSPLUS_SECTOR_SIZE);
-+}
-+
- #define hfs_btree_open hfsplus_btree_open
- #define hfs_btree_close hfsplus_btree_close
- #define hfs_btree_write hfsplus_btree_write
-@@ -436,8 +448,8 @@ int hfsplus_compare_dentry(const struct dentry *parent,
- /* wrapper.c */
- int hfsplus_read_wrapper(struct super_block *);
- int hfs_part_find(struct super_block *, sector_t *, sector_t *);
--int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
--		void *data, int rw);
-+int hfsplus_submit_bio(struct super_block *sb, sector_t sector,
-+		void *buf, void **data, int rw);
- 
- /* time macros */
- #define __hfsp_mt2ut(t)		(be32_to_cpu(t) - 2082844800U)
-diff --git a/fs/hfsplus/part_tbl.c b/fs/hfsplus/part_tbl.c
-index 40ad88c..eb355d8 100644
---- a/fs/hfsplus/part_tbl.c
-+++ b/fs/hfsplus/part_tbl.c
-@@ -88,11 +88,12 @@ static int hfs_parse_old_pmap(struct super_block *sb, struct old_pmap *pm,
- 	return -ENOENT;
- }
- 
--static int hfs_parse_new_pmap(struct super_block *sb, struct new_pmap *pm,
--		sector_t *part_start, sector_t *part_size)
-+static int hfs_parse_new_pmap(struct super_block *sb, void *buf,
-+		struct new_pmap *pm, sector_t *part_start, sector_t *part_size)
- {
- 	struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
- 	int size = be32_to_cpu(pm->pmMapBlkCnt);
-+	int buf_size = hfsplus_min_io_size(sb);
- 	int res;
- 	int i = 0;
- 
-@@ -107,11 +108,14 @@ static int hfs_parse_new_pmap(struct super_block *sb, struct new_pmap *pm,
- 		if (++i >= size)
- 			return -ENOENT;
- 
--		res = hfsplus_submit_bio(sb->s_bdev,
--					 *part_start + HFS_PMAP_BLK + i,
--					 pm, READ);
--		if (res)
--			return res;
-+		pm = (struct new_pmap *)((u8 *)pm + HFSPLUS_SECTOR_SIZE);
-+		if ((u8 *)pm - (u8 *)buf >= buf_size) {
-+			res = hfsplus_submit_bio(sb,
-+						 *part_start + HFS_PMAP_BLK + i,
-+						 buf, (void **)&pm, READ);
-+			if (res)
-+				return res;
-+		}
- 	} while (pm->pmSig == cpu_to_be16(HFS_NEW_PMAP_MAGIC));
- 
- 	return -ENOENT;
-@@ -124,15 +128,15 @@ static int hfs_parse_new_pmap(struct super_block *sb, struct new_pmap *pm,
- int hfs_part_find(struct super_block *sb,
- 		sector_t *part_start, sector_t *part_size)
- {
--	void *data;
-+	void *buf, *data;
- 	int res;
- 
--	data = kmalloc(HFSPLUS_SECTOR_SIZE, GFP_KERNEL);
--	if (!data)
-+	buf = kmalloc(hfsplus_min_io_size(sb), GFP_KERNEL);
-+	if (!buf)
- 		return -ENOMEM;
- 
--	res = hfsplus_submit_bio(sb->s_bdev, *part_start + HFS_PMAP_BLK,
--				 data, READ);
-+	res = hfsplus_submit_bio(sb, *part_start + HFS_PMAP_BLK,
-+				 buf, &data, READ);
- 	if (res)
- 		goto out;
- 
-@@ -141,13 +145,13 @@ int hfs_part_find(struct super_block *sb,
- 		res = hfs_parse_old_pmap(sb, data, part_start, part_size);
- 		break;
- 	case HFS_NEW_PMAP_MAGIC:
--		res = hfs_parse_new_pmap(sb, data, part_start, part_size);
-+		res = hfs_parse_new_pmap(sb, buf, data, part_start, part_size);
- 		break;
- 	default:
- 		res = -ENOENT;
- 		break;
- 	}
- out:
--	kfree(data);
-+	kfree(buf);
- 	return res;
- }
-diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
-index 84a47b7..c3a76fd 100644
---- a/fs/hfsplus/super.c
-+++ b/fs/hfsplus/super.c
-@@ -197,17 +197,17 @@ int hfsplus_sync_fs(struct super_block *sb, int wait)
- 		write_backup = 1;
- 	}
- 
--	error2 = hfsplus_submit_bio(sb->s_bdev,
-+	error2 = hfsplus_submit_bio(sb,
- 				   sbi->part_start + HFSPLUS_VOLHEAD_SECTOR,
--				   sbi->s_vhdr, WRITE_SYNC);
-+				   sbi->s_vhdr_buf, NULL, WRITE_SYNC);
- 	if (!error)
- 		error = error2;
- 	if (!write_backup)
- 		goto out;
- 
--	error2 = hfsplus_submit_bio(sb->s_bdev,
-+	error2 = hfsplus_submit_bio(sb,
- 				  sbi->part_start + sbi->sect_count - 2,
--				  sbi->s_backup_vhdr, WRITE_SYNC);
-+				  sbi->s_backup_vhdr_buf, NULL, WRITE_SYNC);
- 	if (!error)
- 		error2 = error;
- out:
-@@ -251,8 +251,8 @@ static void hfsplus_put_super(struct super_block *sb)
- 	hfs_btree_close(sbi->ext_tree);
- 	iput(sbi->alloc_file);
- 	iput(sbi->hidden_dir);
--	kfree(sbi->s_vhdr);
--	kfree(sbi->s_backup_vhdr);
-+	kfree(sbi->s_vhdr_buf);
-+	kfree(sbi->s_backup_vhdr_buf);
- 	unload_nls(sbi->nls);
- 	kfree(sb->s_fs_info);
- 	sb->s_fs_info = NULL;
-@@ -508,8 +508,8 @@ out_close_cat_tree:
- out_close_ext_tree:
- 	hfs_btree_close(sbi->ext_tree);
- out_free_vhdr:
--	kfree(sbi->s_vhdr);
--	kfree(sbi->s_backup_vhdr);
-+	kfree(sbi->s_vhdr_buf);
-+	kfree(sbi->s_backup_vhdr_buf);
- out_unload_nls:
- 	unload_nls(sbi->nls);
- 	unload_nls(nls);
-diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
-index 4ac88ff..7b8112d 100644
---- a/fs/hfsplus/wrapper.c
-+++ b/fs/hfsplus/wrapper.c
-@@ -31,25 +31,67 @@ static void hfsplus_end_io_sync(struct bio *bio, int err)
- 	complete(bio->bi_private);
- }
- 
--int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
--		void *data, int rw)
-+/*
-+ * hfsplus_submit_bio - Perfrom block I/O
-+ * @sb: super block of volume for I/O
-+ * @sector: block to read or write, for blocks of HFSPLUS_SECTOR_SIZE bytes
-+ * @buf: buffer for I/O
-+ * @data: output pointer for location of requested data
-+ * @rw: direction of I/O
-+ *
-+ * The unit of I/O is hfsplus_min_io_size(sb), which may be bigger than
-+ * HFSPLUS_SECTOR_SIZE, and @buf must be sized accordingly. On reads
-+ * @data will return a pointer to the start of the requested sector,
-+ * which may not be the same location as @buf.
-+ *
-+ * If @sector is not aligned to the bdev logical block size it will
-+ * be rounded down. For writes this means that @buf should contain data
-+ * that starts at the rounded-down address. As long as the data was
-+ * read using hfsplus_submit_bio() and the same buffer is used things
-+ * will work correctly.
-+ */
-+int hfsplus_submit_bio(struct super_block *sb, sector_t sector,
-+		void *buf, void **data, int rw)
- {
- 	DECLARE_COMPLETION_ONSTACK(wait);
- 	struct bio *bio;
- 	int ret = 0;
-+	unsigned int io_size;
-+	loff_t start;
-+	int offset;
-+
-+	/*
-+	 * Align sector to hardware sector size and find offset. We
-+	 * assume that io_size is a power of two, which _should_
-+	 * be true.
-+	 */
-+	io_size = hfsplus_min_io_size(sb);
-+	start = (loff_t)sector << HFSPLUS_SECTOR_SHIFT;
-+	offset = start & (io_size - 1);
-+	sector &= ~((io_size >> HFSPLUS_SECTOR_SHIFT) - 1);
- 
- 	bio = bio_alloc(GFP_NOIO, 1);
- 	bio->bi_sector = sector;
--	bio->bi_bdev = bdev;
-+	bio->bi_bdev = sb->s_bdev;
- 	bio->bi_end_io = hfsplus_end_io_sync;
- 	bio->bi_private = &wait;
- 
--	/*
--	 * We always submit one sector at a time, so bio_add_page must not fail.
--	 */
--	if (bio_add_page(bio, virt_to_page(data), HFSPLUS_SECTOR_SIZE,
--			 offset_in_page(data)) != HFSPLUS_SECTOR_SIZE)
--		BUG();
-+	if (!(rw & WRITE) && data)
-+		*data = (u8 *)buf + offset;
-+
-+	while (io_size > 0) {
-+		unsigned int page_offset = offset_in_page(buf);
-+		unsigned int len = min_t(unsigned int, PAGE_SIZE - page_offset,
-+					 io_size);
-+
-+		ret = bio_add_page(bio, virt_to_page(buf), len, page_offset);
-+		if (ret != len) {
-+			ret = -EIO;
-+			goto out;
-+		}
-+		io_size -= len;
-+		buf = (u8 *)buf + len;
-+	}
- 
- 	submit_bio(rw, bio);
- 	wait_for_completion(&wait);
-@@ -57,8 +99,9 @@ int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
- 	if (!bio_flagged(bio, BIO_UPTODATE))
- 		ret = -EIO;
- 
-+out:
- 	bio_put(bio);
--	return ret;
-+	return ret < 0 ? ret : 0;
- }
- 
- static int hfsplus_read_mdb(void *bufptr, struct hfsplus_wd *wd)
-@@ -147,17 +190,17 @@ int hfsplus_read_wrapper(struct super_block *sb)
- 	}
- 
- 	error = -ENOMEM;
--	sbi->s_vhdr = kmalloc(HFSPLUS_SECTOR_SIZE, GFP_KERNEL);
--	if (!sbi->s_vhdr)
-+	sbi->s_vhdr_buf = kmalloc(hfsplus_min_io_size(sb), GFP_KERNEL);
-+	if (!sbi->s_vhdr_buf)
- 		goto out;
--	sbi->s_backup_vhdr = kmalloc(HFSPLUS_SECTOR_SIZE, GFP_KERNEL);
--	if (!sbi->s_backup_vhdr)
-+	sbi->s_backup_vhdr_buf = kmalloc(hfsplus_min_io_size(sb), GFP_KERNEL);
-+	if (!sbi->s_backup_vhdr_buf)
- 		goto out_free_vhdr;
- 
- reread:
--	error = hfsplus_submit_bio(sb->s_bdev,
--				   part_start + HFSPLUS_VOLHEAD_SECTOR,
--				   sbi->s_vhdr, READ);
-+	error = hfsplus_submit_bio(sb, part_start + HFSPLUS_VOLHEAD_SECTOR,
-+				   sbi->s_vhdr_buf, (void **)&sbi->s_vhdr,
-+				   READ);
- 	if (error)
- 		goto out_free_backup_vhdr;
- 
-@@ -186,9 +229,9 @@ reread:
- 		goto reread;
- 	}
- 
--	error = hfsplus_submit_bio(sb->s_bdev,
--				   part_start + part_size - 2,
--				   sbi->s_backup_vhdr, READ);
-+	error = hfsplus_submit_bio(sb, part_start + part_size - 2,
-+				   sbi->s_backup_vhdr_buf,
-+				   (void **)&sbi->s_backup_vhdr, READ);
- 	if (error)
- 		goto out_free_backup_vhdr;
- 
-@@ -232,9 +275,9 @@ reread:
- 	return 0;
- 
- out_free_backup_vhdr:
--	kfree(sbi->s_backup_vhdr);
-+	kfree(sbi->s_backup_vhdr_buf);
- out_free_vhdr:
--	kfree(sbi->s_vhdr);
-+	kfree(sbi->s_vhdr_buf);
- out:
- 	return error;
- }
-diff --git a/fs/xfs/linux-2.6/xfs_linux.h b/fs/xfs/linux-2.6/xfs_linux.h
-index 8633521..8731516 100644
---- a/fs/xfs/linux-2.6/xfs_linux.h
-+++ b/fs/xfs/linux-2.6/xfs_linux.h
-@@ -70,6 +70,8 @@
- #include <linux/ctype.h>
- #include <linux/writeback.h>
- #include <linux/capability.h>
-+#include <linux/kthread.h>
-+#include <linux/freezer.h>
- #include <linux/list_sort.h>
- 
- #include <asm/page.h>
-diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
-index a1a881e..347cae9 100644
---- a/fs/xfs/linux-2.6/xfs_super.c
-+++ b/fs/xfs/linux-2.6/xfs_super.c
-@@ -1412,37 +1412,35 @@ xfs_fs_fill_super(
- 	sb->s_time_gran = 1;
- 	set_posix_acl_flag(sb);
- 
--	error = xfs_syncd_init(mp);
--	if (error)
--		goto out_filestream_unmount;
--
- 	xfs_inode_shrinker_register(mp);
- 
- 	error = xfs_mountfs(mp);
- 	if (error)
--		goto out_syncd_stop;
-+		goto out_filestream_unmount;
-+
-+	error = xfs_syncd_init(mp);
-+	if (error)
-+		goto out_unmount;
- 
- 	root = igrab(VFS_I(mp->m_rootip));
- 	if (!root) {
- 		error = ENOENT;
--		goto fail_unmount;
-+		goto out_syncd_stop;
- 	}
- 	if (is_bad_inode(root)) {
- 		error = EINVAL;
--		goto fail_vnrele;
-+		goto out_syncd_stop;
- 	}
- 	sb->s_root = d_alloc_root(root);
- 	if (!sb->s_root) {
- 		error = ENOMEM;
--		goto fail_vnrele;
-+		goto out_iput;
- 	}
- 
- 	return 0;
- 
-- out_syncd_stop:
--	xfs_inode_shrinker_unregister(mp);
--	xfs_syncd_stop(mp);
-  out_filestream_unmount:
-+	xfs_inode_shrinker_unregister(mp);
- 	xfs_filestream_unmount(mp);
-  out_free_sb:
- 	xfs_freesb(mp);
-@@ -1456,17 +1454,12 @@ xfs_fs_fill_super(
-  out:
- 	return -error;
- 
-- fail_vnrele:
--	if (sb->s_root) {
--		dput(sb->s_root);
--		sb->s_root = NULL;
--	} else {
--		iput(root);
--	}
--
-- fail_unmount:
--	xfs_inode_shrinker_unregister(mp);
-+ out_iput:
-+	iput(root);
-+ out_syncd_stop:
- 	xfs_syncd_stop(mp);
-+ out_unmount:
-+	xfs_inode_shrinker_unregister(mp);
- 
- 	/*
- 	 * Blow away any referenced inode in the filestreams cache.
-@@ -1667,24 +1660,13 @@ xfs_init_workqueues(void)
- 	 */
- 	xfs_syncd_wq = alloc_workqueue("xfssyncd", WQ_CPU_INTENSIVE, 8);
- 	if (!xfs_syncd_wq)
--		goto out;
--
--	xfs_ail_wq = alloc_workqueue("xfsail", WQ_CPU_INTENSIVE, 8);
--	if (!xfs_ail_wq)
--		goto out_destroy_syncd;
--
-+		return -ENOMEM;
- 	return 0;
--
--out_destroy_syncd:
--	destroy_workqueue(xfs_syncd_wq);
--out:
--	return -ENOMEM;
- }
- 
- STATIC void
- xfs_destroy_workqueues(void)
- {
--	destroy_workqueue(xfs_ail_wq);
- 	destroy_workqueue(xfs_syncd_wq);
- }
- 
-diff --git a/fs/xfs/quota/xfs_dquot_item.c b/fs/xfs/quota/xfs_dquot_item.c
-index 9e0e2fa..8126fc2 100644
---- a/fs/xfs/quota/xfs_dquot_item.c
-+++ b/fs/xfs/quota/xfs_dquot_item.c
-@@ -183,13 +183,14 @@ xfs_qm_dqunpin_wait(
-  * search the buffer cache can be a time consuming thing, and AIL lock is a
-  * spinlock.
-  */
--STATIC void
-+STATIC bool
- xfs_qm_dquot_logitem_pushbuf(
- 	struct xfs_log_item	*lip)
- {
- 	struct xfs_dq_logitem	*qlip = DQUOT_ITEM(lip);
- 	struct xfs_dquot	*dqp = qlip->qli_dquot;
- 	struct xfs_buf		*bp;
-+	bool			ret = true;
- 
- 	ASSERT(XFS_DQ_IS_LOCKED(dqp));
- 
-@@ -201,17 +202,20 @@ xfs_qm_dquot_logitem_pushbuf(
- 	if (completion_done(&dqp->q_flush) ||
- 	    !(lip->li_flags & XFS_LI_IN_AIL)) {
- 		xfs_dqunlock(dqp);
--		return;
-+		return true;
- 	}
- 
- 	bp = xfs_incore(dqp->q_mount->m_ddev_targp, qlip->qli_format.qlf_blkno,
- 			dqp->q_mount->m_quotainfo->qi_dqchunklen, XBF_TRYLOCK);
- 	xfs_dqunlock(dqp);
- 	if (!bp)
--		return;
-+		return true;
- 	if (XFS_BUF_ISDELAYWRITE(bp))
- 		xfs_buf_delwri_promote(bp);
-+	if (XFS_BUF_ISPINNED(bp))
-+		ret = false;
- 	xfs_buf_relse(bp);
-+	return ret;
- }
- 
- /*
-diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
-index 7b7e005..a7342e8 100644
---- a/fs/xfs/xfs_buf_item.c
-+++ b/fs/xfs/xfs_buf_item.c
-@@ -632,7 +632,7 @@ xfs_buf_item_push(
-  * the xfsbufd to get this buffer written. We have to unlock the buffer
-  * to allow the xfsbufd to write it, too.
-  */
--STATIC void
-+STATIC bool
- xfs_buf_item_pushbuf(
- 	struct xfs_log_item	*lip)
- {
-@@ -646,6 +646,7 @@ xfs_buf_item_pushbuf(
- 
- 	xfs_buf_delwri_promote(bp);
- 	xfs_buf_relse(bp);
-+	return true;
- }
- 
- STATIC void
-diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
-index b1e88d5..391044c 100644
---- a/fs/xfs/xfs_inode_item.c
-+++ b/fs/xfs/xfs_inode_item.c
-@@ -713,13 +713,14 @@ xfs_inode_item_committed(
-  * marked delayed write. If that's the case, we'll promote it and that will
-  * allow the caller to write the buffer by triggering the xfsbufd to run.
-  */
--STATIC void
-+STATIC bool
- xfs_inode_item_pushbuf(
- 	struct xfs_log_item	*lip)
- {
- 	struct xfs_inode_log_item *iip = INODE_ITEM(lip);
- 	struct xfs_inode	*ip = iip->ili_inode;
- 	struct xfs_buf		*bp;
-+	bool			ret = true;
- 
- 	ASSERT(xfs_isilocked(ip, XFS_ILOCK_SHARED));
- 
-@@ -730,7 +731,7 @@ xfs_inode_item_pushbuf(
- 	if (completion_done(&ip->i_flush) ||
- 	    !(lip->li_flags & XFS_LI_IN_AIL)) {
- 		xfs_iunlock(ip, XFS_ILOCK_SHARED);
--		return;
-+		return true;
- 	}
- 
- 	bp = xfs_incore(ip->i_mount->m_ddev_targp, iip->ili_format.ilf_blkno,
-@@ -738,10 +739,13 @@ xfs_inode_item_pushbuf(
- 
- 	xfs_iunlock(ip, XFS_ILOCK_SHARED);
- 	if (!bp)
--		return;
-+		return true;
- 	if (XFS_BUF_ISDELAYWRITE(bp))
- 		xfs_buf_delwri_promote(bp);
-+	if (XFS_BUF_ISPINNED(bp))
-+		ret = false;
- 	xfs_buf_relse(bp);
-+	return ret;
- }
- 
- /*
-diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
-index c83f63b..efc147f 100644
---- a/fs/xfs/xfs_trans.c
-+++ b/fs/xfs/xfs_trans.c
-@@ -1426,6 +1426,7 @@ xfs_trans_committed(
- static inline void
- xfs_log_item_batch_insert(
- 	struct xfs_ail		*ailp,
-+	struct xfs_ail_cursor	*cur,
- 	struct xfs_log_item	**log_items,
- 	int			nr_items,
- 	xfs_lsn_t		commit_lsn)
-@@ -1434,7 +1435,7 @@ xfs_log_item_batch_insert(
- 
- 	spin_lock(&ailp->xa_lock);
- 	/* xfs_trans_ail_update_bulk drops ailp->xa_lock */
--	xfs_trans_ail_update_bulk(ailp, log_items, nr_items, commit_lsn);
-+	xfs_trans_ail_update_bulk(ailp, cur, log_items, nr_items, commit_lsn);
- 
- 	for (i = 0; i < nr_items; i++)
- 		IOP_UNPIN(log_items[i], 0);
-@@ -1452,6 +1453,13 @@ xfs_log_item_batch_insert(
-  * as an iclog write error even though we haven't started any IO yet. Hence in
-  * this case all we need to do is IOP_COMMITTED processing, followed by an
-  * IOP_UNPIN(aborted) call.
-+ *
-+ * The AIL cursor is used to optimise the insert process. If commit_lsn is not
-+ * at the end of the AIL, the insert cursor avoids the need to walk
-+ * the AIL to find the insertion point on every xfs_log_item_batch_insert()
-+ * call. This saves a lot of needless list walking and is a net win, even
-+ * though it slightly increases that amount of AIL lock traffic to set it up
-+ * and tear it down.
-  */
- void
- xfs_trans_committed_bulk(
-@@ -1463,8 +1471,13 @@ xfs_trans_committed_bulk(
- #define LOG_ITEM_BATCH_SIZE	32
- 	struct xfs_log_item	*log_items[LOG_ITEM_BATCH_SIZE];
- 	struct xfs_log_vec	*lv;
-+	struct xfs_ail_cursor	cur;
- 	int			i = 0;
- 
-+	spin_lock(&ailp->xa_lock);
-+	xfs_trans_ail_cursor_last(ailp, &cur, commit_lsn);
-+	spin_unlock(&ailp->xa_lock);
-+
- 	/* unpin all the log items */
- 	for (lv = log_vector; lv; lv = lv->lv_next ) {
- 		struct xfs_log_item	*lip = lv->lv_item;
-@@ -1493,7 +1506,9 @@ xfs_trans_committed_bulk(
- 			/*
- 			 * Not a bulk update option due to unusual item_lsn.
- 			 * Push into AIL immediately, rechecking the lsn once
--			 * we have the ail lock. Then unpin the item.
-+			 * we have the ail lock. Then unpin the item. This does
-+			 * not affect the AIL cursor the bulk insert path is
-+			 * using.
- 			 */
- 			spin_lock(&ailp->xa_lock);
- 			if (XFS_LSN_CMP(item_lsn, lip->li_lsn) > 0)
-@@ -1507,7 +1522,7 @@ xfs_trans_committed_bulk(
- 		/* Item is a candidate for bulk AIL insert.  */
- 		log_items[i++] = lv->lv_item;
- 		if (i >= LOG_ITEM_BATCH_SIZE) {
--			xfs_log_item_batch_insert(ailp, log_items,
-+			xfs_log_item_batch_insert(ailp, &cur, log_items,
- 					LOG_ITEM_BATCH_SIZE, commit_lsn);
- 			i = 0;
- 		}
-@@ -1515,7 +1530,11 @@ xfs_trans_committed_bulk(
- 
- 	/* make sure we insert the remainder! */
- 	if (i)
--		xfs_log_item_batch_insert(ailp, log_items, i, commit_lsn);
-+		xfs_log_item_batch_insert(ailp, &cur, log_items, i, commit_lsn);
-+
-+	spin_lock(&ailp->xa_lock);
-+	xfs_trans_ail_cursor_done(ailp, &cur);
-+	spin_unlock(&ailp->xa_lock);
- }
- 
- /*
-diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h
-index 06a9759..53597f4 100644
---- a/fs/xfs/xfs_trans.h
-+++ b/fs/xfs/xfs_trans.h
-@@ -350,7 +350,7 @@ typedef struct xfs_item_ops {
- 	void (*iop_unlock)(xfs_log_item_t *);
- 	xfs_lsn_t (*iop_committed)(xfs_log_item_t *, xfs_lsn_t);
- 	void (*iop_push)(xfs_log_item_t *);
--	void (*iop_pushbuf)(xfs_log_item_t *);
-+	bool (*iop_pushbuf)(xfs_log_item_t *);
- 	void (*iop_committing)(xfs_log_item_t *, xfs_lsn_t);
- } xfs_item_ops_t;
- 
-diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
-index 5fc2380..a4c281b 100644
---- a/fs/xfs/xfs_trans_ail.c
-+++ b/fs/xfs/xfs_trans_ail.c
-@@ -28,8 +28,6 @@
- #include "xfs_trans_priv.h"
- #include "xfs_error.h"
- 
--struct workqueue_struct	*xfs_ail_wq;	/* AIL workqueue */
--
- #ifdef DEBUG
- /*
-  * Check that the list is sorted as it should be.
-@@ -272,9 +270,9 @@ xfs_trans_ail_cursor_clear(
- }
- 
- /*
-- * Return the item in the AIL with the current lsn.
-- * Return the current tree generation number for use
-- * in calls to xfs_trans_next_ail().
-+ * Initialise the cursor to the first item in the AIL with the given @lsn.
-+ * This searches the list from lowest LSN to highest. Pass a @lsn of zero
-+ * to initialise the cursor to the first item in the AIL.
-  */
- xfs_log_item_t *
- xfs_trans_ail_cursor_first(
-@@ -300,31 +298,97 @@ out:
- }
- 
- /*
-- * splice the log item list into the AIL at the given LSN.
-+ * Initialise the cursor to the last item in the AIL with the given @lsn.
-+ * This searches the list from highest LSN to lowest. If there is no item with
-+ * the value of @lsn, then it sets the cursor to the last item with an LSN lower
-+ * than @lsn.
-+ */
-+static struct xfs_log_item *
-+__xfs_trans_ail_cursor_last(
-+	struct xfs_ail		*ailp,
-+	xfs_lsn_t		lsn)
-+{
-+	xfs_log_item_t		*lip;
-+
-+	list_for_each_entry_reverse(lip, &ailp->xa_ail, li_ail) {
-+		if (XFS_LSN_CMP(lip->li_lsn, lsn) <= 0)
-+			return lip;
-+	}
-+	return NULL;
-+}
-+
-+/*
-+ * Initialise the cursor to the last item in the AIL with the given @lsn.
-+ * This searches the list from highest LSN to lowest.
-+ */
-+struct xfs_log_item *
-+xfs_trans_ail_cursor_last(
-+	struct xfs_ail		*ailp,
-+	struct xfs_ail_cursor	*cur,
-+	xfs_lsn_t		lsn)
-+{
-+	xfs_trans_ail_cursor_init(ailp, cur);
-+	cur->item = __xfs_trans_ail_cursor_last(ailp, lsn);
-+	return cur->item;
-+}
-+
-+/*
-+ * splice the log item list into the AIL at the given LSN. We splice to the
-+ * tail of the given LSN to maintain insert order for push traversals. The
-+ * cursor is optional, allowing repeated updates to the same LSN to avoid
-+ * repeated traversals.
-  */
- static void
- xfs_ail_splice(
--	struct xfs_ail  *ailp,
--	struct list_head *list,
--	xfs_lsn_t       lsn)
-+	struct xfs_ail		*ailp,
-+	struct xfs_ail_cursor	*cur,
-+	struct list_head	*list,
-+	xfs_lsn_t		lsn)
- {
--	xfs_log_item_t  *next_lip;
-+	struct xfs_log_item	*lip = cur ? cur->item : NULL;
-+	struct xfs_log_item	*next_lip;
- 
--	/* If the list is empty, just insert the item.  */
--	if (list_empty(&ailp->xa_ail)) {
--		list_splice(list, &ailp->xa_ail);
--		return;
-+	/*
-+	 * Get a new cursor if we don't have a placeholder or the existing one
-+	 * has been invalidated.
-+	 */
-+	if (!lip || (__psint_t)lip & 1) {
-+		lip = __xfs_trans_ail_cursor_last(ailp, lsn);
-+
-+		if (!lip) {
-+			/* The list is empty, so just splice and return.  */
-+			if (cur)
-+				cur->item = NULL;
-+			list_splice(list, &ailp->xa_ail);
-+			return;
-+		}
- 	}
- 
--	list_for_each_entry_reverse(next_lip, &ailp->xa_ail, li_ail) {
--		if (XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0)
--			break;
-+	/*
-+	 * Our cursor points to the item we want to insert _after_, so we have
-+	 * to update the cursor to point to the end of the list we are splicing
-+	 * in so that it points to the correct location for the next splice.
-+	 * i.e. before the splice
-+	 *
-+	 *  lsn -> lsn -> lsn + x -> lsn + x ...
-+	 *          ^
-+	 *          | cursor points here
-+	 *
-+	 * After the splice we have:
-+	 *
-+	 *  lsn -> lsn -> lsn -> lsn -> .... -> lsn -> lsn + x -> lsn + x ...
-+	 *          ^                            ^
-+	 *          | cursor points here         | needs to move here
-+	 *
-+	 * So we set the cursor to the last item in the list to be spliced
-+	 * before we execute the splice, resulting in the cursor pointing to
-+	 * the correct item after the splice occurs.
-+	 */
-+	if (cur) {
-+		next_lip = list_entry(list->prev, struct xfs_log_item, li_ail);
-+		cur->item = next_lip;
- 	}
--
--	ASSERT(&next_lip->li_ail == &ailp->xa_ail ||
--	       XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0);
--
--	list_splice_init(list, &next_lip->li_ail);
-+	list_splice(list, &lip->li_ail);
- }
- 
- /*
-@@ -340,16 +404,10 @@ xfs_ail_delete(
- 	xfs_trans_ail_cursor_clear(ailp, lip);
- }
- 
--/*
-- * xfs_ail_worker does the work of pushing on the AIL. It will requeue itself
-- * to run at a later time if there is more work to do to complete the push.
-- */
--STATIC void
--xfs_ail_worker(
--	struct work_struct	*work)
-+static long
-+xfsaild_push(
-+	struct xfs_ail		*ailp)
- {
--	struct xfs_ail		*ailp = container_of(to_delayed_work(work),
--					struct xfs_ail, xa_work);
- 	xfs_mount_t		*mp = ailp->xa_mount;
- 	struct xfs_ail_cursor	*cur = &ailp->xa_cursors;
- 	xfs_log_item_t		*lip;
-@@ -412,8 +470,13 @@ xfs_ail_worker(
- 
- 		case XFS_ITEM_PUSHBUF:
- 			XFS_STATS_INC(xs_push_ail_pushbuf);
--			IOP_PUSHBUF(lip);
--			ailp->xa_last_pushed_lsn = lsn;
-+
-+			if (!IOP_PUSHBUF(lip)) {
-+				stuck++;
-+				flush_log = 1;
-+			} else {
-+				ailp->xa_last_pushed_lsn = lsn;
-+			}
- 			push_xfsbufd = 1;
- 			break;
- 
-@@ -425,7 +488,6 @@ xfs_ail_worker(
- 
- 		case XFS_ITEM_LOCKED:
- 			XFS_STATS_INC(xs_push_ail_locked);
--			ailp->xa_last_pushed_lsn = lsn;
- 			stuck++;
- 			break;
- 
-@@ -486,20 +548,6 @@ out_done:
- 		/* We're past our target or empty, so idle */
- 		ailp->xa_last_pushed_lsn = 0;
- 
--		/*
--		 * We clear the XFS_AIL_PUSHING_BIT first before checking
--		 * whether the target has changed. If the target has changed,
--		 * this pushes the requeue race directly onto the result of the
--		 * atomic test/set bit, so we are guaranteed that either the
--		 * the pusher that changed the target or ourselves will requeue
--		 * the work (but not both).
--		 */
--		clear_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags);
--		smp_rmb();
--		if (XFS_LSN_CMP(ailp->xa_target, target) == 0 ||
--		    test_and_set_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags))
--			return;
--
- 		tout = 50;
- 	} else if (XFS_LSN_CMP(lsn, target) >= 0) {
- 		/*
-@@ -522,9 +570,30 @@ out_done:
- 		tout = 20;
- 	}
- 
--	/* There is more to do, requeue us.  */
--	queue_delayed_work(xfs_syncd_wq, &ailp->xa_work,
--					msecs_to_jiffies(tout));
-+	return tout;
-+}
-+
-+static int
-+xfsaild(
-+	void		*data)
-+{
-+	struct xfs_ail	*ailp = data;
-+	long		tout = 0;	/* milliseconds */
-+
-+	while (!kthread_should_stop()) {
-+		if (tout && tout <= 20)
-+			__set_current_state(TASK_KILLABLE);
-+		else
-+			__set_current_state(TASK_INTERRUPTIBLE);
-+		schedule_timeout(tout ?
-+				 msecs_to_jiffies(tout) : MAX_SCHEDULE_TIMEOUT);
-+
-+		try_to_freeze();
-+
-+		tout = xfsaild_push(ailp);
-+	}
-+
-+	return 0;
- }
- 
- /*
-@@ -559,8 +628,9 @@ xfs_ail_push(
- 	 */
- 	smp_wmb();
- 	xfs_trans_ail_copy_lsn(ailp, &ailp->xa_target, &threshold_lsn);
--	if (!test_and_set_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags))
--		queue_delayed_work(xfs_syncd_wq, &ailp->xa_work, 0);
-+	smp_wmb();
-+
-+	wake_up_process(ailp->xa_task);
- }
- 
- /*
-@@ -645,6 +715,7 @@ xfs_trans_unlocked_item(
- void
- xfs_trans_ail_update_bulk(
- 	struct xfs_ail		*ailp,
-+	struct xfs_ail_cursor	*cur,
- 	struct xfs_log_item	**log_items,
- 	int			nr_items,
- 	xfs_lsn_t		lsn) __releases(ailp->xa_lock)
-@@ -674,7 +745,7 @@ xfs_trans_ail_update_bulk(
- 		list_add(&lip->li_ail, &tmp);
- 	}
- 
--	xfs_ail_splice(ailp, &tmp, lsn);
-+	xfs_ail_splice(ailp, cur, &tmp, lsn);
- 
- 	if (!mlip_changed) {
- 		spin_unlock(&ailp->xa_lock);
-@@ -794,9 +865,18 @@ xfs_trans_ail_init(
- 	ailp->xa_mount = mp;
- 	INIT_LIST_HEAD(&ailp->xa_ail);
- 	spin_lock_init(&ailp->xa_lock);
--	INIT_DELAYED_WORK(&ailp->xa_work, xfs_ail_worker);
-+
-+	ailp->xa_task = kthread_run(xfsaild, ailp, "xfsaild/%s",
-+			ailp->xa_mount->m_fsname);
-+	if (IS_ERR(ailp->xa_task))
-+		goto out_free_ailp;
-+
- 	mp->m_ail = ailp;
- 	return 0;
-+
-+out_free_ailp:
-+	kmem_free(ailp);
-+	return ENOMEM;
- }
- 
- void
-@@ -805,6 +885,6 @@ xfs_trans_ail_destroy(
- {
- 	struct xfs_ail	*ailp = mp->m_ail;
- 
--	cancel_delayed_work_sync(&ailp->xa_work);
-+	kthread_stop(ailp->xa_task);
- 	kmem_free(ailp);
- }
-diff --git a/fs/xfs/xfs_trans_priv.h b/fs/xfs/xfs_trans_priv.h
-index 6b164e9..fe2e3cb 100644
---- a/fs/xfs/xfs_trans_priv.h
-+++ b/fs/xfs/xfs_trans_priv.h
-@@ -64,24 +64,19 @@ struct xfs_ail_cursor {
-  */
- struct xfs_ail {
- 	struct xfs_mount	*xa_mount;
-+	struct task_struct	*xa_task;
- 	struct list_head	xa_ail;
- 	xfs_lsn_t		xa_target;
- 	struct xfs_ail_cursor	xa_cursors;
- 	spinlock_t		xa_lock;
--	struct delayed_work	xa_work;
- 	xfs_lsn_t		xa_last_pushed_lsn;
--	unsigned long		xa_flags;
- };
- 
--#define XFS_AIL_PUSHING_BIT	0
--
- /*
-  * From xfs_trans_ail.c
-  */
--
--extern struct workqueue_struct	*xfs_ail_wq;	/* AIL workqueue */
--
- void	xfs_trans_ail_update_bulk(struct xfs_ail *ailp,
-+				struct xfs_ail_cursor *cur,
- 				struct xfs_log_item **log_items, int nr_items,
- 				xfs_lsn_t lsn) __releases(ailp->xa_lock);
- static inline void
-@@ -90,7 +85,7 @@ xfs_trans_ail_update(
- 	struct xfs_log_item	*lip,
- 	xfs_lsn_t		lsn) __releases(ailp->xa_lock)
- {
--	xfs_trans_ail_update_bulk(ailp, &lip, 1, lsn);
-+	xfs_trans_ail_update_bulk(ailp, NULL, &lip, 1, lsn);
- }
- 
- void	xfs_trans_ail_delete_bulk(struct xfs_ail *ailp,
-@@ -111,10 +106,13 @@ xfs_lsn_t		xfs_ail_min_lsn(struct xfs_ail *ailp);
- void			xfs_trans_unlocked_item(struct xfs_ail *,
- 					xfs_log_item_t *);
- 
--struct xfs_log_item	*xfs_trans_ail_cursor_first(struct xfs_ail *ailp,
-+struct xfs_log_item *	xfs_trans_ail_cursor_first(struct xfs_ail *ailp,
-+					struct xfs_ail_cursor *cur,
-+					xfs_lsn_t lsn);
-+struct xfs_log_item *	xfs_trans_ail_cursor_last(struct xfs_ail *ailp,
- 					struct xfs_ail_cursor *cur,
- 					xfs_lsn_t lsn);
--struct xfs_log_item	*xfs_trans_ail_cursor_next(struct xfs_ail *ailp,
-+struct xfs_log_item *	xfs_trans_ail_cursor_next(struct xfs_ail *ailp,
- 					struct xfs_ail_cursor *cur);
- void			xfs_trans_ail_cursor_done(struct xfs_ail *ailp,
- 					struct xfs_ail_cursor *cur);
-diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
-index c8008dd..640ded8 100644
---- a/kernel/posix-cpu-timers.c
-+++ b/kernel/posix-cpu-timers.c
-@@ -274,9 +274,7 @@ void thread_group_cputimer(struct task_struct *tsk, struct task_cputime *times)
- 	struct task_cputime sum;
- 	unsigned long flags;
- 
--	spin_lock_irqsave(&cputimer->lock, flags);
- 	if (!cputimer->running) {
--		cputimer->running = 1;
- 		/*
- 		 * The POSIX timer interface allows for absolute time expiry
- 		 * values through the TIMER_ABSTIME flag, therefore we have
-@@ -284,8 +282,11 @@ void thread_group_cputimer(struct task_struct *tsk, struct task_cputime *times)
- 		 * it.
- 		 */
- 		thread_group_cputime(tsk, &sum);
-+		spin_lock_irqsave(&cputimer->lock, flags);
-+		cputimer->running = 1;
- 		update_gt_cputime(&cputimer->cputime, &sum);
--	}
-+	} else
-+		spin_lock_irqsave(&cputimer->lock, flags);
- 	*times = cputimer->cputime;
- 	spin_unlock_irqrestore(&cputimer->lock, flags);
- }
-diff --git a/kernel/sys.c b/kernel/sys.c
-index 5c942cf..f88dadc 100644
---- a/kernel/sys.c
-+++ b/kernel/sys.c
-@@ -1135,7 +1135,7 @@ DECLARE_RWSEM(uts_sem);
- static int override_release(char __user *release, int len)
- {
- 	int ret = 0;
--	char buf[len];
-+	char buf[65];
- 
- 	if (current->personality & UNAME26) {
- 		char *rest = UTS_RELEASE;
-diff --git a/mm/migrate.c b/mm/migrate.c
-index 666e4e6..14d0a6a 100644
---- a/mm/migrate.c
-+++ b/mm/migrate.c
-@@ -120,10 +120,10 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
- 
- 		ptep = pte_offset_map(pmd, addr);
- 
--		if (!is_swap_pte(*ptep)) {
--			pte_unmap(ptep);
--			goto out;
--		}
-+		/*
-+		 * Peek to check is_swap_pte() before taking ptlock?  No, we
-+		 * can race mremap's move_ptes(), which skips anon_vma lock.
-+		 */
- 
- 		ptl = pte_lockptr(mm, pmd);
- 	}
-diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
-index 4680b1e..373e14f 100644
---- a/net/x25/af_x25.c
-+++ b/net/x25/af_x25.c
-@@ -295,7 +295,8 @@ static struct sock *x25_find_listener(struct x25_address *addr,
- 			 * Found a listening socket, now check the incoming
- 			 * call user data vs this sockets call user data
- 			 */
--			if(skb->len > 0 && x25_sk(s)->cudmatchlength > 0) {
-+			if (x25_sk(s)->cudmatchlength > 0 &&
-+				skb->len >= x25_sk(s)->cudmatchlength) {
- 				if((memcmp(x25_sk(s)->calluserdata.cuddata,
- 					skb->data,
- 					x25_sk(s)->cudmatchlength)) == 0) {
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index 486f6de..981b6fd 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -2352,6 +2352,7 @@ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
- 	SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB),
- 	SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB),
- 	SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB),
-+	SND_PCI_QUIRK(0x1028, 0x02c6, "Dell Inspiron 1010", POS_FIX_LPIB),
- 	SND_PCI_QUIRK(0x1028, 0x0470, "Dell Inspiron 1120", POS_FIX_LPIB),
- 	SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB),
- 	SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
-diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
-index 7bbc5f2..cf1fa36 100644
---- a/sound/pci/hda/patch_conexant.c
-+++ b/sound/pci/hda/patch_conexant.c
-@@ -3097,6 +3097,7 @@ static const struct snd_pci_quirk cxt5066_cfg_tbl[] = {
- 	SND_PCI_QUIRK(0x17aa, 0x21c5, "Thinkpad Edge 13", CXT5066_THINKPAD),
- 	SND_PCI_QUIRK(0x17aa, 0x21c6, "Thinkpad Edge 13", CXT5066_ASUS),
-  	SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD),
-+	SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520 & W520", CXT5066_AUTO),
- 	SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT5066_THINKPAD),
- 	SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT5066_THINKPAD),
- 	SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo U350", CXT5066_ASUS),

diff --git a/3.1.5/0000_README b/3.1.5/0000_README
new file mode 100644
index 0000000..dc91a63
--- /dev/null
+++ b/3.1.5/0000_README
@@ -0,0 +1,8 @@
+README
+-----------------------------------------------------------------------------
+
+Individual Patch Descriptions:
+-----------------------------------------------------------------------------
+Patch:	4500_patch-linux-3.1.5-rsbac-1.4.6.diff
+From:	Amon Ott <ao@×××××.org>
+Desc:	RSBAC patch from http://www.rsbac.org/

diff --git a/3.0.8/4500_rsbac.patch b/3.1.5/4500_patch-linux-3.1.5-rsbac-1.4.6.diff
similarity index 99%
rename from 3.0.8/4500_rsbac.patch
rename to 3.1.5/4500_patch-linux-3.1.5-rsbac-1.4.6.diff
index d4cb64b..bfb3bd1 100644
--- a/3.0.8/4500_rsbac.patch
+++ b/3.1.5/4500_patch-linux-3.1.5-rsbac-1.4.6.diff
@@ -25,12 +25,20 @@ index 0000000..7e08278
 +Amon Ott <ao@×××××.org>
 diff --git a/Documentation/rsbac/Changes b/Documentation/rsbac/Changes
 new file mode 100644
-index 0000000..751a60d
+index 0000000..8217276
 --- /dev/null
 +++ b/Documentation/rsbac/Changes
-@@ -0,0 +1,675 @@
+@@ -0,0 +1,683 @@
 +RSBAC Changes
 +-------------
++1.4.6:
++	- Port everything to kernel 3.1.5
++	- Show process name and parent when logging PROCESS target accesses
++	- Add RSBAC syscalls to get and set UM password history size per
++	  user.
++	- Do not allow to set attributes for FD targets with
++	  sys_rsbac_set_attr()
++
 +1.4.5:
 +	- Fix symlink's stat() call to return the real symlink size
 +	  Fixes program that would assert on stat->s_size being the same size as when using readlink()
@@ -1555,10 +1563,10 @@ index 0000000..10d6b8b
 +rsbac-admin tools. These are basically the same modules that are built if
 +you enabled building of sample modules in kernel config.
 diff --git a/MAINTAINERS b/MAINTAINERS
-index 187282d..d71f5f5 100644
+index e608038..7a1e27e 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -5352,6 +5352,13 @@ F:	include/linux/rose.h
+@@ -5441,6 +5441,13 @@ F:	include/linux/rose.h
  F:	include/net/rose.h
  F:	net/rose/
  
@@ -1573,7 +1581,7 @@ index 187282d..d71f5f5 100644
  M:	"John W. Linville" <linville@×××××××××.com>
  L:	linux-wireless@×××××××××××.org
 diff --git a/Makefile b/Makefile
-index 9f6e3cd..a432f4b 100644
+index 94ab2ad..a2ce3ff 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -681,6 +681,13 @@ export KBUILD_IMAGE ?= vmlinux
@@ -1677,7 +1685,7 @@ index e2af5eb..1e45259 100644
  	switch (request) {
  	/* When I and D space are separate, these will need to be fixed.  */
 diff --git a/arch/arm/include/asm/unistd.h b/arch/arm/include/asm/unistd.h
-index 2c04ed5..fb999d3 100644
+index c60a294..4978995 100644
 --- a/arch/arm/include/asm/unistd.h
 +++ b/arch/arm/include/asm/unistd.h
 @@ -248,7 +248,12 @@
@@ -1695,7 +1703,7 @@ index 2c04ed5..fb999d3 100644
  #define __NR_readahead			(__NR_SYSCALL_BASE+225)
  #define __NR_setxattr			(__NR_SYSCALL_BASE+226)
 diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
-index 80f7896..5e354d3 100644
+index 9943e9e..cba188b 100644
 --- a/arch/arm/kernel/calls.S
 +++ b/arch/arm/kernel/calls.S
 @@ -232,7 +232,11 @@
@@ -1711,10 +1719,10 @@ index 80f7896..5e354d3 100644
  /* 225 */	CALL(ABI(sys_readahead, sys_oabi_readahead))
  		CALL(sys_setxattr)
 diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
-index 5e1e541..ea7a4ab 100644
+index c9d11ea..9432520 100644
 --- a/arch/arm/kernel/process.c
 +++ b/arch/arm/kernel/process.c
-@@ -445,6 +445,10 @@ pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
+@@ -450,6 +450,10 @@ pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
  {
  	struct pt_regs regs;
  
@@ -1725,7 +1733,7 @@ index 5e1e541..ea7a4ab 100644
  	memset(&regs, 0, sizeof(regs));
  
  	regs.ARM_r4 = (unsigned long)arg;
-@@ -454,7 +458,12 @@ pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
+@@ -459,7 +463,12 @@ pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
  	regs.ARM_pc = (unsigned long)kernel_thread_helper;
  	regs.ARM_cpsr = regs.ARM_r7 | PSR_I_BIT;
  
@@ -1758,7 +1766,7 @@ index ef5a2a0..ae0c932 100644
  EXPORT_SYMBOL(kernel_thread);
  
 diff --git a/arch/blackfin/kernel/process.c b/arch/blackfin/kernel/process.c
-index 6a660fa..cf065bb 100644
+index 6a80a9e..3650435 100644
 --- a/arch/blackfin/kernel/process.c
 +++ b/arch/blackfin/kernel/process.c
 @@ -127,8 +127,13 @@ pid_t kernel_thread(int (*fn) (void *), void *arg, unsigned long flags)
@@ -1777,7 +1785,7 @@ index 6a660fa..cf065bb 100644
  EXPORT_SYMBOL(kernel_thread);
  
 diff --git a/arch/cris/arch-v10/kernel/entry.S b/arch/cris/arch-v10/kernel/entry.S
-index 1161883..c96da47 100644
+index 592fbe9..0360b7f 100644
 --- a/arch/cris/arch-v10/kernel/entry.S
 +++ b/arch/cris/arch-v10/kernel/entry.S
 @@ -825,7 +825,11 @@ sys_call_table:
@@ -1934,7 +1942,7 @@ index af56501..98608b3 100644
  	BLANK();
  	DEFINE(IA64_CPUINFO_NSEC_PER_CYC_OFFSET,
 diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
-index 97dd2ab..fbfe83c 100644
+index 198c753..c8f006a 100644
 --- a/arch/ia64/kernel/entry.S
 +++ b/arch/ia64/kernel/entry.S
 @@ -1758,6 +1758,9 @@ sys_call_table:
@@ -2099,7 +2107,7 @@ index 6cf4bd6..ae5dc84 100644
 +#endif
 +
 diff --git a/arch/m68k/kernel/process_no.c b/arch/m68k/kernel/process_no.c
-index 9b86ad1..237324d 100644
+index 69c1803..f387c82 100644
 --- a/arch/m68k/kernel/process_no.c
 +++ b/arch/m68k/kernel/process_no.c
 @@ -121,7 +121,11 @@ void show_regs(struct pt_regs * regs)
@@ -2128,10 +2136,10 @@ index 9b86ad1..237324d 100644
  }
  EXPORT_SYMBOL(kernel_thread);
 diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
-index d2112d3..bc0f34e 100644
+index b30cb25..9bbec68 100644
 --- a/arch/mips/kernel/process.c
 +++ b/arch/mips/kernel/process.c
-@@ -234,6 +234,7 @@ static void __noreturn kernel_thread_helper(void *arg, int (*fn)(void *))
+@@ -233,6 +233,7 @@ static void __noreturn kernel_thread_helper(void *arg, int (*fn)(void *))
  long kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
  {
  	struct pt_regs regs;
@@ -2139,7 +2147,7 @@ index d2112d3..bc0f34e 100644
  
  	memset(&regs, 0, sizeof(regs));
  
-@@ -249,7 +250,12 @@ long kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
+@@ -248,7 +249,12 @@ long kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
  #endif
  
  	/* Ok, create the new process.. */
@@ -2154,7 +2162,7 @@ index d2112d3..bc0f34e 100644
  
  /*
 diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
-index 99e656e..82923de 100644
+index 865bc7a..beba92f 100644
 --- a/arch/mips/kernel/scall32-o32.S
 +++ b/arch/mips/kernel/scall32-o32.S
 @@ -456,7 +456,11 @@ einval:	li	v0, -ENOSYS
@@ -2170,7 +2178,7 @@ index 99e656e..82923de 100644
  	sys	sys_readahead		5
  	sys	sys_setxattr		5
 diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
-index fb0575f..18b9954 100644
+index fb7334b..55139c0 100644
 --- a/arch/mips/kernel/scall64-64.S
 +++ b/arch/mips/kernel/scall64-64.S
 @@ -303,7 +303,11 @@ sys_call_table:
@@ -2186,7 +2194,7 @@ index fb0575f..18b9954 100644
  	PTR	sys_readahead
  	PTR	sys_setxattr			/* 5180 */
 diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
-index 4a387de..40598f9 100644
+index 1d81316..54fc4d5 100644
 --- a/arch/mips/kernel/scall64-o32.S
 +++ b/arch/mips/kernel/scall64-o32.S
 @@ -424,7 +424,11 @@ sys_call_table:
@@ -2220,26 +2228,16 @@ index 28eec31..2e8973f 100644
  EXPORT_SYMBOL(kernel_thread);
  
 diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
-index 4b4b918..c954f2e 100644
+index 4b4b918..822e4f1 100644
 --- a/arch/parisc/kernel/process.c
 +++ b/arch/parisc/kernel/process.c
-@@ -170,13 +170,22 @@ EXPORT_SYMBOL(pm_power_off);
- extern pid_t __kernel_thread(int (*fn)(void *), void *arg, unsigned long flags);
- pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
- {
-+#ifdef CONFIG_RSBAC
-+	pid_t rsbac_retval;
-+#endif
- 
- 	/*
- 	 * FIXME: Once we are sure we don't need any debug here,
+@@ -176,7 +176,12 @@ pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
  	 *	  kernel_thread can become a #define.
  	 */
  
 +	/* Ok, create the new process.. */
 +#ifdef CONFIG_RSBAC
-+	rsbac_retval = __kernel_thread(fn, arg, flags | CLONE_KTHREAD);
-+	return rsbac_retval;
++	return __kernel_thread(fn, arg, flags | CLONE_KTHREAD);
 +#else
  	return __kernel_thread(fn, arg, flags);
 +#endif
@@ -2247,7 +2245,7 @@ index 4b4b918..c954f2e 100644
  EXPORT_SYMBOL(kernel_thread);
  
 diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
-index e66366f..680336c 100644
+index 3735abd..97347de 100644
 --- a/arch/parisc/kernel/syscall_table.S
 +++ b/arch/parisc/kernel/syscall_table.S
 @@ -407,6 +407,9 @@
@@ -2261,7 +2259,7 @@ index e66366f..680336c 100644
  	ENTRY_SAME(eventfd2)		/* 310 */
  	ENTRY_SAME(epoll_create1)
 diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
-index f6736b7..6133b35 100644
+index fa0d27a..3ef73e0 100644
 --- a/arch/powerpc/include/asm/systbl.h
 +++ b/arch/powerpc/include/asm/systbl.h
 @@ -227,7 +227,11 @@ SYSCALL_SPU(fremovexattr)
@@ -2292,10 +2290,10 @@ index b8b3f59..0838a51 100644
  #define __NR_tuxcall		225
  #ifndef __powerpc64__
 diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
-index 36e1c8a..caabc4d 100644
+index 5f078bc..9f176b3 100644
 --- a/arch/powerpc/kernel/asm-offsets.c
 +++ b/arch/powerpc/kernel/asm-offsets.c
-@@ -312,6 +312,9 @@ int main(void)
+@@ -313,6 +313,9 @@ int main(void)
  #endif
  	DEFINE(CLONE_VM, CLONE_VM);
  	DEFINE(CLONE_UNTRACED, CLONE_UNTRACED);
@@ -2322,7 +2320,7 @@ index 998a100..d86df96 100644
  	li	r0,__NR_clone
  	sc
 diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
-index e89df59..c5a752a 100644
+index 616921e..9f8aeb4 100644
 --- a/arch/powerpc/kernel/misc_64.S
 +++ b/arch/powerpc/kernel/misc_64.S
 @@ -422,7 +422,11 @@ _GLOBAL(kernel_thread)
@@ -2367,7 +2365,7 @@ index 541a750..e1e8a62 100644
  EXPORT_SYMBOL(kernel_thread);
  
 diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
-index ef86ad2..ad9f572 100644
+index 5804cfa..455478a 100644
 --- a/arch/s390/kernel/ptrace.c
 +++ b/arch/s390/kernel/ptrace.c
 @@ -35,6 +35,8 @@
@@ -2450,7 +2448,7 @@ index 210c1ca..d0493ec 100644
  EXPORT_SYMBOL(kernel_thread);
  
 diff --git a/arch/sh/kernel/syscalls_32.S b/arch/sh/kernel/syscalls_32.S
-index 39b051d..6b64f7a 100644
+index 293e39c..008bdca 100644
 --- a/arch/sh/kernel/syscalls_32.S
 +++ b/arch/sh/kernel/syscalls_32.S
 @@ -239,7 +239,11 @@ ENTRY(sys_call_table)
@@ -2466,7 +2464,7 @@ index 39b051d..6b64f7a 100644
  	.long sys_readahead	/* 225 */
  	.long sys_setxattr
 diff --git a/arch/sh/kernel/syscalls_64.S b/arch/sh/kernel/syscalls_64.S
-index 089c4d8..c1db16f 100644
+index ceb34b9..a577dfc 100644
 --- a/arch/sh/kernel/syscalls_64.S
 +++ b/arch/sh/kernel/syscalls_64.S
 @@ -276,7 +276,11 @@ sys_call_table:
@@ -2499,10 +2497,10 @@ index 6260d5d..2d5b076 100644
  #ifdef __32bit_syscall_numbers__
  /* Sparc 32-bit only has the "setresuid32", "getresuid32" variants,
 diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
-index c8cc461..28ea016 100644
+index f793742..af327b1 100644
 --- a/arch/sparc/kernel/process_32.c
 +++ b/arch/sparc/kernel/process_32.c
-@@ -679,9 +679,14 @@ pid_t kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)
+@@ -678,9 +678,14 @@ pid_t kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)
  			     /* Notreached by child. */
  			     "1: mov %%o0, %0\n\t" :
  			     "=r" (retval) :
@@ -2518,10 +2516,10 @@ index c8cc461..28ea016 100644
  }
  EXPORT_SYMBOL(kernel_thread);
 diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
-index c158a95..eb31c7f 100644
+index d959cd0..dc40d9b 100644
 --- a/arch/sparc/kernel/process_64.c
 +++ b/arch/sparc/kernel/process_64.c
-@@ -646,7 +646,11 @@ pid_t kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)
+@@ -643,7 +643,11 @@ pid_t kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)
  			     /* Notreached by child. */
  			     "1:" :
  			     "=r" (retval) :
@@ -2622,7 +2620,7 @@ index 96ee50a..83bf9b0 100644
  	case PTRACE_PEEKUSR:
  		ret = (addr != 0) ? -EIO : 0;
 diff --git a/arch/sparc/kernel/systbls_32.S b/arch/sparc/kernel/systbls_32.S
-index 6e492d5..742c50b 100644
+index 09d8ec4..75c21ac 100644
 --- a/arch/sparc/kernel/systbls_32.S
 +++ b/arch/sparc/kernel/systbls_32.S
 @@ -48,7 +48,11 @@ sys_call_table:
@@ -2638,7 +2636,7 @@ index 6e492d5..742c50b 100644
  /*170*/	.long sys_lsetxattr, sys_fsetxattr, sys_getxattr, sys_lgetxattr, sys_getdents
  /*175*/	.long sys_setsid, sys_fchdir, sys_fgetxattr, sys_listxattr, sys_llistxattr
 diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
-index f566518..4631842 100644
+index edbec45..07cb12f 100644
 --- a/arch/sparc/kernel/systbls_64.S
 +++ b/arch/sparc/kernel/systbls_64.S
 @@ -50,7 +50,11 @@ sys_call_table32:
@@ -2654,7 +2652,7 @@ index f566518..4631842 100644
  /*170*/	.word sys32_lsetxattr, sys32_fsetxattr, sys_getxattr, sys_lgetxattr, compat_sys_getdents
  	.word sys_setsid, sys_fchdir, sys32_fgetxattr, sys_listxattr, sys_llistxattr
 diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
-index fab4371..2787392 100644
+index 21c1ae7..796e7f4 100644
 --- a/arch/um/kernel/process.c
 +++ b/arch/um/kernel/process.c
 @@ -74,7 +74,11 @@ int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)
@@ -2670,7 +2668,7 @@ index fab4371..2787392 100644
  	return pid;
  }
 diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
-index c1870dd..08d73c9 100644
+index 54edb207..895a206 100644
 --- a/arch/x86/ia32/ia32entry.S
 +++ b/arch/x86/ia32/ia32entry.S
 @@ -726,7 +726,11 @@ ia32_sys_call_table:
@@ -2700,7 +2698,7 @@ index 593485b..21f9477 100644
  #define __NR_readahead		225
  #define __NR_setxattr		226
 diff --git a/arch/x86/include/asm/unistd_64.h b/arch/x86/include/asm/unistd_64.h
-index 705bf13..1a4897f 100644
+index 2010405..7fbae21 100644
 --- a/arch/x86/include/asm/unistd_64.h
 +++ b/arch/x86/include/asm/unistd_64.h
 @@ -431,7 +431,14 @@ __SYSCALL(__NR_afs_syscall, sys_ni_syscall)
@@ -2799,7 +2797,7 @@ index 8c96897..524e039 100644
  	t->iopl = level << 12;
  	set_iopl_mask(t->iopl);
 diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
-index e1ba8cb..630e58a 100644
+index e7e3b01..128ffdb 100644
 --- a/arch/x86/kernel/process.c
 +++ b/arch/x86/kernel/process.c
 @@ -276,6 +276,10 @@ int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
@@ -2827,10 +2825,10 @@ index e1ba8cb..630e58a 100644
  EXPORT_SYMBOL(kernel_thread);
  
 diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
-index ca6f7ab..e2e7e23 100644
+index f693e44..a0ef1a1 100644
 --- a/arch/x86/kernel/process_64.c
 +++ b/arch/x86/kernel/process_64.c
-@@ -56,6 +56,12 @@ asmlinkage extern void ret_from_fork(void);
+@@ -57,6 +57,12 @@ asmlinkage extern void ret_from_fork(void);
  DEFINE_PER_CPU(unsigned long, old_rsp);
  static DEFINE_PER_CPU(unsigned char, is_idle);
  
@@ -2844,7 +2842,7 @@ index ca6f7ab..e2e7e23 100644
  
  void idle_notifier_register(struct notifier_block *n)
 diff --git a/arch/x86/kernel/syscall_table_32.S b/arch/x86/kernel/syscall_table_32.S
-index fbb0a04..f94ac61 100644
+index bc19be3..63a703d 100644
 --- a/arch/x86/kernel/syscall_table_32.S
 +++ b/arch/x86/kernel/syscall_table_32.S
 @@ -222,7 +222,11 @@ ENTRY(sys_call_table)
@@ -2955,19 +2953,19 @@ index 1124cd2..0852ffd 100644
  	case BLKFLSBUF:
  		if (!capable(CAP_SYS_ADMIN))
 diff --git a/drivers/block/loop.c b/drivers/block/loop.c
-index 2ebacf0..77b0aba 100644
+index 4720c7a..0fc0685 100644
 --- a/drivers/block/loop.c
 +++ b/drivers/block/loop.c
 @@ -78,6 +78,8 @@
- 
+ #include <linux/miscdevice.h>
  #include <asm/uaccess.h>
  
 +#include <rsbac/hooks.h>
 +
- static LIST_HEAD(loop_devices);
- static DEFINE_MUTEX(loop_devices_mutex);
+ static DEFINE_IDR(loop_index_idr);
+ static DEFINE_MUTEX(loop_index_mutex);
  
-@@ -825,6 +827,12 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
+@@ -818,6 +820,12 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
  	int		error;
  	loff_t		size;
  
@@ -2980,7 +2978,7 @@ index 2ebacf0..77b0aba 100644
  	/* This is safe, since we have a reference from open(). */
  	__module_get(THIS_MODULE);
  
-@@ -886,6 +894,46 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
+@@ -879,6 +887,46 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
  	if (!(mode & FMODE_WRITE))
  		lo_flags |= LO_FLAGS_READ_ONLY;
  
@@ -3027,7 +3025,7 @@ index 2ebacf0..77b0aba 100644
  	set_device_ro(bdev, (lo_flags & LO_FLAGS_READ_ONLY) != 0);
  
  	lo->lo_blocksize = lo_blocksize;
-@@ -992,6 +1040,12 @@ static int loop_clr_fd(struct loop_device *lo, struct block_device *bdev)
+@@ -985,6 +1033,12 @@ static int loop_clr_fd(struct loop_device *lo, struct block_device *bdev)
  	struct file *filp = lo->lo_backing_file;
  	gfp_t gfp = lo->old_gfp_mask;
  
@@ -3040,7 +3038,7 @@ index 2ebacf0..77b0aba 100644
  	if (lo->lo_state != Lo_bound)
  		return -ENXIO;
  
-@@ -1001,6 +1055,44 @@ static int loop_clr_fd(struct loop_device *lo, struct block_device *bdev)
+@@ -994,6 +1048,44 @@ static int loop_clr_fd(struct loop_device *lo, struct block_device *bdev)
  	if (filp == NULL)
  		return -EINVAL;
  
@@ -3337,10 +3335,10 @@ index 43db715..ec958c5 100644
  	NULL,				/* y */
  	&sysrq_ftrace_dump_op,		/* z */
 diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
-index b6f92d3..f06464b 100644
+index 1a890e2..5d0c72a 100644
 --- a/drivers/tty/tty_io.c
 +++ b/drivers/tty/tty_io.c
-@@ -105,6 +105,8 @@
+@@ -106,6 +106,8 @@
  #include <linux/kmod.h>
  #include <linux/nsproxy.h>
  
@@ -3349,7 +3347,7 @@ index b6f92d3..f06464b 100644
  #undef TTY_DEBUG_HANGUP
  
  #define TTY_PARANOIA_CHECK 1
-@@ -2056,10 +2058,33 @@ static int tiocsti(struct tty_struct *tty, char __user *p)
+@@ -2080,10 +2082,33 @@ static int tiocsti(struct tty_struct *tty, char __user *p)
  	char ch, mbz = 0;
  	struct tty_ldisc *ld;
  
@@ -3456,7 +3454,7 @@ index 53f2442..e9eff1e 100644
  #ifdef TIOCGETP
  	case TIOCGETP:
 diff --git a/fs/exec.c b/fs/exec.c
-index 044c13f..36499fc 100644
+index 25dcbe5..0b3ec45 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -61,6 +61,8 @@
@@ -3547,7 +3545,7 @@ index 044c13f..36499fc 100644
  	fput(file);
  out:
    	return error;
-@@ -789,6 +845,13 @@ struct file *open_exec(const char *name)
+@@ -782,6 +838,13 @@ struct file *open_exec(const char *name)
  
  	fsnotify_open(file);
  
@@ -3561,9 +3559,9 @@ index 044c13f..36499fc 100644
  	err = deny_write_access(file);
  	if (err)
  		goto exit;
-@@ -1436,6 +1499,12 @@ static int do_execve_common(const char *filename,
- 	bool clear_in_exec;
+@@ -1461,6 +1524,12 @@ static int do_execve_common(const char *filename,
  	int retval;
+ 	const struct cred *cred = current_cred();
  
 +#ifdef CONFIG_RSBAC
 +	union rsbac_target_id_t rsbac_target_id;
@@ -3571,10 +3569,10 @@ index 044c13f..36499fc 100644
 +	union rsbac_attribute_value_t rsbac_attribute_value;
 +#endif
 +
- 	retval = unshare_files(&displaced);
- 	if (retval)
- 		goto out_ret;
-@@ -1478,6 +1547,26 @@ static int do_execve_common(const char *filename,
+ 	/*
+ 	 * We move the actual failure in case of RLIMIT_NPROC excess from
+ 	 * set*uid() to execve() because too many poorly written programs
+@@ -1519,6 +1588,26 @@ static int do_execve_common(const char *filename,
  	if ((retval = bprm->envc) < 0)
  		goto out;
  
@@ -3601,7 +3599,7 @@ index 044c13f..36499fc 100644
  	retval = prepare_binprm(bprm);
  	if (retval < 0)
  		goto out;
-@@ -1503,6 +1592,25 @@ static int do_execve_common(const char *filename,
+@@ -1544,6 +1633,25 @@ static int do_execve_common(const char *filename,
  	current->fs->in_exec = 0;
  	current->in_execve = 0;
  	acct_update_integrals(current);
@@ -3717,7 +3715,7 @@ index f81e250..48be9f3 100644
  
  	switch (cmd) {
 diff --git a/fs/ext2/namei.c b/fs/ext2/namei.c
-index ed5c5d4..b4050ed 100644
+index 761fde8..360b78d 100644
 --- a/fs/ext2/namei.c
 +++ b/fs/ext2/namei.c
 @@ -37,6 +37,8 @@
@@ -3729,7 +3727,7 @@ index ed5c5d4..b4050ed 100644
  static inline int ext2_add_nondir(struct dentry *dentry, struct inode *inode)
  {
  	int err = ext2_add_link(dentry, inode);
-@@ -284,6 +286,11 @@ static int ext2_unlink(struct inode * dir, struct dentry *dentry)
+@@ -280,6 +282,11 @@ static int ext2_unlink(struct inode * dir, struct dentry *dentry)
  	if (err)
  		goto out;
  
@@ -3741,7 +3739,7 @@ index ed5c5d4..b4050ed 100644
  	inode->i_ctime = dir->i_ctime;
  	inode_dec_link_count(inode);
  	err = 0;
-@@ -344,6 +351,12 @@ static int ext2_rename (struct inode * old_dir, struct dentry * old_dentry,
+@@ -340,6 +347,12 @@ static int ext2_rename (struct inode * old_dir, struct dentry * old_dentry,
  		new_de = ext2_find_entry (new_dir, &new_dentry->d_name, &new_page);
  		if (!new_de)
  			goto out_dir;
@@ -3755,7 +3753,7 @@ index ed5c5d4..b4050ed 100644
  		new_inode->i_ctime = CURRENT_TIME_SEC;
  		if (dir_de)
 diff --git a/fs/ext3/ioctl.c b/fs/ext3/ioctl.c
-index f4090bd..410113d 100644
+index c7f4394..b6ad308 100644
 --- a/fs/ext3/ioctl.c
 +++ b/fs/ext3/ioctl.c
 @@ -17,6 +17,11 @@
@@ -3855,10 +3853,10 @@ index f4090bd..410113d 100644
  
  	switch (cmd) {
 diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
-index e5a7111..b2b4e50 100644
+index 0629e09..ef78a97 100644
 --- a/fs/ext3/namei.c
 +++ b/fs/ext3/namei.c
-@@ -41,6 +41,8 @@
+@@ -42,6 +42,8 @@
  #include "xattr.h"
  #include "acl.h"
  
@@ -3867,7 +3865,7 @@ index e5a7111..b2b4e50 100644
  /*
   * define how far ahead to read directories while searching them.
   */
-@@ -2163,6 +2165,19 @@ static int ext3_unlink(struct inode * dir, struct dentry *dentry)
+@@ -2162,6 +2164,19 @@ static int ext3_unlink(struct inode * dir, struct dentry *dentry)
  
  	inode = dentry->d_inode;
  
@@ -3911,7 +3909,7 @@ index e5a7111..b2b4e50 100644
  		retval = ext3_journal_get_write_access(handle, new_bh);
  		if (retval)
 diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
-index 808c554..8577f87 100644
+index f18bfe3..3b41dd0 100644
 --- a/fs/ext4/ioctl.c
 +++ b/fs/ext4/ioctl.c
 @@ -18,12 +18,93 @@
@@ -4009,7 +4007,7 @@ index 808c554..8577f87 100644
  
  	switch (cmd) {
 diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
-index 458a394..0f22f61 100644
+index 50c7294..89a815e 100644
 --- a/fs/ext4/namei.c
 +++ b/fs/ext4/namei.c
 @@ -41,6 +41,9 @@
@@ -4022,7 +4020,7 @@ index 458a394..0f22f61 100644
  /*
   * define how far ahead to read directories while searching them.
   */
-@@ -2216,6 +2219,19 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry)
+@@ -2206,6 +2209,19 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry)
  
  	inode = dentry->d_inode;
  
@@ -4042,7 +4040,7 @@ index 458a394..0f22f61 100644
  	retval = -EIO;
  	if (le32_to_cpu(de->inode) != inode->i_ino)
  		goto end_unlink;
-@@ -2473,6 +2489,21 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+@@ -2463,6 +2479,21 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
  		if (retval)
  			goto end_rename;
  	} else {
@@ -4065,7 +4063,7 @@ index 458a394..0f22f61 100644
  		retval = ext4_journal_get_write_access(handle, new_bh);
  		if (retval)
 diff --git a/fs/fat/namei_msdos.c b/fs/fat/namei_msdos.c
-index 3b222da..92c2bfa 100644
+index 66e83b8..030f654 100644
 --- a/fs/fat/namei_msdos.c
 +++ b/fs/fat/namei_msdos.c
 @@ -9,6 +9,7 @@
@@ -4076,7 +4074,7 @@ index 3b222da..92c2bfa 100644
  #include "fat.h"
  
  /* Characters that are undesirable in an MS-DOS file name */
-@@ -432,6 +433,9 @@ static int msdos_unlink(struct inode *dir, struct dentry *dentry)
+@@ -423,6 +424,9 @@ static int msdos_unlink(struct inode *dir, struct dentry *dentry)
  	clear_nlink(inode);
  	inode->i_ctime = CURRENT_TIME_SEC;
  	fat_detach(inode);
@@ -4086,7 +4084,7 @@ index 3b222da..92c2bfa 100644
  out:
  	unlock_super(sb);
  	if (!err)
-@@ -525,6 +529,11 @@ static int do_msdos_rename(struct inode *old_dir, unsigned char *old_name,
+@@ -516,6 +520,11 @@ static int do_msdos_rename(struct inode *old_dir, unsigned char *old_name,
  	}
  	new_dir->i_version++;
  
@@ -4099,7 +4097,7 @@ index 3b222da..92c2bfa 100644
  	fat_attach(old_inode, new_i_pos);
  	if (is_hid)
 diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
-index 20b4ea5..9775564 100644
+index bb3f29c..a217b34 100644
 --- a/fs/fat/namei_vfat.c
 +++ b/fs/fat/namei_vfat.c
 @@ -21,6 +21,7 @@
@@ -4110,7 +4108,7 @@ index 20b4ea5..9775564 100644
  #include "fat.h"
  
  /*
-@@ -860,6 +861,10 @@ static int vfat_unlink(struct inode *dir, struct dentry *dentry)
+@@ -858,6 +859,10 @@ static int vfat_unlink(struct inode *dir, struct dentry *dentry)
  	if (err)
  		goto out;
  
@@ -4121,7 +4119,7 @@ index 20b4ea5..9775564 100644
  	err = fat_remove_entries(dir, &sinfo);	/* and releases bh */
  	if (err)
  		goto out;
-@@ -956,6 +961,11 @@ static int vfat_rename(struct inode *old_dir, struct dentry *old_dentry,
+@@ -954,6 +959,11 @@ static int vfat_rename(struct inode *old_dir, struct dentry *old_dentry,
  			if (err)
  				goto out;
  		}
@@ -4229,7 +4227,7 @@ index 1d9b9fc..9f55d27 100644
  	if (error == -ENOIOCTLCMD)
  		error = -EINVAL;
 diff --git a/fs/ioprio.c b/fs/ioprio.c
-index 7da2a06..c255e3d 100644
+index 7da2a06..c652f8e 100644
 --- a/fs/ioprio.c
 +++ b/fs/ioprio.c
 @@ -26,6 +26,7 @@
@@ -4240,14 +4238,16 @@ index 7da2a06..c255e3d 100644
  #include <linux/pid_namespace.h>
  
  int set_task_ioprio(struct task_struct *task, int ioprio)
-@@ -82,6 +83,25 @@ SYSCALL_DEFINE3(ioprio_set, int, which, int, who, int, ioprio)
+@@ -82,6 +83,26 @@ SYSCALL_DEFINE3(ioprio_set, int, which, int, who, int, ioprio)
  	struct pid *pgrp;
  	int ret;
  
 +#ifdef CONFIG_RSBAC
 +	union rsbac_target_id_t rsbac_target_id;
 +	union rsbac_attribute_value_t rsbac_attribute_value;
++#endif
 +
++#ifdef CONFIG_RSBAC
 +	rsbac_pr_debug(aef, "calling ADF\n");
 +	rsbac_target_id.scd = ST_priority;
 +	rsbac_attribute_value.priority = ioprio;
@@ -4257,8 +4257,7 @@ index 7da2a06..c255e3d 100644
 +				T_SCD,
 +				rsbac_target_id,
 +				A_priority,
-+				rsbac_attribute_value))
-+	{
++				rsbac_attribute_value)) {
 +		return -EPERM;
 +	}
 +#endif
@@ -4266,14 +4265,16 @@ index 7da2a06..c255e3d 100644
  	switch (class) {
  		case IOPRIO_CLASS_RT:
  			if (!capable(CAP_SYS_ADMIN))
-@@ -156,6 +176,25 @@ static int get_task_ioprio(struct task_struct *p)
+@@ -156,6 +177,26 @@ static int get_task_ioprio(struct task_struct *p)
  {
  	int ret;
  
 +#ifdef CONFIG_RSBAC
 +        union rsbac_target_id_t rsbac_target_id;
 +        union rsbac_attribute_value_t rsbac_attribute_value;
++#endif
 +
++#ifdef CONFIG_RSBAC
 +        rsbac_pr_debug(aef, "calling ADF\n");
 +        rsbac_target_id.scd = ST_priority;
 +        rsbac_attribute_value.dummy = 0;
@@ -4283,8 +4284,7 @@ index 7da2a06..c255e3d 100644
 +                                T_SCD,
 +                                rsbac_target_id,
 +                                A_none,
-+                                rsbac_attribute_value))
-+        {
++                                rsbac_attribute_value)) {
 +                return -EPERM;
 +        }
 +#endif
@@ -4309,7 +4309,7 @@ index 2d71094..608951e 100644
  			transaction->t_tid);
  
 diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
-index eaaf2b5..c79b6be 100644
+index e17545e..03825fb 100644
 --- a/fs/jfs/namei.c
 +++ b/fs/jfs/namei.c
 @@ -33,6 +33,8 @@
@@ -4334,7 +4334,7 @@ index eaaf2b5..c79b6be 100644
  	IWRITE_LOCK(ip, RDWRLOCK_NORMAL);
  
  	tid = txBegin(dip->i_sb, 0);
-@@ -1145,6 +1153,10 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+@@ -1144,6 +1152,10 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
  			goto out3;
  		}
  	} else if (new_ip) {
@@ -4345,23 +4345,8 @@ index eaaf2b5..c79b6be 100644
  		IWRITE_LOCK(new_ip, RDWRLOCK_NORMAL);
  		/* Init inode for quota operations. */
  		dquot_initialize(new_ip);
-diff --git a/fs/libfs.c b/fs/libfs.c
-index 275ca474..2e02b31 100644
---- a/fs/libfs.c
-+++ b/fs/libfs.c
-@@ -16,6 +16,10 @@
- 
- #include <asm/uaccess.h>
- 
-+#ifdef CONFIG_RSBAC
-+#include <rsbac/aci.h>
-+#endif
-+
- static inline int simple_positive(struct dentry *dentry)
- {
- 	return dentry->d_inode && !d_unhashed(dentry);
 diff --git a/fs/locks.c b/fs/locks.c
-index b286539..fd78ad6 100644
+index 703f545..86106cf 100644
 --- a/fs/locks.c
 +++ b/fs/locks.c
 @@ -129,6 +129,8 @@
@@ -4373,7 +4358,7 @@ index b286539..fd78ad6 100644
  #define IS_POSIX(fl)	(fl->fl_flags & FL_POSIX)
  #define IS_FLOCK(fl)	(fl->fl_flags & FL_FLOCK)
  #define IS_LEASE(fl)	(fl->fl_flags & FL_LEASE)
-@@ -1608,6 +1610,12 @@ SYSCALL_DEFINE2(flock, unsigned int, fd, unsigned int, cmd)
+@@ -1587,6 +1589,12 @@ SYSCALL_DEFINE2(flock, unsigned int, fd, unsigned int, cmd)
  	int can_sleep, unlock;
  	int error;
  
@@ -4386,7 +4371,7 @@ index b286539..fd78ad6 100644
  	error = -EBADF;
  	filp = fget(fd);
  	if (!filp)
-@@ -1621,6 +1629,39 @@ SYSCALL_DEFINE2(flock, unsigned int, fd, unsigned int, cmd)
+@@ -1600,6 +1608,39 @@ SYSCALL_DEFINE2(flock, unsigned int, fd, unsigned int, cmd)
  	    !(filp->f_mode & (FMODE_READ|FMODE_WRITE)))
  		goto out_putf;
  
@@ -4426,7 +4411,7 @@ index b286539..fd78ad6 100644
  	error = flock_make_lock(filp, &lock, cmd);
  	if (error)
  		goto out_putf;
-@@ -1706,6 +1747,12 @@ int fcntl_getlk(struct file *filp, struct flock __user *l)
+@@ -1685,6 +1726,12 @@ int fcntl_getlk(struct file *filp, struct flock __user *l)
  	struct flock flock;
  	int error;
  
@@ -4439,7 +4424,7 @@ index b286539..fd78ad6 100644
  	error = -EFAULT;
  	if (copy_from_user(&flock, l, sizeof(flock)))
  		goto out;
-@@ -1717,6 +1764,33 @@ int fcntl_getlk(struct file *filp, struct flock __user *l)
+@@ -1696,6 +1743,33 @@ int fcntl_getlk(struct file *filp, struct flock __user *l)
  	if (error)
  		goto out;
  
@@ -4473,7 +4458,7 @@ index b286539..fd78ad6 100644
  	error = vfs_test_lock(filp, &file_lock);
  	if (error)
  		goto out;
-@@ -1812,6 +1886,12 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
+@@ -1791,6 +1865,12 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
  	struct file *f;
  	int error;
  
@@ -4486,7 +4471,7 @@ index b286539..fd78ad6 100644
  	if (file_lock == NULL)
  		return -ENOLCK;
  
-@@ -1840,6 +1920,39 @@ again:
+@@ -1819,6 +1899,39 @@ again:
  		file_lock->fl_flags |= FL_SLEEP;
  	}
  	
@@ -4526,7 +4511,7 @@ index b286539..fd78ad6 100644
  	error = -EBADF;
  	switch (flock.l_type) {
  	case F_RDLCK:
-@@ -1891,6 +2004,12 @@ int fcntl_getlk64(struct file *filp, struct flock64 __user *l)
+@@ -1870,6 +1983,12 @@ int fcntl_getlk64(struct file *filp, struct flock64 __user *l)
  	struct flock64 flock;
  	int error;
  
@@ -4539,7 +4524,7 @@ index b286539..fd78ad6 100644
  	error = -EFAULT;
  	if (copy_from_user(&flock, l, sizeof(flock)))
  		goto out;
-@@ -1902,6 +2021,33 @@ int fcntl_getlk64(struct file *filp, struct flock64 __user *l)
+@@ -1881,6 +2000,33 @@ int fcntl_getlk64(struct file *filp, struct flock64 __user *l)
  	if (error)
  		goto out;
  
@@ -4573,7 +4558,7 @@ index b286539..fd78ad6 100644
  	error = vfs_test_lock(filp, &file_lock);
  	if (error)
  		goto out;
-@@ -1930,6 +2076,12 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
+@@ -1909,6 +2055,12 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
  	struct file *f;
  	int error;
  
@@ -4586,7 +4571,7 @@ index b286539..fd78ad6 100644
  	if (file_lock == NULL)
  		return -ENOLCK;
  
-@@ -1975,6 +2127,39 @@ again:
+@@ -1954,6 +2106,39 @@ again:
  		goto out;
  	}
  
@@ -4665,18 +4650,18 @@ index 6e6777f..99a755f 100644
  		new_inode->i_ctime = CURRENT_TIME_SEC;
  		if (dir_de)
 diff --git a/fs/namei.c b/fs/namei.c
-index b456c7a..3a0dc19 100644
+index 3d15072..fd0652f 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
-@@ -33,6 +33,7 @@
- #include <linux/device_cgroup.h>
+@@ -34,6 +34,7 @@
  #include <linux/fs_struct.h>
+ #include <linux/posix_acl.h>
  #include <asm/uaccess.h>
 +#include <rsbac/hooks.h>
  
  #include "internal.h"
  
-@@ -270,6 +271,11 @@ int inode_permission(struct inode *inode, int mask)
+@@ -344,6 +345,11 @@ int inode_permission(struct inode *inode, int mask)
  {
  	int retval;
  
@@ -4685,10 +4670,10 @@ index b456c7a..3a0dc19 100644
 +	  return 0;
 +#endif
 +
- 	if (mask & MAY_WRITE) {
+ 	if (unlikely(mask & MAY_WRITE)) {
  		umode_t mode = inode->i_mode;
  
-@@ -680,6 +686,11 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
+@@ -630,6 +636,11 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
  	int error;
  	struct dentry *dentry = link->dentry;
  
@@ -4700,7 +4685,7 @@ index b456c7a..3a0dc19 100644
  	BUG_ON(nd->flags & LOOKUP_RCU);
  
  	if (link->mnt == nd->path.mnt)
-@@ -703,14 +714,49 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
+@@ -653,14 +664,49 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
  		return error;
  	}
  
@@ -4751,9 +4736,9 @@ index b456c7a..3a0dc19 100644
  		else if (nd->last_type == LAST_BIND) {
  			nd->flags |= LOOKUP_JUMPED;
  			nd->inode = nd->path.dentry->d_inode;
-@@ -1356,6 +1402,11 @@ static int link_path_walk(const char *name, struct nameidata *nd)
+@@ -1384,6 +1430,11 @@ static int link_path_walk(const char *name, struct nameidata *nd)
+ 	struct path next;
  	int err;
- 	unsigned int lookup_flags = nd->flags;
  	
 +#ifdef CONFIG_RSBAC
 +	union rsbac_target_id_t       rsbac_target_id;
@@ -4763,8 +4748,8 @@ index b456c7a..3a0dc19 100644
  	while (*name=='/')
  		name++;
  	if (!*name)
-@@ -1371,9 +1422,35 @@ static int link_path_walk(const char *name, struct nameidata *nd)
- 		nd->flags |= LOOKUP_CONTINUE;
+@@ -1397,9 +1448,35 @@ static int link_path_walk(const char *name, struct nameidata *nd)
+ 		int type;
  
  		err = may_lookup(nd);
 +#ifdef CONFIG_RSBAC_ALLOW_DAC_DISABLE_PART
@@ -4799,7 +4784,7 @@ index b456c7a..3a0dc19 100644
  		this.name = name;
  		c = *(const unsigned char *)name;
  
-@@ -1438,6 +1515,24 @@ last_component:
+@@ -1462,6 +1539,24 @@ last_component:
  		return 0;
  	}
  	terminate_walk(nd);
@@ -4824,7 +4809,7 @@ index b456c7a..3a0dc19 100644
  	return err;
  }
  
-@@ -1672,10 +1767,38 @@ static struct dentry *__lookup_hash(struct qstr *name,
+@@ -1702,10 +1797,38 @@ static struct dentry *__lookup_hash(struct qstr *name,
  	struct dentry *dentry;
  	int err;
  
@@ -4839,7 +4824,7 @@ index b456c7a..3a0dc19 100644
 +	else
 +#endif
 +
- 	err = exec_permission(inode, 0);
+ 	err = inode_permission(inode, MAY_EXEC);
  	if (err)
  		return ERR_PTR(err);
  
@@ -4863,7 +4848,7 @@ index b456c7a..3a0dc19 100644
  	/*
  	 * Don't bother with __d_lookup: callers are for creat as
  	 * well as unlink, so a lot of the time it would cost
-@@ -1747,6 +1870,71 @@ struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
+@@ -1803,6 +1926,97 @@ struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
  	return __lookup_hash(&this, base, NULL);
  }
  
@@ -4886,8 +4871,34 @@ index b456c7a..3a0dc19 100644
 +	 */
 +	dentry = d_lookup(base, name);
 +
-+	if (dentry && (dentry->d_flags & DCACHE_OP_REVALIDATE))
-+		dentry = do_revalidate(dentry, nd);
++	if (dentry && d_need_lookup(dentry)) {
++		/*
++		 * __lookup_hash is called with the parent dir's i_mutex already
++		 * held, so we are good to go here.
++		 */
++		dentry = d_inode_lookup(base, dentry, nd);
++		if (IS_ERR(dentry))
++			return dentry;
++	}
++
++	if (dentry && (dentry->d_flags & DCACHE_OP_REVALIDATE)) {
++		int status = d_revalidate(dentry, nd);
++		if (unlikely(status <= 0)) {
++			/*
++			 * The dentry failed validation.
++			 * If d_revalidate returned 0 attempt to invalidate
++			 * the dentry otherwise d_revalidate is asking us
++			 * to return a fail status.
++			 */
++			if (status < 0) {
++				dput(dentry);
++				return ERR_PTR(status);
++			} else if (!d_invalidate(dentry)) {
++				dput(dentry);
++				dentry = NULL;
++			}
++		}
++	}
 +
 +	if (!dentry)
 +		dentry = d_alloc_and_lookup(base, name, nd);
@@ -4932,10 +4943,10 @@ index b456c7a..3a0dc19 100644
 +EXPORT_SYMBOL(rsbac_lookup_one_len);
 +#endif
 +
- int user_path_at(int dfd, const char __user *name, unsigned flags,
- 		 struct path *path)
+ int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
+ 		 struct path *path, int *empty)
  {
-@@ -1833,6 +2021,11 @@ static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
+@@ -1895,6 +2109,11 @@ static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
  	BUG_ON(victim->d_parent->d_inode != dir);
  	audit_inode_child(victim, dir);
  
@@ -4947,7 +4958,7 @@ index b456c7a..3a0dc19 100644
  	error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
  	if (error)
  		return error;
-@@ -1869,6 +2062,12 @@ static inline int may_create(struct inode *dir, struct dentry *child)
+@@ -1931,6 +2150,12 @@ static inline int may_create(struct inode *dir, struct dentry *child)
  		return -EEXIST;
  	if (IS_DEADDIR(dir))
  		return -ENOENT;
@@ -4960,7 +4971,7 @@ index b456c7a..3a0dc19 100644
  	return inode_permission(dir, MAY_WRITE | MAY_EXEC);
  }
  
-@@ -1919,6 +2118,14 @@ int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
+@@ -1981,6 +2206,14 @@ int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
  {
  	int error = may_create(dir, dentry);
  
@@ -4975,7 +4986,7 @@ index b456c7a..3a0dc19 100644
  	if (error)
  		return error;
  
-@@ -1929,9 +2136,52 @@ int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
+@@ -1991,9 +2224,52 @@ int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
  	error = security_inode_create(dir, dentry, mode);
  	if (error)
  		return error;
@@ -5029,7 +5040,7 @@ index b456c7a..3a0dc19 100644
  	return error;
  }
  
-@@ -1966,6 +2216,12 @@ static int may_open(struct path *path, int acc_mode, int flag)
+@@ -2028,6 +2304,12 @@ static int may_open(struct path *path, int acc_mode, int flag)
  		break;
  	}
  
@@ -5042,7 +5053,7 @@ index b456c7a..3a0dc19 100644
  	error = inode_permission(inode, acc_mode);
  	if (error)
  		return error;
-@@ -2051,6 +2307,14 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2096,6 +2378,14 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  	struct file *filp;
  	int error;
  
@@ -5057,7 +5068,7 @@ index b456c7a..3a0dc19 100644
  	nd->flags &= ~LOOKUP_PARENT;
  	nd->flags |= op->intent;
  
-@@ -2198,6 +2462,70 @@ ok:
+@@ -2254,6 +2544,68 @@ ok:
  		want_write = 1;
  	}
  common:
@@ -5099,18 +5110,16 @@ index b456c7a..3a0dc19 100644
 +	if (open_flag & O_APPEND)
 +		rsbac_adf_req = R_APPEND_OPEN;
 +	else
-+		if ((open_flag & FMODE_WRITE) && (open_flag & FMODE_READ))
++		if ((open_flag & O_RDWR) || ((open_flag & O_WRONLY) && (open_flag & O_RDONLY)))
 +			rsbac_adf_req = R_READ_WRITE_OPEN;
 +		else
-+			if (open_flag & FMODE_WRITE)
++			if (open_flag & O_WRONLY)
 +				rsbac_adf_req = R_WRITE_OPEN;
 +			else
-+				if (open_flag & FMODE_READ) {
-+					if (rsbac_target == T_DIR)
-+						rsbac_adf_req = R_READ;
-+					else
-+						rsbac_adf_req = R_READ_OPEN;
-+				}
++				if (rsbac_target == T_DIR)
++					rsbac_adf_req = R_READ;
++				else
++					rsbac_adf_req = R_READ_OPEN;
 +	if ((rsbac_adf_req != R_NONE) && (rsbac_target != T_NONE)) {
 +		rsbac_attribute_value.open_flag = open_flag;
 +		if (!rsbac_adf_request(rsbac_adf_req,
@@ -5128,13 +5137,13 @@ index b456c7a..3a0dc19 100644
  	error = may_open(&nd->path, acc_mode, open_flag);
  	if (error)
  		goto exit;
-@@ -2221,6 +2549,24 @@ common:
+@@ -2277,6 +2629,24 @@ common:
  out:
  	if (want_write)
  		mnt_drop_write(nd->path.mnt);
 +
 +#ifdef CONFIG_RSBAC
-+	if ((rsbac_adf_req != R_NONE) && (rsbac_target != T_NONE)) {
++	if (!PTR_ERR(filp) && (rsbac_adf_req != R_NONE) && (rsbac_target != T_NONE)) {
 +		rsbac_new_target_id.dummy = 0;
 +		if (rsbac_adf_set_attr(rsbac_adf_req,
 +					task_pid(current),
@@ -5153,7 +5162,7 @@ index b456c7a..3a0dc19 100644
  	path_put(&nd->path);
  	return filp;
  
-@@ -2240,6 +2586,10 @@ static struct file *path_openat(int dfd, const char *pathname,
+@@ -2296,6 +2666,10 @@ static struct file *path_openat(int dfd, const char *pathname,
  	struct file *filp;
  	struct path path;
  	int error;
@@ -5164,7 +5173,7 @@ index b456c7a..3a0dc19 100644
  
  	filp = get_empty_filp();
  	if (!filp)
-@@ -2268,6 +2618,25 @@ static struct file *path_openat(int dfd, const char *pathname,
+@@ -2324,6 +2698,25 @@ static struct file *path_openat(int dfd, const char *pathname,
  			path_put(&nd->path);
  			filp = ERR_PTR(-ELOOP);
  			break;
@@ -5190,7 +5199,7 @@ index b456c7a..3a0dc19 100644
  		}
  		nd->flags |= LOOKUP_PARENT;
  		nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
-@@ -2384,6 +2753,13 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
+@@ -2451,6 +2844,13 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
  {
  	int error = may_create(dir, dentry);
  
@@ -5204,7 +5213,7 @@ index b456c7a..3a0dc19 100644
  	if (error)
  		return error;
  
-@@ -2402,9 +2778,57 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
+@@ -2469,9 +2869,57 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
  	if (error)
  		return error;
  
@@ -5263,7 +5272,7 @@ index b456c7a..3a0dc19 100644
  	return error;
  }
  
-@@ -2489,6 +2913,12 @@ int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+@@ -2548,6 +2996,12 @@ int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
  {
  	int error = may_create(dir, dentry);
  
@@ -5276,7 +5285,7 @@ index b456c7a..3a0dc19 100644
  	if (error)
  		return error;
  
-@@ -2500,9 +2930,48 @@ int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+@@ -2559,9 +3013,48 @@ int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
  	if (error)
  		return error;
  
@@ -5326,7 +5335,7 @@ index b456c7a..3a0dc19 100644
  	return error;
  }
  
-@@ -2576,6 +3045,12 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
+@@ -2626,6 +3119,12 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
  {
  	int error = may_delete(dir, dentry, 1);
  
@@ -5339,7 +5348,7 @@ index b456c7a..3a0dc19 100644
  	if (error)
  		return error;
  
-@@ -2583,6 +3058,24 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
+@@ -2633,6 +3132,24 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
  		return -EPERM;
  
  	dget(dentry);
@@ -5364,7 +5373,7 @@ index b456c7a..3a0dc19 100644
  	mutex_lock(&dentry->d_inode->i_mutex);
  
  	error = -EBUSY;
-@@ -2606,6 +3099,24 @@ out:
+@@ -2656,6 +3173,24 @@ out:
  	dput(dentry);
  	if (!error)
  		d_delete(dentry);
@@ -5389,7 +5398,7 @@ index b456c7a..3a0dc19 100644
  	return error;
  }
  
-@@ -2671,6 +3182,13 @@ int vfs_unlink(struct inode *dir, struct dentry *dentry)
+@@ -2721,6 +3256,13 @@ int vfs_unlink(struct inode *dir, struct dentry *dentry)
  {
  	int error = may_delete(dir, dentry, 0);
  
@@ -5403,7 +5412,7 @@ index b456c7a..3a0dc19 100644
  	if (error)
  		return error;
  
-@@ -2683,9 +3201,58 @@ int vfs_unlink(struct inode *dir, struct dentry *dentry)
+@@ -2733,9 +3275,58 @@ int vfs_unlink(struct inode *dir, struct dentry *dentry)
  	else {
  		error = security_inode_unlink(dir, dentry);
  		if (!error) {
@@ -5462,7 +5471,7 @@ index b456c7a..3a0dc19 100644
  		}
  	}
  	mutex_unlock(&dentry->d_inode->i_mutex);
-@@ -2780,6 +3347,12 @@ int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
+@@ -2830,6 +3421,12 @@ int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
  {
  	int error = may_create(dir, dentry);
  
@@ -5475,7 +5484,7 @@ index b456c7a..3a0dc19 100644
  	if (error)
  		return error;
  
-@@ -2790,9 +3363,48 @@ int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
+@@ -2840,9 +3437,48 @@ int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
  	if (error)
  		return error;
  
@@ -5525,7 +5534,7 @@ index b456c7a..3a0dc19 100644
  	return error;
  }
  
-@@ -2848,6 +3460,12 @@ int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_de
+@@ -2891,6 +3527,12 @@ int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_de
  	struct inode *inode = old_dentry->d_inode;
  	int error;
  
@@ -5538,7 +5547,7 @@ index b456c7a..3a0dc19 100644
  	if (!inode)
  		return -ENOENT;
  
-@@ -2872,6 +3490,32 @@ int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_de
+@@ -2915,6 +3557,32 @@ int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_de
  	if (error)
  		return error;
  
@@ -5571,7 +5580,7 @@ index b456c7a..3a0dc19 100644
  	mutex_lock(&inode->i_mutex);
  	/* Make sure we don't allow creating hardlink to an unlinked file */
  	if (inode->i_nlink == 0)
-@@ -2993,11 +3637,27 @@ static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
+@@ -3029,11 +3697,27 @@ static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
  	int error = 0;
  	struct inode *target = new_dentry->d_inode;
  
@@ -5599,7 +5608,7 @@ index b456c7a..3a0dc19 100644
  		error = inode_permission(old_dentry->d_inode, MAY_WRITE);
  		if (error)
  			return error;
-@@ -3007,6 +3667,74 @@ static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
+@@ -3043,6 +3727,74 @@ static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
  	if (error)
  		return error;
  
@@ -5674,7 +5683,7 @@ index b456c7a..3a0dc19 100644
  	dget(new_dentry);
  	if (target)
  		mutex_lock(&target->i_mutex);
-@@ -3029,23 +3757,134 @@ out:
+@@ -3065,23 +3817,135 @@ out:
  	if (target)
  		mutex_unlock(&target->i_mutex);
  	dput(new_dentry);
@@ -5738,6 +5747,8 @@ index b456c7a..3a0dc19 100644
  	if (error)
  		return error;
  
+ 	dget(new_dentry);
++
 +#ifdef CONFIG_RSBAC
 +	rsbac_pr_debug(aef, "[sys_rename()]: calling ADF\n");
 +	rsbac_target = T_FILE;
@@ -5758,8 +5769,8 @@ index b456c7a..3a0dc19 100644
 +				rsbac_target,
 +				rsbac_target_id,
 +				A_new_dir_dentry_p,
-+				rsbac_attribute_value))
-+	{
++				rsbac_attribute_value)) {
++		dput(new_dentry);
 +		return -EPERM;
 +	}
 +	if (new_dir != old_dir) {
@@ -5774,6 +5785,7 @@ index b456c7a..3a0dc19 100644
 +					rsbac_target_id2,
 +					A_none,
 +					rsbac_attribute_value2)) {
++			dput(new_dentry);
 +			return -EPERM;
 +		}
 +	}
@@ -5798,20 +5810,18 @@ index b456c7a..3a0dc19 100644
 +					rsbac_target2,
 +					rsbac_target_id2,
 +					A_nlink,
-+					rsbac_attribute_value2))
-+		{
++					rsbac_attribute_value2)) {
++			dput(new_dentry);
 +			return -EPERM;
 +		}
 +	}
 +#endif
 +
- 	dget(new_dentry);
-+
 +	target = new_dentry->d_inode;
  	if (target)
  		mutex_lock(&target->i_mutex);
  
-@@ -3061,6 +3900,35 @@ static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
+@@ -3097,6 +3961,35 @@ static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
  		dont_mount(new_dentry);
  	if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
  		d_move(old_dentry, new_dentry);
@@ -5847,7 +5857,7 @@ index b456c7a..3a0dc19 100644
  out:
  	if (target)
  		mutex_unlock(&target->i_mutex);
-@@ -3208,6 +4076,9 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
+@@ -3244,6 +4137,9 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
  int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
  {
  	int len;
@@ -5857,7 +5867,7 @@ index b456c7a..3a0dc19 100644
  
  	len = PTR_ERR(link);
  	if (IS_ERR(link))
-@@ -3216,8 +4087,20 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
+@@ -3252,6 +4148,17 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
  	len = strlen(link);
  	if (len > (unsigned) buflen)
  		len = buflen;
@@ -5874,12 +5884,9 @@ index b456c7a..3a0dc19 100644
 +#endif
  	if (copy_to_user(buffer, link, len))
  		len = -EFAULT;
-+
  out:
- 	return len;
- }
 diff --git a/fs/namespace.c b/fs/namespace.c
-index fe59bd1..497c7be 100644
+index e5e1c7d..1b35322 100644
 --- a/fs/namespace.c
 +++ b/fs/namespace.c
 @@ -33,6 +33,7 @@
@@ -5945,7 +5952,7 @@ index fe59bd1..497c7be 100644
  	return mnt;
  }
  EXPORT_SYMBOL_GPL(vfs_kern_mount);
-@@ -1266,6 +1294,11 @@ static int do_umount(struct vfsmount *mnt, int flags)
+@@ -1267,6 +1295,11 @@ static int do_umount(struct vfsmount *mnt, int flags)
  	int retval;
  	LIST_HEAD(umount_list);
  
@@ -5957,7 +5964,7 @@ index fe59bd1..497c7be 100644
  	retval = security_sb_umount(mnt, flags);
  	if (retval)
  		return retval;
-@@ -1296,6 +1329,46 @@ static int do_umount(struct vfsmount *mnt, int flags)
+@@ -1297,6 +1330,46 @@ static int do_umount(struct vfsmount *mnt, int flags)
  			return -EAGAIN;
  	}
  
@@ -6004,7 +6011,7 @@ index fe59bd1..497c7be 100644
  	/*
  	 * If we may have to abort operations to get out of this
  	 * mount, and they will themselves hold resources we must
-@@ -1345,6 +1418,17 @@ static int do_umount(struct vfsmount *mnt, int flags)
+@@ -1346,6 +1419,17 @@ static int do_umount(struct vfsmount *mnt, int flags)
  		retval = 0;
  	}
  	br_write_unlock(vfsmount_lock);
@@ -6022,7 +6029,7 @@ index fe59bd1..497c7be 100644
  	up_write(&namespace_sem);
  	release_mounts(&umount_list);
  	return retval;
-@@ -1753,6 +1837,13 @@ static int do_loopback(struct path *path, char *old_name,
+@@ -1754,6 +1838,13 @@ static int do_loopback(struct path *path, char *old_name,
  	struct path old_path;
  	struct vfsmount *mnt = NULL;
  	int err = mount_is_safe(path);
@@ -6036,21 +6043,15 @@ index fe59bd1..497c7be 100644
  	if (err)
  		return err;
  	if (!old_name || !*old_name)
-@@ -1765,6 +1856,88 @@ static int do_loopback(struct path *path, char *old_name,
+@@ -1766,6 +1857,57 @@ static int do_loopback(struct path *path, char *old_name,
  	if (err)
  		goto out;
  
 +#ifdef CONFIG_RSBAC
 +	rsbac_pr_debug(aef, "[do_loopback() [sys_mount()]]: calling ADF for DIR\n");
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
 +	rsbac_target_id.dir.device = old_path.dentry->d_sb->s_dev;
 +	rsbac_target_id.dir.inode  = old_path.dentry->d_inode->i_ino;
 +	rsbac_target_id.dir.dentry_p = old_path.dentry;
-+#else
-+	rsbac_target_id.dir.device = nd->path.dentry->d_sb->s_dev;
-+	rsbac_target_id.dir.inode  = nd->path.dentry->d_inode->i_ino;
-+	rsbac_target_id.dir.dentry_p = nd->path.dentry;
-+#endif
 +	rsbac_attribute_value.mode = recurse;
 +	if (!rsbac_adf_request(R_MOUNT,
 +				task_pid(current),
@@ -6063,52 +6064,27 @@ index fe59bd1..497c7be 100644
 +		goto out2;
 +	}
 +	rsbac_pr_debug(aef, "[do_mount() [sys_mount()]]: calling ADF for DEV\n");
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
 +	if(S_ISBLK(old_path.dentry->d_inode->i_mode))
-+#else
-+	if(S_ISBLK(old_nd.path.dentry->d_inode->i_mode))
-+#endif
 +	{
 +		rsbac_target = T_DEV;
 +		rsbac_target_id.dev.type = D_block;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
 +		rsbac_target_id.dev.major = RSBAC_MAJOR(old_path.dentry->d_sb->s_dev);
 +		rsbac_target_id.dev.minor = RSBAC_MINOR(old_path.dentry->d_sb->s_dev);
-+#else
-+		rsbac_target_id.dev.major = RSBAC_MAJOR(old_nd.path.dentry->d_sb->s_dev);
-+		rsbac_target_id.dev.minor = RSBAC_MINOR(old_nd.path.dentry->d_sb->s_dev);
-+#endif
 +	}
 +	else
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
 +		if(S_ISDIR(old_path.dentry->d_inode->i_mode))
-+#else
-+		if(S_ISDIR(old_nd.path.dentry->d_inode->i_mode))
-+#endif
 +		{
 +			rsbac_target = T_DIR;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
 +			rsbac_target_id.dir.device = old_path.dentry->d_sb->s_dev;
 +			rsbac_target_id.dir.inode  = old_path.dentry->d_inode->i_ino;
 +			rsbac_target_id.dir.dentry_p = old_path.dentry;
-+#else
-+			rsbac_target_id.dir.device = old_nd.path.dentry->d_sb->s_dev;
-+			rsbac_target_id.dir.inode  = old_nd.path.dentry->d_inode->i_ino;
-+			rsbac_target_id.dir.dentry_p = old_nd.path.dentry;
-+#endif
 +		}
 +		else
 +		{
 +			rsbac_target = T_FILE;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
 +			rsbac_target_id.file.device = old_path.dentry->d_sb->s_dev;
 +			rsbac_target_id.file.inode  = old_path.dentry->d_inode->i_ino;
 +			rsbac_target_id.file.dentry_p = old_path.dentry;
-+#else
-+			rsbac_target_id.file.device = old_nd.path.dentry->d_sb->s_dev;
-+			rsbac_target_id.file.inode  = old_nd.path.dentry->d_inode->i_ino;
-+			rsbac_target_id.file.dentry_p = old_nd.path.dentry;
-+#endif
 +		}
 +	if (!rsbac_adf_request(R_MOUNT,
 +				task_pid(current),
@@ -6125,7 +6101,7 @@ index fe59bd1..497c7be 100644
  	err = -EINVAL;
  	if (IS_MNT_UNBINDABLE(old_path.mnt))
  		goto out2;
-@@ -1792,6 +1965,12 @@ out2:
+@@ -1793,6 +1935,12 @@ out2:
  	release_mounts(&umount_list);
  out:
  	path_put(&old_path);
@@ -6138,7 +6114,7 @@ index fe59bd1..497c7be 100644
  	return err;
  }
  
-@@ -1823,6 +2002,11 @@ static int do_remount(struct path *path, int flags, int mnt_flags,
+@@ -1824,6 +1972,11 @@ static int do_remount(struct path *path, int flags, int mnt_flags,
  	int err;
  	struct super_block *sb = path->mnt->mnt_sb;
  
@@ -6150,21 +6126,15 @@ index fe59bd1..497c7be 100644
  	if (!capable(CAP_SYS_ADMIN))
  		return -EPERM;
  
-@@ -1836,6 +2020,40 @@ static int do_remount(struct path *path, int flags, int mnt_flags,
+@@ -1837,6 +1990,34 @@ static int do_remount(struct path *path, int flags, int mnt_flags,
  	if (err)
  		return err;
  
 +#ifdef CONFIG_RSBAC
 +	rsbac_pr_debug(aef, "[do_mount() [sys_mount()]]: calling ADF for DIR\n");
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
 +	rsbac_target_id.dir.device = path->dentry->d_sb->s_dev;
 +	rsbac_target_id.dir.inode  = path->dentry->d_inode->i_ino;
 +	rsbac_target_id.dir.dentry_p = path->dentry;
-+#else
-+	rsbac_target_id.dir.device = nd->path.dentry->d_sb->s_dev;
-+	rsbac_target_id.dir.inode  = nd->path.dentry->d_inode->i_ino;
-+	rsbac_target_id.dir.dentry_p = nd->path.dentry;
-+#endif
 +	rsbac_attribute_value.mode = flags;
 +	if (!rsbac_adf_request(R_MOUNT,
 +				task_pid(current),
@@ -6191,7 +6161,7 @@ index fe59bd1..497c7be 100644
  	down_write(&sb->s_umount);
  	if (flags & MS_BIND)
  		err = change_mount_flags(path->mnt, flags);
-@@ -1871,6 +2089,12 @@ static int do_move_mount(struct path *path, char *old_name)
+@@ -1872,6 +2053,12 @@ static int do_move_mount(struct path *path, char *old_name)
  	struct path old_path, parent_path;
  	struct vfsmount *p;
  	int err = 0;
@@ -6204,21 +6174,15 @@ index fe59bd1..497c7be 100644
  	if (!capable(CAP_SYS_ADMIN))
  		return -EPERM;
  	if (!old_name || !*old_name)
-@@ -1883,6 +2107,75 @@ static int do_move_mount(struct path *path, char *old_name)
+@@ -1884,6 +2071,61 @@ static int do_move_mount(struct path *path, char *old_name)
  	if (err < 0)
  		goto out;
  
 +#ifdef CONFIG_RSBAC
 +	rsbac_pr_debug(aef, "[do_mount() [sys_mount()]]: calling ADF for UMOUNT on old DIR\n");
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
 +	rsbac_target_id.dir.device = old_path.dentry->d_sb->s_dev;
 +	rsbac_target_id.dir.inode  = old_path.dentry->d_inode->i_ino;
 +	rsbac_target_id.dir.dentry_p = old_path.dentry;
-+#else
-+	rsbac_target_id.dir.device = old_nd.path.dentry->d_sb->s_dev;
-+	rsbac_target_id.dir.inode  = old_nd.path.dentry->d_inode->i_ino;
-+	rsbac_target_id.dir.dentry_p = old_nd.path.dentry;
-+#endif
 +	rsbac_attribute_value.dummy = 0;
 +	if (!rsbac_adf_request(R_UMOUNT,
 +				task_pid(current),
@@ -6227,7 +6191,7 @@ index fe59bd1..497c7be 100644
 +				A_none,
 +				rsbac_attribute_value))	{
 +		err = -EPERM;
-+		goto out;
++		goto out1;
 +	}
 +	rsbac_pr_debug(aef, "[do_mount() [sys_mount()]]: calling ADF for MOUNT on new DIR\n");
 +	rsbac_target_id.dir.device = path->dentry->d_sb->s_dev;
@@ -6239,29 +6203,22 @@ index fe59bd1..497c7be 100644
 +				T_DIR,
 +				rsbac_target_id,
 +				A_none,
-+				rsbac_attribute_value))
-+	{
++				rsbac_attribute_value)) {
 +		err = -EPERM;
-+		goto out;
++		goto out1;
 +	}
 +	rsbac_pr_debug(aef, "[do_mount() [sys_mount()]]: calling ADF for UMOUNT on DEV\n");
 +	rsbac_target_id.dev.type = D_block;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
 +	rsbac_target_id.dev.major = RSBAC_MAJOR(old_path.dentry->d_sb->s_dev);
 +	rsbac_target_id.dev.minor = RSBAC_MINOR(old_path.dentry->d_sb->s_dev);
-+#else
-+	rsbac_target_id.dev.major = RSBAC_MAJOR(old_nd.path.dentry->d_sb->s_dev);
-+	rsbac_target_id.dev.minor = RSBAC_MINOR(old_nd.path.dentry->d_sb->s_dev);
-+#endif
 +	if (!rsbac_adf_request(R_UMOUNT,
 +				task_pid(current),
 +				T_DEV,
 +				rsbac_target_id,
 +				A_none,
-+				rsbac_attribute_value))
-+	{
++				rsbac_attribute_value)) {
 +		err = -EPERM;
-+		goto out;
++		goto out1;
 +	}
 +	rsbac_pr_debug(aef, "[do_mount() [sys_mount()]]: calling ADF for MOUNT on DEV\n");
 +	if (!rsbac_adf_request(R_MOUNT,
@@ -6269,10 +6226,9 @@ index fe59bd1..497c7be 100644
 +				T_DEV,
 +				rsbac_target_id,
 +				A_none,
-+				rsbac_attribute_value))
-+	{
++				rsbac_attribute_value)) {
 +		err = -EPERM;
-+		goto out;
++		goto out1;
 +	}
 +#endif
 +
@@ -6280,7 +6236,7 @@ index fe59bd1..497c7be 100644
  	err = -EINVAL;
  	if (!check_mnt(path->mnt) || !check_mnt(old_path.mnt))
  		goto out1;
-@@ -1922,6 +2215,10 @@ static int do_move_mount(struct path *path, char *old_name)
+@@ -1923,6 +2165,10 @@ static int do_move_mount(struct path *path, char *old_name)
  	if (err)
  		goto out1;
  
@@ -6291,7 +6247,7 @@ index fe59bd1..497c7be 100644
  	/* if the mount is moved, it should no longer be expire
  	 * automatically */
  	list_del_init(&old_path.mnt->mnt_expire);
-@@ -1980,12 +2277,50 @@ static int do_add_mount(struct vfsmount *newmnt, struct path *path, int mnt_flag
+@@ -1981,12 +2227,50 @@ static int do_add_mount(struct vfsmount *newmnt, struct path *path, int mnt_flag
  {
  	int err;
  
@@ -6342,7 +6298,7 @@ index fe59bd1..497c7be 100644
  	err = -EINVAL;
  	if (!(mnt_flags & MNT_SHRINKABLE) && !check_mnt(path->mnt))
  		goto unlock;
-@@ -2560,6 +2895,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
+@@ -2561,6 +2845,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
  	struct path new, old, parent_path, root_parent, root;
  	int error;
  
@@ -6354,7 +6310,7 @@ index fe59bd1..497c7be 100644
  	if (!capable(CAP_SYS_ADMIN))
  		return -EPERM;
  
-@@ -2580,6 +2920,42 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
+@@ -2581,6 +2870,42 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
  	if (error)
  		goto out3;
  
@@ -6397,7 +6353,7 @@ index fe59bd1..497c7be 100644
  	error = -EINVAL;
  	if (IS_MNT_SHARED(old.mnt) ||
  		IS_MNT_SHARED(new.mnt->mnt_parent) ||
-@@ -2656,6 +3032,10 @@ static void __init init_mount_tree(void)
+@@ -2657,6 +2982,10 @@ static void __init init_mount_tree(void)
  	if (IS_ERR(mnt))
  		panic("Can't create rootfs");
  
@@ -6409,7 +6365,7 @@ index fe59bd1..497c7be 100644
  	if (IS_ERR(ns))
  		panic("Can't allocate initial namespace");
 diff --git a/fs/open.c b/fs/open.c
-index b52cf01..8c7bc7f 100644
+index f711921..897375c 100644
 --- a/fs/open.c
 +++ b/fs/open.c
 @@ -33,16 +33,52 @@
@@ -6732,65 +6688,9 @@ index b52cf01..8c7bc7f 100644
  	set_fs_root(current->fs, &path);
  	error = 0;
  dput_and_out:
-@@ -454,6 +658,12 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd, mode_t, mode)
- 	int err = -EBADF;
+@@ -452,9 +656,50 @@ static int chmod_common(struct path *path, umode_t mode)
  	struct iattr newattrs;
- 
-+#ifdef CONFIG_RSBAC
-+	enum  rsbac_target_t rsbac_target;
-+	union rsbac_target_id_t rsbac_target_id;
-+	union rsbac_attribute_value_t rsbac_attribute_value;
-+#endif
-+
- 	file = fget(fd);
- 	if (!file)
- 		goto out;
-@@ -466,6 +676,42 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd, mode_t, mode)
- 	err = mnt_want_write_file(file);
- 	if (err)
- 		goto out_putf;
-+
-+#ifdef CONFIG_RSBAC
-+	rsbac_pr_debug(aef, "calling ADF\n");
-+	rsbac_target = T_FILE;
-+	rsbac_target_id.file.device = inode->i_sb->s_dev;
-+	rsbac_target_id.file.inode  = inode->i_ino;
-+	rsbac_target_id.file.dentry_p = dentry;
-+	if (S_ISDIR(inode->i_mode))
-+		rsbac_target = T_DIR;
-+	else if (S_ISFIFO(inode->i_mode))
-+		rsbac_target = T_FIFO;
-+	else if (S_ISLNK(inode->i_mode))
-+		rsbac_target = T_SYMLINK;
-+	else if (S_ISSOCK(inode->i_mode)) {
-+		if(inode->i_sb->s_magic == SOCKFS_MAGIC) {
-+			rsbac_target = T_IPC;
-+			rsbac_target_id.ipc.type = I_anonunix;
-+			rsbac_target_id.ipc.id.id_nr = inode->i_ino;
-+		} else {
-+			rsbac_target = T_UNIXSOCK;
-+		}
-+	}
-+	rsbac_attribute_value.mode = mode;
-+	if (!rsbac_adf_request(R_MODIFY_PERMISSIONS_DATA,
-+				task_pid(current),
-+				rsbac_target,
-+				rsbac_target_id,
-+				A_mode,
-+				rsbac_attribute_value))
-+	{
-+		err = -EPERM;
-+		mnt_drop_write(file->f_path.mnt);
-+		goto out_putf;
-+	}
-+#endif
-+
- 	mutex_lock(&inode->i_mutex);
- 	err = security_path_chmod(dentry, file->f_vfsmnt, mode);
- 	if (err)
-@@ -491,6 +737,12 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename, mode_t, mode)
  	int error;
- 	struct iattr newattrs;
  
 +#ifdef CONFIG_RSBAC
 +	enum  rsbac_target_t rsbac_target;
@@ -6798,19 +6698,16 @@ index b52cf01..8c7bc7f 100644
 +	union rsbac_attribute_value_t rsbac_attribute_value;
 +#endif
 +
- 	error = user_path_at(dfd, filename, LOOKUP_FOLLOW, &path);
- 	if (error)
- 		goto out;
-@@ -499,6 +751,41 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename, mode_t, mode)
- 	error = mnt_want_write(path.mnt);
+ 	error = mnt_want_write(path->mnt);
  	if (error)
- 		goto dput_and_out;
+ 		return error;
++
 +#ifdef CONFIG_RSBAC
 +	rsbac_pr_debug(aef, "calling ADF\n");
 +	rsbac_target = T_FILE;
 +	rsbac_target_id.file.device = inode->i_sb->s_dev;
 +	rsbac_target_id.file.inode  = inode->i_ino;
-+	rsbac_target_id.file.dentry_p = path.dentry;
++	rsbac_target_id.file.dentry_p = path->dentry;
 +	if (S_ISDIR(inode->i_mode))
 +		rsbac_target = T_DIR;
 +	else if (S_ISFIFO(inode->i_mode))
@@ -6834,16 +6731,15 @@ index b52cf01..8c7bc7f 100644
 +				A_mode,
 +				rsbac_attribute_value))
 +	{
-+		error = -EPERM;
-+		mnt_drop_write(path.mnt);
-+		goto dput_and_out;
++		mnt_drop_write(path->mnt);
++		return -EPERM;
 +	}
 +#endif
 +
  	mutex_lock(&inode->i_mutex);
- 	error = security_path_chmod(path.dentry, path.mnt, mode);
+ 	error = security_path_chmod(path->dentry, path->mnt, mode);
  	if (error)
-@@ -528,6 +815,36 @@ static int chown_common(struct path *path, uid_t user, gid_t group)
+@@ -506,6 +751,38 @@ static int chown_common(struct path *path, uid_t user, gid_t group)
  	int error;
  	struct iattr newattrs;
  
@@ -6851,7 +6747,9 @@ index b52cf01..8c7bc7f 100644
 +	enum  rsbac_target_t rsbac_target;
 +	union rsbac_target_id_t rsbac_target_id;
 +	union rsbac_attribute_value_t rsbac_attribute_value;
++#endif
 +
++#ifdef CONFIG_RSBAC
 +	rsbac_pr_debug(aef, "[sys_*chown]: calling ADF\n");
 +	rsbac_target = T_FILE;
 +	if (S_ISDIR(inode->i_mode))
@@ -6880,7 +6778,7 @@ index b52cf01..8c7bc7f 100644
  	newattrs.ia_valid =  ATTR_CTIME;
  	if (user != (uid_t) -1) {
  		newattrs.ia_valid |= ATTR_UID;
-@@ -1060,11 +1377,92 @@ int filp_close(struct file *filp, fl_owner_t id)
+@@ -1038,11 +1315,92 @@ int filp_close(struct file *filp, fl_owner_t id)
  {
  	int retval = 0;
  
@@ -6973,7 +6871,7 @@ index b52cf01..8c7bc7f 100644
  	if (filp->f_op && filp->f_op->flush)
  		retval = filp->f_op->flush(filp, id);
  
-@@ -1072,6 +1470,26 @@ int filp_close(struct file *filp, fl_owner_t id)
+@@ -1050,6 +1408,26 @@ int filp_close(struct file *filp, fl_owner_t id)
  		dnotify_flush(filp, id);
  		locks_remove_posix(filp, id);
  	}
@@ -7001,7 +6899,7 @@ index b52cf01..8c7bc7f 100644
  	return retval;
  }
 diff --git a/fs/pipe.c b/fs/pipe.c
-index da42f7d..c142429 100644
+index 0e0be1d..967dcdec 100644
 --- a/fs/pipe.c
 +++ b/fs/pipe.c
 @@ -24,6 +24,8 @@
@@ -7348,7 +7246,7 @@ index da42f7d..c142429 100644
  	return retval;
  }
  
-@@ -798,6 +1047,27 @@ pipe_read_open(struct inode *inode, struct file *filp)
+@@ -798,6 +1047,29 @@ pipe_read_open(struct inode *inode, struct file *filp)
  {
  	int ret = -ENOENT;
  
@@ -7356,7 +7254,9 @@ index da42f7d..c142429 100644
 +	union rsbac_target_id_t rsbac_target_id;
 +	union rsbac_target_id_t rsbac_new_target_id;
 +	union rsbac_attribute_value_t rsbac_attribute_value;
++#endif
 +
++#ifdef CONFIG_RSBAC
 +	rsbac_pr_debug(aef, "calling ADF\n");
 +	rsbac_target_id.ipc.type = I_anonpipe;
 +	rsbac_target_id.ipc.id.id_nr = inode->i_ino;
@@ -7376,7 +7276,7 @@ index da42f7d..c142429 100644
  	mutex_lock(&inode->i_mutex);
  
  	if (inode->i_pipe) {
-@@ -807,6 +1077,22 @@ pipe_read_open(struct inode *inode, struct file *filp)
+@@ -807,6 +1079,22 @@ pipe_read_open(struct inode *inode, struct file *filp)
  
  	mutex_unlock(&inode->i_mutex);
  
@@ -7399,7 +7299,7 @@ index da42f7d..c142429 100644
  	return ret;
  }
  
-@@ -815,6 +1101,29 @@ pipe_write_open(struct inode *inode, struct file *filp)
+@@ -815,6 +1103,29 @@ pipe_write_open(struct inode *inode, struct file *filp)
  {
  	int ret = -ENOENT;
  
@@ -7429,7 +7329,7 @@ index da42f7d..c142429 100644
  	mutex_lock(&inode->i_mutex);
  
  	if (inode->i_pipe) {
-@@ -824,6 +1133,22 @@ pipe_write_open(struct inode *inode, struct file *filp)
+@@ -824,6 +1135,22 @@ pipe_write_open(struct inode *inode, struct file *filp)
  
  	mutex_unlock(&inode->i_mutex);
  
@@ -7452,7 +7352,7 @@ index da42f7d..c142429 100644
  	return ret;
  }
  
-@@ -832,6 +1157,28 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
+@@ -832,6 +1159,30 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
  {
  	int ret = -ENOENT;
  
@@ -7460,7 +7360,9 @@ index da42f7d..c142429 100644
 +	union rsbac_target_id_t rsbac_target_id;
 +	union rsbac_target_id_t rsbac_new_target_id;
 +	union rsbac_attribute_value_t rsbac_attribute_value;
++#endif
 +
++#ifdef CONFIG_RSBAC
 +	rsbac_pr_debug(aef, "calling ADF\n");
 +	rsbac_target_id.ipc.type = I_anonpipe;
 +	rsbac_target_id.ipc.id.id_nr = inode->i_ino;
@@ -7481,7 +7383,7 @@ index da42f7d..c142429 100644
  	mutex_lock(&inode->i_mutex);
  
  	if (inode->i_pipe) {
-@@ -844,6 +1191,23 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
+@@ -844,6 +1195,23 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
  
  	mutex_unlock(&inode->i_mutex);
  
@@ -7505,7 +7407,7 @@ index da42f7d..c142429 100644
  	return ret;
  }
  
-@@ -993,6 +1357,12 @@ struct file *create_write_pipe(int flags)
+@@ -993,6 +1361,12 @@ struct file *create_write_pipe(int flags)
  	struct path path;
  	struct qstr name = { .name = "" };
  
@@ -7518,7 +7420,7 @@ index da42f7d..c142429 100644
  	err = -ENFILE;
  	inode = get_pipe_inode();
  	if (!inode)
-@@ -1015,6 +1385,24 @@ struct file *create_write_pipe(int flags)
+@@ -1015,6 +1389,24 @@ struct file *create_write_pipe(int flags)
  	f->f_flags = O_WRONLY | (flags & O_NONBLOCK);
  	f->f_version = 0;
  
@@ -7543,7 +7445,7 @@ index da42f7d..c142429 100644
  	return f;
  
   err_dentry:
-@@ -1056,6 +1444,27 @@ int do_pipe_flags(int *fd, int flags)
+@@ -1056,6 +1448,27 @@ int do_pipe_flags(int *fd, int flags)
  	int error;
  	int fdw, fdr;
  
@@ -7572,7 +7474,7 @@ index da42f7d..c142429 100644
  		return -EINVAL;
  
 diff --git a/fs/proc/array.c b/fs/proc/array.c
-index 9b45ee8..dad3882 100644
+index 3a1dafd..d0c628b 100644
 --- a/fs/proc/array.c
 +++ b/fs/proc/array.c
 @@ -85,6 +85,7 @@
@@ -7680,7 +7582,7 @@ index 9b45ee8..dad3882 100644
  		size = task_statm(mm, &shared, &text, &data, &resident);
  		mmput(mm);
 diff --git a/fs/proc/base.c b/fs/proc/base.c
-index 5bff4c6..a34447d 100644
+index 5eb0206..4361341 100644
 --- a/fs/proc/base.c
 +++ b/fs/proc/base.c
 @@ -87,6 +87,7 @@
@@ -8113,7 +8015,7 @@ index 5bff4c6..a34447d 100644
  	if (!task->mm) {
  		err = -EINVAL;
  		goto err_task_lock;
-@@ -1259,8 +1559,30 @@ static ssize_t proc_loginuid_read(struct file * file, char __user * buf,
+@@ -1258,8 +1558,30 @@ static ssize_t proc_loginuid_read(struct file * file, char __user * buf,
  	ssize_t length;
  	char tmpbuf[TMPBUFLEN];
  
@@ -8144,7 +8046,7 @@ index 5bff4c6..a34447d 100644
  	length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
  				audit_get_loginuid(task));
  	put_task_struct(task);
-@@ -1275,6 +1597,11 @@ static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
+@@ -1274,6 +1596,11 @@ static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
  	ssize_t length;
  	uid_t loginuid;
  
@@ -8156,7 +8058,7 @@ index 5bff4c6..a34447d 100644
  	if (!capable(CAP_AUDIT_CONTROL))
  		return -EPERM;
  
-@@ -1292,6 +1619,25 @@ static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
+@@ -1291,6 +1618,25 @@ static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
  		/* No partial writes. */
  		return -EINVAL;
  	}
@@ -8182,7 +8084,7 @@ index 5bff4c6..a34447d 100644
  	page = (char*)__get_free_page(GFP_TEMPORARY);
  	if (!page)
  		return -ENOMEM;
-@@ -1586,10 +1932,30 @@ static int proc_exe_link(struct inode *inode, struct path *exe_path)
+@@ -1585,10 +1931,30 @@ static int proc_exe_link(struct inode *inode, struct path *exe_path)
  	struct task_struct *task;
  	struct mm_struct *mm;
  	struct file *exe_file;
@@ -8213,7 +8115,7 @@ index 5bff4c6..a34447d 100644
  	mm = get_task_mm(task);
  	put_task_struct(task);
  	if (!mm)
-@@ -1908,6 +2274,30 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
+@@ -1907,6 +2273,30 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
  	struct file *file;
  	int fd = proc_fd(inode);
  
@@ -8244,7 +8146,7 @@ index 5bff4c6..a34447d 100644
  	if (task) {
  		files = get_files_struct(task);
  		put_task_struct(task);
-@@ -3007,6 +3397,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
+@@ -3014,6 +3404,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
  	unsigned tgid;
  	struct pid_namespace *ns;
  
@@ -8256,7 +8158,7 @@ index 5bff4c6..a34447d 100644
  	result = proc_base_lookup(dir, dentry);
  	if (!IS_ERR(result) || PTR_ERR(result) != -ENOENT)
  		goto out;
-@@ -3024,6 +3419,22 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
+@@ -3031,6 +3426,22 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
  	if (!task)
  		goto out;
  
@@ -8279,7 +8181,7 @@ index 5bff4c6..a34447d 100644
  	result = proc_pid_instantiate(dir, dentry, task, NULL);
  	put_task_struct(task);
  out:
-@@ -3091,6 +3502,10 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
+@@ -3098,6 +3509,10 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
  	struct task_struct *reaper;
  	struct tgid_iter iter;
  	struct pid_namespace *ns;
@@ -8290,7 +8192,7 @@ index 5bff4c6..a34447d 100644
  
  	if (filp->f_pos >= PID_MAX_LIMIT + TGID_OFFSET)
  		goto out_no_task;
-@@ -3112,6 +3527,23 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
+@@ -3119,6 +3534,23 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
  	for (iter = next_tgid(ns, iter);
  	     iter.task;
  	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
@@ -8314,7 +8216,7 @@ index 5bff4c6..a34447d 100644
  		filp->f_pos = iter.tgid + TGID_OFFSET;
  		if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
  			put_task_struct(iter.task);
-@@ -3259,6 +3691,10 @@ static struct dentry *proc_task_lookup(struct inode *dir, struct dentry * dentry
+@@ -3266,6 +3698,10 @@ static struct dentry *proc_task_lookup(struct inode *dir, struct dentry * dentry
  	struct task_struct *leader = get_proc_task(dir);
  	unsigned tid;
  	struct pid_namespace *ns;
@@ -8325,7 +8227,7 @@ index 5bff4c6..a34447d 100644
  
  	if (!leader)
  		goto out_no_task;
-@@ -3278,6 +3714,20 @@ static struct dentry *proc_task_lookup(struct inode *dir, struct dentry * dentry
+@@ -3285,6 +3721,20 @@ static struct dentry *proc_task_lookup(struct inode *dir, struct dentry * dentry
  	if (!same_thread_group(leader, task))
  		goto out_drop_task;
  
@@ -8388,7 +8290,7 @@ index d245cb2..6de900e 100644
  		kcore_update_ram();
  	if (i_size_read(inode) != proc_root_kcore->size) {
 diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index 5afaa58..57379a1 100644
+index c7d4ee6..1905197 100644
 --- a/fs/proc/task_mmu.c
 +++ b/fs/proc/task_mmu.c
 @@ -16,6 +16,7 @@
@@ -8470,7 +8372,7 @@ index 980de54..efbcee0 100644
  	if (priv) {
  		priv->pid = proc_pid(inode);
 diff --git a/fs/quota/quota.c b/fs/quota/quota.c
-index b34bdb2..ae55b0b 100644
+index 10b6be3..6a1e4ce 100644
 --- a/fs/quota/quota.c
 +++ b/fs/quota/quota.c
 @@ -16,12 +16,18 @@
@@ -8555,7 +8457,7 @@ index b34bdb2..ae55b0b 100644
  
  	return security_quotactl(cmd, type, id, sb);
 diff --git a/fs/read_write.c b/fs/read_write.c
-index 5520f8a..ff3750f 100644
+index 179f1c3..1055cd3 100644
 --- a/fs/read_write.c
 +++ b/fs/read_write.c
 @@ -17,6 +17,12 @@
@@ -8571,7 +8473,7 @@ index 5520f8a..ff3750f 100644
  #include <asm/uaccess.h>
  #include <asm/unistd.h>
  
-@@ -267,7 +273,7 @@ int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count
+@@ -309,7 +315,7 @@ int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count
  	return count > MAX_RW_COUNT ? MAX_RW_COUNT : count;
  }
  
@@ -8580,7 +8482,7 @@ index 5520f8a..ff3750f 100644
  {
  	set_current_state(TASK_UNINTERRUPTIBLE);
  	if (!kiocbIsKicked(iocb))
-@@ -307,6 +313,10 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
+@@ -349,6 +355,10 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
  {
  	ssize_t ret;
  
@@ -8591,7 +8493,7 @@ index 5520f8a..ff3750f 100644
  	if (!(file->f_mode & FMODE_READ))
  		return -EBADF;
  	if (!file->f_op || (!file->f_op->read && !file->f_op->aio_read))
-@@ -317,6 +327,12 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
+@@ -359,6 +369,12 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
  	ret = rw_verify_area(READ, file, pos, count);
  	if (ret >= 0) {
  		count = ret;
@@ -8604,7 +8506,7 @@ index 5520f8a..ff3750f 100644
  		if (file->f_op->read)
  			ret = file->f_op->read(file, buf, count, pos);
  		else
-@@ -324,6 +340,9 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
+@@ -366,6 +382,9 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
  		if (ret > 0) {
  			fsnotify_access(file);
  			add_rchar(current, ret);
@@ -8614,7 +8516,7 @@ index 5520f8a..ff3750f 100644
  		}
  		inc_syscr(current);
  	}
-@@ -363,6 +382,10 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_
+@@ -405,6 +424,10 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_
  {
  	ssize_t ret;
  
@@ -8625,7 +8527,7 @@ index 5520f8a..ff3750f 100644
  	if (!(file->f_mode & FMODE_WRITE))
  		return -EBADF;
  	if (!file->f_op || (!file->f_op->write && !file->f_op->aio_write))
-@@ -373,6 +396,12 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_
+@@ -415,6 +438,12 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_
  	ret = rw_verify_area(WRITE, file, pos, count);
  	if (ret >= 0) {
  		count = ret;
@@ -8638,7 +8540,7 @@ index 5520f8a..ff3750f 100644
  		if (file->f_op->write)
  			ret = file->f_op->write(file, buf, count, pos);
  		else
-@@ -380,6 +409,10 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_
+@@ -422,6 +451,10 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_
  		if (ret > 0) {
  			fsnotify_modify(file);
  			add_wchar(current, ret);
@@ -8649,7 +8551,7 @@ index 5520f8a..ff3750f 100644
  		}
  		inc_syscw(current);
  	}
-@@ -657,6 +690,11 @@ static ssize_t do_readv_writev(int type, struct file *file,
+@@ -699,6 +732,11 @@ static ssize_t do_readv_writev(int type, struct file *file,
  	io_fn_t fn;
  	iov_fn_t fnv;
  
@@ -8661,7 +8563,7 @@ index 5520f8a..ff3750f 100644
  	if (!file->f_op) {
  		ret = -EINVAL;
  		goto out;
-@@ -672,6 +710,19 @@ static ssize_t do_readv_writev(int type, struct file *file,
+@@ -714,6 +752,19 @@ static ssize_t do_readv_writev(int type, struct file *file,
  	if (ret < 0)
  		goto out;
  
@@ -8681,7 +8583,7 @@ index 5520f8a..ff3750f 100644
  	fnv = NULL;
  	if (type == READ) {
  		fn = file->f_op->read;
-@@ -696,6 +747,12 @@ out:
+@@ -738,6 +789,12 @@ out:
  		else
  			fsnotify_modify(file);
  	}
@@ -8694,7 +8596,7 @@ index 5520f8a..ff3750f 100644
  	return ret;
  }
  
-@@ -832,6 +889,15 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
+@@ -874,6 +931,15 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
  	ssize_t retval;
  	int fput_needed_in, fput_needed_out, fl;
  
@@ -8710,7 +8612,7 @@ index 5520f8a..ff3750f 100644
  	/*
  	 * Get input file, and verify that it is ok..
  	 */
-@@ -852,6 +918,29 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
+@@ -894,6 +960,29 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
  		goto fput_in;
  	count = retval;
  
@@ -8740,7 +8642,7 @@ index 5520f8a..ff3750f 100644
  	/*
  	 * Get output file, and verify that it is ok..
  	 */
-@@ -869,6 +958,28 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
+@@ -911,6 +1000,28 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
  		goto fput_out;
  	count = retval;
  
@@ -8769,7 +8671,7 @@ index 5520f8a..ff3750f 100644
  	if (!max)
  		max = min(in_inode->i_sb->s_maxbytes, out_inode->i_sb->s_maxbytes);
  
-@@ -903,6 +1014,11 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
+@@ -945,6 +1056,11 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
  	if (*ppos > max)
  		retval = -EOVERFLOW;
  
@@ -8934,7 +8836,7 @@ index 356f715..62bf4f4 100644
  	buf.error = 0;
  
 diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
-index 1186626..5d091ce 100644
+index ef39232..03b8ca9 100644
 --- a/fs/reiserfs/namei.c
 +++ b/fs/reiserfs/namei.c
 @@ -18,6 +18,7 @@
@@ -8970,10 +8872,10 @@ index 1186626..5d091ce 100644
  
  		copy_item_head(&new_entry_ih, get_ih(&new_entry_path));
 diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
-index d780896..166430b 100644
+index 6bc346c..ac9382c 100644
 --- a/fs/reiserfs/xattr.c
 +++ b/fs/reiserfs/xattr.c
-@@ -981,6 +981,10 @@ static const struct dentry_operations xattr_lookup_poison_ops = {
+@@ -951,6 +951,10 @@ static const struct dentry_operations xattr_lookup_poison_ops = {
  	.d_revalidate = xattr_hide_revalidate,
  };
  
@@ -8984,7 +8886,7 @@ index d780896..166430b 100644
  int reiserfs_lookup_privroot(struct super_block *s)
  {
  	struct dentry *dentry;
-@@ -1025,8 +1029,13 @@ int reiserfs_xattr_init(struct super_block *s, int mount_flags)
+@@ -995,8 +999,13 @@ int reiserfs_xattr_init(struct super_block *s, int mount_flags)
  		reiserfs_mutex_lock_safe(&privroot->d_inode->i_mutex, s);
  		if (!REISERFS_SB(s)->xattr_root) {
  			struct dentry *dentry;
@@ -8999,7 +8901,7 @@ index d780896..166430b 100644
  				REISERFS_SB(s)->xattr_root = dentry;
  			else
 diff --git a/fs/stat.c b/fs/stat.c
-index 9610391..d36f8f1 100644
+index 8806b89..2d3c3d3 100644
 --- a/fs/stat.c
 +++ b/fs/stat.c
 @@ -18,8 +18,19 @@
@@ -9022,25 +8924,27 @@ index 9610391..d36f8f1 100644
  	stat->dev = inode->i_sb->s_dev;
  	stat->ino = inode->i_ino;
  	stat->mode = inode->i_mode;
-@@ -30,6 +41,17 @@ void generic_fillattr(struct inode *inode, struct kstat *stat)
- 	stat->atime = inode->i_atime;
- 	stat->mtime = inode->i_mtime;
- 	stat->ctime = inode->i_ctime;
+@@ -27,6 +38,19 @@ void generic_fillattr(struct inode *inode, struct kstat *stat)
+ 	stat->uid = inode->i_uid;
+ 	stat->gid = inode->i_gid;
+ 	stat->rdev = inode->i_rdev;
 +
 +#ifdef CONFIG_RSBAC_SYM_REDIR
 +	if (S_ISLNK(inode->i_mode)) {
 +		rsbac_name = rsbac_symlink_redirect(inode, "", 0);
-+		if (rsbac_name)
++		if (rsbac_name) {
 +			len = strlen(rsbac_name);
++			kfree(rsbac_name);
++		}
 +		stat->size = i_size_read(inode) + len;
 +	}
 +	else
 +#endif
 +
  	stat->size = i_size_read(inode);
- 	stat->blocks = inode->i_blocks;
- 	stat->blksize = (1 << inode->i_blkbits);
-@@ -42,10 +64,51 @@ int vfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+ 	stat->atime = inode->i_atime;
+ 	stat->mtime = inode->i_mtime;
+@@ -42,10 +66,51 @@ int vfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
  	struct inode *inode = dentry->d_inode;
  	int retval;
  
@@ -9092,9 +8996,9 @@ index 9610391..d36f8f1 100644
  	if (inode->i_op->getattr)
  		return inode->i_op->getattr(mnt, dentry, stat);
  
-@@ -297,6 +360,11 @@ SYSCALL_DEFINE4(readlinkat, int, dfd, const char __user *, pathname,
- 	struct path path;
+@@ -296,6 +361,11 @@ SYSCALL_DEFINE4(readlinkat, int, dfd, const char __user *, pathname,
  	int error;
+ 	int empty = 0;
  
 +#ifdef CONFIG_RSBAC
 +	union rsbac_target_id_t rsbac_target_id;
@@ -9104,7 +9008,7 @@ index 9610391..d36f8f1 100644
  	if (bufsiz <= 0)
  		return -EINVAL;
  
-@@ -308,6 +376,24 @@ SYSCALL_DEFINE4(readlinkat, int, dfd, const char __user *, pathname,
+@@ -307,6 +377,24 @@ SYSCALL_DEFINE4(readlinkat, int, dfd, const char __user *, pathname,
  		if (inode->i_op->readlink) {
  			error = security_inode_readlink(path.dentry);
  			if (!error) {
@@ -9130,7 +9034,7 @@ index 9610391..d36f8f1 100644
  				error = inode->i_op->readlink(path.dentry,
  							      buf, bufsiz);
 diff --git a/fs/statfs.c b/fs/statfs.c
-index 8244924..039e6ca 100644
+index 9cf04a1..d978425 100644
 --- a/fs/statfs.c
 +++ b/fs/statfs.c
 @@ -8,6 +8,8 @@
@@ -9313,7 +9217,7 @@ index ba653f3..0c8e4d7 100644
  	error = notify_change(path->dentry, &newattrs);
  	mutex_unlock(&inode->i_mutex);
 diff --git a/fs/xattr.c b/fs/xattr.c
-index f060663..fb94ce1 100644
+index f060663..5a6aaa9 100644
 --- a/fs/xattr.c
 +++ b/fs/xattr.c
 @@ -20,6 +20,7 @@
@@ -9324,7 +9228,7 @@ index f060663..fb94ce1 100644
  
  /*
   * Check permissions for extended attribute access.  This is a bit complicated
-@@ -121,6 +122,38 @@ vfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+@@ -121,6 +122,36 @@ vfs_setxattr(struct dentry *dentry, const char *name, const void *value,
  {
  	struct inode *inode = dentry->d_inode;
  	int error;
@@ -9334,7 +9238,6 @@ index f060663..fb94ce1 100644
 +	union rsbac_attribute_value_t rsbac_attribute_value;
 +#endif
 +
-+
 +#ifdef CONFIG_RSBAC
 +	rsbac_pr_debug(aef, "[sys_*setxattr()]: calling ADF\n");
 +	rsbac_target = T_FILE;
@@ -9356,14 +9259,13 @@ index f060663..fb94ce1 100644
 +				rsbac_target_id,
 +				A_none,
 +				rsbac_attribute_value)) {
-+		error = -EPERM;
-+		goto out;
++		return -EPERM;
 +	}
 +#endif
  
  	error = xattr_permission(inode, name, MAY_WRITE);
  	if (error)
-@@ -172,6 +205,12 @@ vfs_getxattr(struct dentry *dentry, const char *name, void *value, size_t size)
+@@ -172,6 +203,12 @@ vfs_getxattr(struct dentry *dentry, const char *name, void *value, size_t size)
  	struct inode *inode = dentry->d_inode;
  	int error;
  
@@ -9376,7 +9278,7 @@ index f060663..fb94ce1 100644
  	error = xattr_permission(inode, name, MAY_READ);
  	if (error)
  		return error;
-@@ -180,6 +219,33 @@ vfs_getxattr(struct dentry *dentry, const char *name, void *value, size_t size)
+@@ -180,6 +217,31 @@ vfs_getxattr(struct dentry *dentry, const char *name, void *value, size_t size)
  	if (error)
  		return error;
  
@@ -9400,26 +9302,27 @@ index f060663..fb94ce1 100644
 +				rsbac_target,
 +				rsbac_target_id,
 +				A_none,
-+				rsbac_attribute_value))
-+	{
-+		error = -EPERM;
-+		return error;
++				rsbac_attribute_value)) {
++		return -EPERM;
 +	}
 +#endif
 +
  	if (!strncmp(name, XATTR_SECURITY_PREFIX,
  				XATTR_SECURITY_PREFIX_LEN)) {
  		const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;
-@@ -206,7 +272,36 @@ ssize_t
+@@ -206,10 +268,41 @@ ssize_t
  vfs_listxattr(struct dentry *d, char *list, size_t size)
  {
  	ssize_t error;
--
 +#ifdef CONFIG_RSBAC
 +	enum  rsbac_target_t rsbac_target;
 +	union rsbac_target_id_t rsbac_target_id;
 +	union rsbac_attribute_value_t rsbac_attribute_value;
 +#endif
+ 
+ 	error = security_inode_listxattr(d);
+ 	if (error)
+ 		return error;
 +
 +#ifdef CONFIG_RSBAC
 +	rsbac_pr_debug(aef, "[sys_*listxattr()]: calling ADF\n");
@@ -9445,10 +9348,11 @@ index f060663..fb94ce1 100644
 +		return -EPERM;
 +	}
 +#endif
- 	error = security_inode_listxattr(d);
- 	if (error)
- 		return error;
-@@ -228,6 +323,12 @@ vfs_removexattr(struct dentry *dentry, const char *name)
++
+ 	error = -EOPNOTSUPP;
+ 	if (d->d_inode->i_op->listxattr) {
+ 		error = d->d_inode->i_op->listxattr(d, list, size);
+@@ -228,6 +321,12 @@ vfs_removexattr(struct dentry *dentry, const char *name)
  	struct inode *inode = dentry->d_inode;
  	int error;
  
@@ -9461,7 +9365,7 @@ index f060663..fb94ce1 100644
  	if (!inode->i_op->removexattr)
  		return -EOPNOTSUPP;
  
-@@ -239,6 +340,33 @@ vfs_removexattr(struct dentry *dentry, const char *name)
+@@ -239,6 +338,31 @@ vfs_removexattr(struct dentry *dentry, const char *name)
  	if (error)
  		return error;
  
@@ -9485,21 +9389,19 @@ index f060663..fb94ce1 100644
 +				rsbac_target,
 +				rsbac_target_id,
 +				A_none,
-+				rsbac_attribute_value))
-+	{
-+		error = -EPERM;
-+		return error;
++				rsbac_attribute_value)) {
++		return -EPERM;
 +	}
 +#endif
 +
  	mutex_lock(&inode->i_mutex);
  	error = inode->i_op->removexattr(dentry, name);
  	mutex_unlock(&inode->i_mutex);
-diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
-index d44d92c..231c000 100644
---- a/fs/xfs/linux-2.6/xfs_iops.c
-+++ b/fs/xfs/linux-2.6/xfs_iops.c
-@@ -49,6 +49,8 @@
+diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
+index 474920b..53f939f 100644
+--- a/fs/xfs/xfs_iops.c
++++ b/fs/xfs/xfs_iops.c
+@@ -50,6 +50,8 @@
  #include <linux/fiemap.h>
  #include <linux/slab.h>
  
@@ -9508,7 +9410,7 @@ index d44d92c..231c000 100644
  /*
   * Bring the timestamps in the XFS inode uptodate.
   *
-@@ -330,6 +332,10 @@ xfs_vn_unlink(
+@@ -339,6 +341,10 @@ xfs_vn_unlink(
  	struct xfs_name	name;
  	int		error;
  
@@ -9519,7 +9421,7 @@ index d44d92c..231c000 100644
  	xfs_dentry_to_name(&name, dentry);
  
  	error = -xfs_remove(XFS_I(dir), &name, XFS_I(dentry->d_inode));
-@@ -391,10 +397,34 @@ xfs_vn_rename(
+@@ -400,10 +406,34 @@ xfs_vn_rename(
  	struct inode	*new_inode = ndentry->d_inode;
  	struct xfs_name	oname;
  	struct xfs_name	nname;
@@ -9555,7 +9457,7 @@ index d44d92c..231c000 100644
  			   XFS_I(ndir), &nname, new_inode ?
  			   			XFS_I(new_inode) : NULL);
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 4ef452b..cdaf6b4 100644
+index 41d0237..c6374f4 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -29,6 +29,9 @@
@@ -9591,7 +9493,7 @@ index 4ef452b..cdaf6b4 100644
  
  /*
   * These are the constant used to fake the fixed-point load-average
-@@ -2206,6 +2217,13 @@ static inline void mmdrop(struct mm_struct * mm)
+@@ -2225,6 +2236,13 @@ static inline void mmdrop(struct mm_struct * mm)
  
  /* mmput gets rid of the mappings and all user-space */
  extern void mmput(struct mm_struct *);
@@ -9605,7 +9507,7 @@ index 4ef452b..cdaf6b4 100644
  /* Grab a reference to a task's mm, if it is not already going away */
  extern struct mm_struct *get_task_mm(struct task_struct *task);
  /* Remove the current tasks stale references to the old mm_struct */
-@@ -2233,7 +2251,12 @@ extern int disallow_signal(int);
+@@ -2252,7 +2270,12 @@ extern int disallow_signal(int);
  extern int do_execve(const char *,
  		     const char __user * const __user *,
  		     const char __user * const __user *, struct pt_regs *);
@@ -12831,17 +12733,17 @@ index 0000000..0a7aa68
 +#endif
 diff --git a/include/rsbac/adf_main.h b/include/rsbac/adf_main.h
 new file mode 100644
-index 0000000..b09fb9e
+index 0000000..ffba0b8
 --- /dev/null
 +++ b/include/rsbac/adf_main.h
-@@ -0,0 +1,835 @@
+@@ -0,0 +1,836 @@
 +/************************************ */
 +/* Rule Set Based Access Control      */
-+/* Author and (c) 1999-2009:          */
++/* Author and (c) 1999-2010:          */
 +/*   Amon Ott <ao@×××××.org>          */
 +/* Data Structs etc. for Access       */
 +/* Control Decision Facility          */
-+/* Last modified: 26/Mar/2009         */
++/* Last modified: 21/May/2010         */
 +/************************************ */
 +
 +#ifndef __RSBAC_ADF_MAIN_H
@@ -13225,6 +13127,7 @@ index 0000000..b09fb9e
 +  ((rsbac_request_vector_t) 1 << R_CLONE) | \
 +  ((rsbac_request_vector_t) 1 << R_CREATE) | \
 +  ((rsbac_request_vector_t) 1 << R_EXECUTE) | \
++  ((rsbac_request_vector_t) 1 << R_CONNECT) | \
 +  ((rsbac_request_vector_t) 1 << R_BIND) )
 +#endif
 +
@@ -22776,7 +22679,7 @@ index c0851a8..e08e25f 100644
 +
  }
 diff --git a/init/main.c b/init/main.c
-index d7211fa..1e384f5 100644
+index 03b408d..962030e 100644
 --- a/init/main.c
 +++ b/init/main.c
 @@ -75,6 +75,8 @@
@@ -22788,7 +22691,7 @@ index d7211fa..1e384f5 100644
  #ifdef CONFIG_X86_LOCAL_APIC
  #include <asm/smp.h>
  #endif
-@@ -606,6 +608,9 @@ asmlinkage void __init start_kernel(void)
+@@ -617,6 +619,9 @@ asmlinkage void __init start_kernel(void)
  	key_init();
  	security_init();
  	dbg_late_init();
@@ -23095,7 +22998,7 @@ index 7385de2..84c9e1b 100644
  			msq->q_qnum--;
  			msq->q_rtime = get_seconds();
 diff --git a/ipc/sem.c b/ipc/sem.c
-index e68a8f5..c3a2636 100644
+index c8e00f8..730685c 100644
 --- a/ipc/sem.c
 +++ b/ipc/sem.c
 @@ -89,6 +89,7 @@
@@ -23165,7 +23068,7 @@ index e68a8f5..c3a2636 100644
  	return sma->sem_perm.id;
  }
  
-@@ -854,6 +893,12 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
+@@ -848,6 +887,12 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
  	int nsems;
  	struct list_head tasks;
  
@@ -23178,7 +23081,7 @@ index e68a8f5..c3a2636 100644
  	sma = sem_lock_check(ns, semid);
  	if (IS_ERR(sma))
  		return PTR_ERR(sma);
-@@ -894,12 +939,49 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
+@@ -888,12 +933,50 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
  			}
  		}
  
@@ -23194,8 +23097,9 @@ index e68a8f5..c3a2636 100644
 +					A_none,
 +					rsbac_attribute_value))
 +		{
++			sem_unlock(sma);
 +			err = -EPERM;
-+			goto out_unlock;
++			goto out_free;
 +		}
 +#endif
 +
@@ -23228,7 +23132,7 @@ index e68a8f5..c3a2636 100644
  		goto out_free;
  	}
  	case SETALL:
-@@ -923,6 +1005,23 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
+@@ -917,6 +1000,23 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
  			goto out_free;
  		}
  
@@ -23252,7 +23156,7 @@ index e68a8f5..c3a2636 100644
  		for (i = 0; i < nsems; i++) {
  			if (sem_io[i] > SEMVMX) {
  				sem_putref(sma);
-@@ -946,6 +1045,24 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
+@@ -940,6 +1040,24 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
  				un->semadj[i] = 0;
  		}
  		sma->sem_ctime = get_seconds();
@@ -23277,7 +23181,7 @@ index e68a8f5..c3a2636 100644
  		/* maybe some queued-up processes were waiting for this */
  		do_smart_update(sma, NULL, 0, 0, &tasks);
  		err = 0;
-@@ -981,6 +1098,23 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
+@@ -975,6 +1093,23 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
  		if (val > SEMVMX || val < 0)
  			goto out_unlock;
  
@@ -23301,7 +23205,7 @@ index e68a8f5..c3a2636 100644
  		assert_spin_locked(&sma->sem_perm.lock);
  		list_for_each_entry(un, &sma->list_id, list_id)
  			un->semadj[semnum] = 0;
-@@ -1043,6 +1177,12 @@ static int semctl_down(struct ipc_namespace *ns, int semid,
+@@ -1037,6 +1172,12 @@ static int semctl_down(struct ipc_namespace *ns, int semid,
  	struct semid64_ds semid64;
  	struct kern_ipc_perm *ipcp;
  
@@ -23314,7 +23218,7 @@ index e68a8f5..c3a2636 100644
  	if(cmd == IPC_SET) {
  		if (copy_semid_from_user(&semid64, arg.buf, version))
  			return -EFAULT;
-@@ -1061,9 +1201,90 @@ static int semctl_down(struct ipc_namespace *ns, int semid,
+@@ -1055,9 +1196,90 @@ static int semctl_down(struct ipc_namespace *ns, int semid,
  
  	switch(cmd){
  	case IPC_RMID:
@@ -23405,16 +23309,8 @@ index e68a8f5..c3a2636 100644
  		ipc_update_perm(&semid64.sem_perm, ipcp);
  		sma->sem_ctime = get_seconds();
  		break;
-@@ -1475,7 +1696,6 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
- 	 * If queue.status != -EINTR we are woken up by another process.
- 	 * Leave without unlink_queue(), but with sem_unlock().
- 	 */
--
- 	if (error != -EINTR) {
- 		goto out_unlock_free;
- 	}
 diff --git a/ipc/shm.c b/ipc/shm.c
-index ab3385a..e157eab 100644
+index 02ecf2c..b784fb9 100644
 --- a/ipc/shm.c
 +++ b/ipc/shm.c
 @@ -44,6 +44,8 @@
@@ -23426,7 +23322,7 @@ index ab3385a..e157eab 100644
  struct shm_file_data {
  	int id;
  	struct ipc_namespace *ns;
-@@ -84,6 +86,11 @@ void shm_init_ns(struct ipc_namespace *ns)
+@@ -85,6 +87,11 @@ void shm_init_ns(struct ipc_namespace *ns)
   */
  static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
  {
@@ -23438,7 +23334,7 @@ index ab3385a..e157eab 100644
  	struct shmid_kernel *shp;
  	shp = container_of(ipcp, struct shmid_kernel, shm_perm);
  
-@@ -92,8 +99,25 @@ static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
+@@ -93,8 +100,25 @@ static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
  		/* Do not find it any more */
  		shp->shm_perm.key = IPC_PRIVATE;
  		shm_unlock(shp);
@@ -23465,7 +23361,7 @@ index ab3385a..e157eab 100644
  }
  
  #ifdef CONFIG_IPC_NS
-@@ -173,6 +197,10 @@ static void shm_open(struct vm_area_struct *vma)
+@@ -187,6 +211,10 @@ static void shm_open(struct vm_area_struct *vma)
   */
  static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
  {
@@ -23476,7 +23372,7 @@ index ab3385a..e157eab 100644
  	ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
  	shm_rmid(ns, shp);
  	shm_unlock(shp);
-@@ -183,6 +211,14 @@ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
+@@ -197,6 +225,14 @@ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
  						shp->mlock_user);
  	fput (shp->shm_file);
  	security_shm_free(shp);
@@ -23491,7 +23387,7 @@ index ab3385a..e157eab 100644
  	ipc_rcu_putref(shp);
  }
  
-@@ -199,6 +235,28 @@ static void shm_close(struct vm_area_struct *vma)
+@@ -230,6 +266,28 @@ static void shm_close(struct vm_area_struct *vma)
  	struct shmid_kernel *shp;
  	struct ipc_namespace *ns = sfd->ns;
  
@@ -23520,7 +23416,7 @@ index ab3385a..e157eab 100644
  	down_write(&shm_ids(ns).rw_mutex);
  	/* remove from the list of attaches of the shm segment */
  	shp = shm_lock(ns, sfd->id);
-@@ -349,6 +407,12 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
+@@ -456,6 +514,12 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
  	int id;
  	vm_flags_t acctflag = 0;
  
@@ -23533,7 +23429,7 @@ index ab3385a..e157eab 100644
  	if (size < SHMMIN || size > ns->shm_ctlmax)
  		return -EINVAL;
  
-@@ -359,6 +423,23 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
+@@ -466,6 +530,23 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
  	if (!shp)
  		return -ENOMEM;
  
@@ -23557,7 +23453,7 @@ index ab3385a..e157eab 100644
  	shp->shm_perm.key = key;
  	shp->shm_perm.mode = (shmflg & S_IRWXUGO);
  	shp->mlock_user = NULL;
-@@ -413,6 +494,23 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
+@@ -521,6 +602,23 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
  	ns->shm_tot += numpages;
  	error = shp->shm_perm.id;
  	shm_unlock(shp);
@@ -23581,7 +23477,7 @@ index ab3385a..e157eab 100644
  	return error;
  
  no_id:
-@@ -657,6 +755,11 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
+@@ -765,6 +863,11 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
  	int err, version;
  	struct ipc_namespace *ns;
  
@@ -23593,7 +23489,7 @@ index ab3385a..e157eab 100644
  	if (cmd < 0 || shmid < 0) {
  		err = -EINVAL;
  		goto out;
-@@ -806,7 +909,41 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
+@@ -914,7 +1017,41 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
  		goto out;
  	}
  	case IPC_RMID:
@@ -23610,7 +23506,7 @@ index ab3385a..e157eab 100644
 +					A_none,
 +					rsbac_attribute_value)) {
 +			err = -EPERM;
-+			goto out_unlock;
++			goto out;
 +		}
 +#endif
 +
@@ -23628,14 +23524,14 @@ index ab3385a..e157eab 100644
 +					A_none,
 +					rsbac_attribute_value)) {
 +			err = -EPERM;
-+			goto out_unlock;
++			goto out;
 +		}
 +#endif
 +
  		err = shmctl_down(ns, shmid, cmd, buf, version);
  		return err;
  	default:
-@@ -842,6 +979,13 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
+@@ -950,6 +1087,13 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
  	struct path path;
  	fmode_t f_mode;
  
@@ -23649,7 +23545,7 @@ index ab3385a..e157eab 100644
  	err = -EINVAL;
  	if (shmid < 0)
  		goto out;
-@@ -896,6 +1040,26 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
+@@ -1004,6 +1148,26 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
  	if (err)
  		goto out_unlock;
  
@@ -23676,7 +23572,7 @@ index ab3385a..e157eab 100644
  	path = shp->shm_file->f_path;
  	path_get(&path);
  	shp->shm_nattch++;
-@@ -958,6 +1122,26 @@ out_nattch:
+@@ -1065,6 +1229,26 @@ out_nattch:
  	up_write(&shm_ids(ns).rw_mutex);
  
  out:
@@ -23843,7 +23739,7 @@ index 283c529..4744298 100644
  }
  EXPORT_SYMBOL(ns_capable);
 diff --git a/kernel/exit.c b/kernel/exit.c
-index f2b321b..0cd2461 100644
+index 2913b35..014688b 100644
 --- a/kernel/exit.c
 +++ b/kernel/exit.c
 @@ -57,6 +57,8 @@
@@ -23855,7 +23751,7 @@ index f2b321b..0cd2461 100644
  static void exit_mm(struct task_struct * tsk);
  
  static void __unhash_process(struct task_struct *p, bool group_dead)
-@@ -904,6 +906,11 @@ NORET_TYPE void do_exit(long code)
+@@ -895,6 +897,11 @@ NORET_TYPE void do_exit(long code)
  	struct task_struct *tsk = current;
  	int group_dead;
  
@@ -23866,9 +23762,9 @@ index f2b321b..0cd2461 100644
 +
  	profile_task_exit(tsk);
  
- 	WARN_ON(atomic_read(&tsk->fs_excl));
-@@ -992,6 +999,23 @@ NORET_TYPE void do_exit(long code)
- 	exit_sem(tsk);
+ 	WARN_ON(blk_needs_flush_plug(tsk));
+@@ -983,6 +990,23 @@ NORET_TYPE void do_exit(long code)
+ 	exit_shm(tsk);
  	exit_files(tsk);
  	exit_fs(tsk);
 +
@@ -23892,10 +23788,10 @@ index f2b321b..0cd2461 100644
  	exit_thread();
  
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 0276c30..6fd2ea3 100644
+index 8e6b6f4..ecf9453 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
-@@ -75,6 +75,8 @@
+@@ -74,6 +74,8 @@
  #include <asm/cacheflush.h>
  #include <asm/tlbflush.h>
  
@@ -23904,7 +23800,7 @@ index 0276c30..6fd2ea3 100644
  #include <trace/events/sched.h>
  
  /*
-@@ -572,6 +574,27 @@ void mmput(struct mm_struct *mm)
+@@ -573,6 +575,27 @@ void mmput(struct mm_struct *mm)
  }
  EXPORT_SYMBOL_GPL(mmput);
  
@@ -23932,7 +23828,7 @@ index 0276c30..6fd2ea3 100644
  /*
   * We added or removed a vma mapping the executable. The vmas are only mapped
   * during exec and are not mapped with the mmap system call.
-@@ -1454,7 +1477,12 @@ struct task_struct * __cpuinit fork_idle(int cpu)
+@@ -1468,7 +1491,12 @@ struct task_struct * __cpuinit fork_idle(int cpu)
   * It copies the process, and if successful kick-starts
   * it and waits for it to finish using the VM if required.
   */
@@ -23945,7 +23841,7 @@ index 0276c30..6fd2ea3 100644
  	      unsigned long stack_start,
  	      struct pt_regs *regs,
  	      unsigned long stack_size,
-@@ -1465,6 +1493,31 @@ long do_fork(unsigned long clone_flags,
+@@ -1479,6 +1507,31 @@ long do_fork(unsigned long clone_flags,
  	int trace = 0;
  	long nr;
  
@@ -23977,7 +23873,7 @@ index 0276c30..6fd2ea3 100644
  	/*
  	 * Do some preliminary argument and permissions checking before we
  	 * actually start allocating stuff
-@@ -1518,6 +1571,33 @@ long do_fork(unsigned long clone_flags,
+@@ -1543,6 +1596,33 @@ long do_fork(unsigned long clone_flags,
  		 */
  		p->flags &= ~PF_STARTING;
  
@@ -24010,7 +23906,7 @@ index 0276c30..6fd2ea3 100644
 +
  		wake_up_new_task(p);
  
- 		tracehook_report_clone_complete(trace, regs,
+ 		/* forking complete and child started to run, tell ptracer */
 diff --git a/kernel/groups.c b/kernel/groups.c
 index 1cc476d..f4c198f 100644
 --- a/kernel/groups.c
@@ -24105,7 +24001,7 @@ index 079f1d3..5279edbb 100644
  	if (!iter)
  		return -ENOMEM;
 diff --git a/kernel/kexec.c b/kernel/kexec.c
-index 8d814cb..cea8bf6 100644
+index 296fbc8..973a1ce 100644
 --- a/kernel/kexec.c
 +++ b/kernel/kexec.c
 @@ -41,6 +41,8 @@
@@ -24149,7 +24045,7 @@ index 8d814cb..cea8bf6 100644
  	 * Verify we have a legal set of flags
  	 * This leaves us room for future extensions.
 diff --git a/kernel/module.c b/kernel/module.c
-index 795bdc7..57a8e56 100644
+index 04379f92..0293ae0 100644
 --- a/kernel/module.c
 +++ b/kernel/module.c
 @@ -59,6 +59,8 @@
@@ -24173,7 +24069,7 @@ index 795bdc7..57a8e56 100644
  	if (!capable(CAP_SYS_MODULE) || modules_disabled)
  		return -EPERM;
  
-@@ -787,6 +794,18 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
+@@ -787,6 +794,19 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
  
  	if (mutex_lock_interruptible(&module_mutex) != 0)
  		return -EINTR;
@@ -24187,12 +24083,13 @@ index 795bdc7..57a8e56 100644
 +				rsbac_target_id,
 +				A_mod_name,
 +				rsbac_attribute_value))
-+		return -EPERM;
++		ret = -EPERM;
++		goto out;
 +#endif
  
  	mod = find_module(name);
  	if (!mod) {
-@@ -2886,10 +2905,28 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
+@@ -2952,10 +2972,28 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
  	struct module *mod;
  	int ret = 0;
  
@@ -24222,7 +24119,7 @@ index 795bdc7..57a8e56 100644
  	mod = load_module(umod, len, uargs);
  	if (IS_ERR(mod))
 diff --git a/kernel/printk.c b/kernel/printk.c
-index 084982f..744348b 100644
+index 28a40d8..7f2f9c6 100644
 --- a/kernel/printk.c
 +++ b/kernel/printk.c
 @@ -44,6 +44,8 @@
@@ -24234,7 +24131,7 @@ index 084982f..744348b 100644
  /*
   * Architectures can override it:
   */
-@@ -334,6 +336,11 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
+@@ -336,6 +338,11 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
  	char c;
  	int error;
  
@@ -24246,7 +24143,7 @@ index 084982f..744348b 100644
  	error = check_syslog_permissions(type, from_file);
  	if (error)
  		goto out;
-@@ -342,6 +349,46 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
+@@ -344,6 +351,46 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
  	if (error)
  		return error;
  
@@ -24294,19 +24191,19 @@ index 084982f..744348b 100644
  	case SYSLOG_ACTION_CLOSE:	/* Close log */
  		break;
 diff --git a/kernel/ptrace.c b/kernel/ptrace.c
-index 2df1157..ee07125 100644
+index a70d2a5..8b08f72 100644
 --- a/kernel/ptrace.c
 +++ b/kernel/ptrace.c
-@@ -25,6 +25,8 @@
- #include <linux/hw_breakpoint.h>
- 
+@@ -32,6 +32,8 @@ static int ptrace_trapping_sleep_fn(void *flags)
+ 	return 0;
+ }
  
 +#include <rsbac/hooks.h>
 +
  /*
   * ptrace a task: make the debugger its new parent and
   * move it to the ptrace list.
-@@ -273,10 +275,31 @@ static int ptrace_traceme(void)
+@@ -325,10 +327,32 @@ static int ptrace_traceme(void)
  {
  	int ret = -EPERM;
  
@@ -24321,24 +24218,25 @@ index 2df1157..ee07125 100644
  		ret = security_ptrace_traceme(current->parent);
 +
 +#ifdef CONFIG_RSBAC
-+                rsbac_pr_debug(aef, "[sys_ptrace] calling ADF\n");
-+                rsbac_target_id.process = task_pid(current);
-+                rsbac_attribute_value.trace_request = PTRACE_TRACEME;
-+                if (!rsbac_adf_request(R_TRACE,
-+                                        task_pid(current),
-+                                        T_PROCESS,
-+                                        rsbac_target_id,
-+                                        A_trace_request,
-+                                        rsbac_attribute_value))
-+                {
-+                        ret = -EPERM;
-+                }
++		if (!ret) {
++			rsbac_pr_debug(aef, "[sys_ptrace] calling ADF\n");
++			rsbac_target_id.process = task_pid(current);
++			rsbac_attribute_value.trace_request = PTRACE_TRACEME;
++			if (!rsbac_adf_request(R_TRACE,
++					task_pid(current),
++					T_PROCESS,
++					rsbac_target_id,
++					A_trace_request,
++					rsbac_attribute_value)) {
++				ret = -EPERM;
++			}
++		}
 +#endif
 +
  		/*
  		 * Check PF_EXITING to ensure ->real_parent has not passed
  		 * exit_ptrace(). Otherwise we don't report the error but
-@@ -748,6 +771,11 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
+@@ -858,6 +882,11 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
  	struct task_struct *child;
  	long ret;
  
@@ -24350,7 +24248,7 @@ index 2df1157..ee07125 100644
  	if (request == PTRACE_TRACEME) {
  		ret = ptrace_traceme();
  		if (!ret)
-@@ -755,6 +783,27 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
+@@ -865,6 +894,27 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
  		goto out;
  	}
  
@@ -24379,19 +24277,19 @@ index 2df1157..ee07125 100644
  	if (IS_ERR(child)) {
  		ret = PTR_ERR(child);
 diff --git a/kernel/sched.c b/kernel/sched.c
-index 063d7a4..eac68f1 100644
+index b50b0f0..2b1c280 100644
 --- a/kernel/sched.c
 +++ b/kernel/sched.c
-@@ -76,6 +76,8 @@
- #include <asm/irq_regs.h>
- #include <asm/mutex.h>
+@@ -79,6 +79,8 @@
+ #include <asm/paravirt.h>
+ #endif
  
 +#include <rsbac/hooks.h>
 +
  #include "sched_cpupri.h"
  #include "workqueue_sched.h"
  #include "sched_autogroup.h"
-@@ -4936,6 +4938,10 @@ int can_nice(const struct task_struct *p, const int nice)
+@@ -4966,6 +4968,10 @@ int can_nice(const struct task_struct *p, const int nice)
  SYSCALL_DEFINE1(nice, int, increment)
  {
  	long nice, retval;
@@ -24402,7 +24300,7 @@ index 063d7a4..eac68f1 100644
  
  	/*
  	 * Setpriority might change our priority at the same moment.
-@@ -4956,6 +4962,23 @@ SYSCALL_DEFINE1(nice, int, increment)
+@@ -4986,6 +4992,23 @@ SYSCALL_DEFINE1(nice, int, increment)
  	if (increment < 0 && !can_nice(current, nice))
  		return -EPERM;
  
@@ -24426,7 +24324,7 @@ index 063d7a4..eac68f1 100644
  	retval = security_task_setnice(current, nice);
  	if (retval)
  		return retval;
-@@ -5245,6 +5268,12 @@ do_sched_setscheduler(pid_t pid, int policy, struct sched_param __user *param)
+@@ -5275,6 +5298,12 @@ do_sched_setscheduler(pid_t pid, int policy, struct sched_param __user *param)
  	struct task_struct *p;
  	int retval;
  
@@ -24439,7 +24337,7 @@ index 063d7a4..eac68f1 100644
  	if (!param || pid < 0)
  		return -EINVAL;
  	if (copy_from_user(&lparam, param, sizeof(struct sched_param)))
-@@ -5253,8 +5282,31 @@ do_sched_setscheduler(pid_t pid, int policy, struct sched_param __user *param)
+@@ -5283,8 +5312,31 @@ do_sched_setscheduler(pid_t pid, int policy, struct sched_param __user *param)
  	rcu_read_lock();
  	retval = -ESRCH;
  	p = find_process_by_pid(pid);
@@ -24472,7 +24370,7 @@ index 063d7a4..eac68f1 100644
  	rcu_read_unlock();
  
  	return retval;
-@@ -5295,9 +5347,36 @@ SYSCALL_DEFINE1(sched_getscheduler, pid_t, pid)
+@@ -5325,9 +5377,36 @@ SYSCALL_DEFINE1(sched_getscheduler, pid_t, pid)
  	struct task_struct *p;
  	int retval;
  
@@ -24509,7 +24407,7 @@ index 063d7a4..eac68f1 100644
  	retval = -ESRCH;
  	rcu_read_lock();
  	p = find_process_by_pid(pid);
-@@ -5322,9 +5401,36 @@ SYSCALL_DEFINE2(sched_getparam, pid_t, pid, struct sched_param __user *, param)
+@@ -5352,9 +5431,36 @@ SYSCALL_DEFINE2(sched_getparam, pid_t, pid, struct sched_param __user *, param)
  	struct task_struct *p;
  	int retval;
  
@@ -24546,7 +24444,7 @@ index 063d7a4..eac68f1 100644
  	rcu_read_lock();
  	p = find_process_by_pid(pid);
  	retval = -ESRCH;
-@@ -5352,6 +5458,12 @@ out_unlock:
+@@ -5382,6 +5488,12 @@ out_unlock:
  
  long sched_setaffinity(pid_t pid, const struct cpumask *in_mask)
  {
@@ -24559,7 +24457,7 @@ index 063d7a4..eac68f1 100644
  	cpumask_var_t cpus_allowed, new_mask;
  	struct task_struct *p;
  	int retval;
-@@ -5386,6 +5498,28 @@ long sched_setaffinity(pid_t pid, const struct cpumask *in_mask)
+@@ -5416,6 +5528,28 @@ long sched_setaffinity(pid_t pid, const struct cpumask *in_mask)
  	if (retval)
  		goto out_unlock;
  
@@ -24588,7 +24486,7 @@ index 063d7a4..eac68f1 100644
  	cpuset_cpus_allowed(p, cpus_allowed);
  	cpumask_and(new_mask, in_mask, cpus_allowed);
  again:
-@@ -5451,6 +5585,32 @@ long sched_getaffinity(pid_t pid, struct cpumask *mask)
+@@ -5481,6 +5615,32 @@ long sched_getaffinity(pid_t pid, struct cpumask *mask)
  	struct task_struct *p;
  	unsigned long flags;
  	int retval;
@@ -24621,7 +24519,7 @@ index 063d7a4..eac68f1 100644
  
  	get_online_cpus();
  	rcu_read_lock();
-@@ -5776,9 +5936,36 @@ SYSCALL_DEFINE2(sched_rr_get_interval, pid_t, pid,
+@@ -5806,9 +5966,36 @@ SYSCALL_DEFINE2(sched_rr_get_interval, pid_t, pid,
  	int retval;
  	struct timespec t;
  
@@ -24659,7 +24557,7 @@ index 063d7a4..eac68f1 100644
  	rcu_read_lock();
  	p = find_process_by_pid(pid);
 diff --git a/kernel/signal.c b/kernel/signal.c
-index 415d85d..1a34f05 100644
+index 291c970..e621b09 100644
 --- a/kernel/signal.c
 +++ b/kernel/signal.c
 @@ -37,6 +37,8 @@
@@ -24671,7 +24569,7 @@ index 415d85d..1a34f05 100644
  /*
   * SLAB caches for signal bits.
   */
-@@ -744,6 +746,11 @@ static int check_kill_permission(int sig, struct siginfo *info,
+@@ -789,6 +791,11 @@ static int check_kill_permission(int sig, struct siginfo *info,
  	struct pid *sid;
  	int error;
  
@@ -24683,7 +24581,7 @@ index 415d85d..1a34f05 100644
  	if (!valid_signal(sig))
  		return -EINVAL;
  
-@@ -770,6 +777,23 @@ static int check_kill_permission(int sig, struct siginfo *info,
+@@ -815,6 +822,23 @@ static int check_kill_permission(int sig, struct siginfo *info,
  		}
  	}
  
@@ -24708,10 +24606,10 @@ index 415d85d..1a34f05 100644
  }
  
 diff --git a/kernel/sys.c b/kernel/sys.c
-index f88dadc..fa611da 100644
+index 1dbbe69..791bbbc 100644
 --- a/kernel/sys.c
 +++ b/kernel/sys.c
-@@ -54,6 +54,8 @@
+@@ -53,6 +53,8 @@
  #include <asm/io.h>
  #include <asm/unistd.h>
  
@@ -24720,7 +24618,7 @@ index f88dadc..fa611da 100644
  #ifndef SET_UNALIGN_CTL
  # define SET_UNALIGN_CTL(a,b)	(-EINVAL)
  #endif
-@@ -178,6 +180,12 @@ SYSCALL_DEFINE3(setpriority, int, which, int, who, int, niceval)
+@@ -177,6 +179,12 @@ SYSCALL_DEFINE3(setpriority, int, which, int, who, int, niceval)
  	int error = -EINVAL;
  	struct pid *pgrp;
  
@@ -24733,7 +24631,7 @@ index f88dadc..fa611da 100644
  	if (which > PRIO_USER || which < PRIO_PROCESS)
  		goto out;
  
-@@ -188,6 +196,38 @@ SYSCALL_DEFINE3(setpriority, int, which, int, who, int, niceval)
+@@ -187,6 +195,39 @@ SYSCALL_DEFINE3(setpriority, int, which, int, who, int, niceval)
  	if (niceval > 19)
  		niceval = 19;
  
@@ -24763,7 +24661,8 @@ index f88dadc..fa611da 100644
 +					rsbac_attribute_value))
 +		{
 +			rcu_read_unlock();
-+			return -EPERM;
++			error = -EPERM;
++			goto out;
 +		}
 +		rcu_read_unlock();
 +	}
@@ -24772,7 +24671,7 @@ index f88dadc..fa611da 100644
  	rcu_read_lock();
  	read_lock(&tasklist_lock);
  	switch (which) {
-@@ -401,6 +441,11 @@ SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
+@@ -431,6 +472,11 @@ SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
  	char buffer[256];
  	int ret = 0;
  
@@ -24784,7 +24683,7 @@ index f88dadc..fa611da 100644
  	/* We only trust the superuser with rebooting the system. */
  	if (!capable(CAP_SYS_BOOT))
  		return -EPERM;
-@@ -419,6 +464,21 @@ SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
+@@ -449,6 +495,21 @@ SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
  	if ((cmd == LINUX_REBOOT_CMD_POWER_OFF) && !pm_power_off)
  		cmd = LINUX_REBOOT_CMD_HALT;
  
@@ -24806,7 +24705,7 @@ index f88dadc..fa611da 100644
  	mutex_lock(&reboot_mutex);
  	switch (cmd) {
  	case LINUX_REBOOT_CMD_RESTART:
-@@ -524,18 +584,66 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
+@@ -554,18 +615,66 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
  
  	retval = -EPERM;
  	if (rgid != (gid_t) -1) {
@@ -24875,7 +24774,7 @@ index f88dadc..fa611da 100644
  			new->egid = egid;
  		else
  			goto error;
-@@ -564,16 +672,68 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
+@@ -594,16 +703,68 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
  	struct cred *new;
  	int retval;
  
@@ -24946,7 +24845,7 @@ index f88dadc..fa611da 100644
  	else
  		goto error;
  
-@@ -627,6 +787,12 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
+@@ -664,6 +825,12 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
  	struct cred *new;
  	int retval;
  
@@ -24959,7 +24858,7 @@ index f88dadc..fa611da 100644
  	new = prepare_creds();
  	if (!new)
  		return -ENOMEM;
-@@ -660,11 +826,114 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
+@@ -697,11 +864,106 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
  		new->suid = new->euid;
  	new->fsuid = new->euid;
  
@@ -25007,14 +24906,6 @@ index f88dadc..fa611da 100644
 +#endif
 +#endif
 +
-+	if (ruid != (uid_t) -1) {
-+		new->uid = ruid;
-+		if (old->uid != ruid &&
-+		    old->euid != ruid &&
-+		    !capable(CAP_SETUID))
-+			goto error;
-+	}
-+
  	retval = security_task_fix_setuid(new, old, LSM_SETID_RE);
  	if (retval < 0)
  		goto error;
@@ -25075,7 +24966,7 @@ index f88dadc..fa611da 100644
  
  error:
  	abort_creds(new);
-@@ -688,11 +957,55 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
+@@ -725,11 +987,59 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
  	struct cred *new;
  	int retval;
  
@@ -25105,9 +24996,9 @@ index f88dadc..fa611da 100644
 +				T_PROCESS,
 +				rsbac_target_id,
 +				A_owner,
-+				rsbac_attribute_value))
-+	{
-+		return -EPERM;
++				rsbac_attribute_value)) {
++		retval = -EPERM;
++		goto error;
 +	}
 +#ifdef CONFIG_RSBAC_DAC_OWNER
 +	rsbac_pr_debug(aef, "calling ADF for euid\n");
@@ -25116,22 +25007,26 @@ index f88dadc..fa611da 100644
 +				T_PROCESS,
 +				rsbac_target_id,
 +				A_owner,
-+				rsbac_attribute_value))
-+		return -EPERM;
++				rsbac_attribute_value)) {
++		retval = -EPERM;
++		goto error;
++	}
 +	rsbac_pr_debug(aef, "calling ADF for fsuid\n");
 +	if (!rsbac_adf_request(R_CHANGE_DAC_FS_OWNER,
 +				task_pid(current),
 +				T_PROCESS,
 +				rsbac_target_id,
 +				A_owner,
-+				rsbac_attribute_value))
-+		return -EPERM;
++				rsbac_attribute_value)) {
++		retval = -EPERM;
++		goto error;
++	}
 +#endif
 +#endif
  	retval = -EPERM;
  	if (nsown_capable(CAP_SETUID)) {
  		new->suid = new->uid = uid;
-@@ -711,7 +1024,53 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
+@@ -748,7 +1058,53 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
  	if (retval < 0)
  		goto error;
  
@@ -25186,7 +25081,7 @@ index f88dadc..fa611da 100644
  
  error:
  	abort_creds(new);
-@@ -729,6 +1088,12 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
+@@ -766,6 +1122,12 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
  	struct cred *new;
  	int retval;
  
@@ -25199,7 +25094,7 @@ index f88dadc..fa611da 100644
  	new = prepare_creds();
  	if (!new)
  		return -ENOMEM;
-@@ -748,6 +1113,46 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
+@@ -785,6 +1147,51 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
  			goto error;
  	}
  
@@ -25214,8 +25109,10 @@ index f88dadc..fa611da 100644
 +					T_PROCESS,
 +					rsbac_target_id,
 +					A_owner,
-+					rsbac_attribute_value))
-+			return -EPERM;
++					rsbac_attribute_value)) {
++			retval = -EPERM;
++			goto error;
++		}
 +	}
 +#ifdef CONFIG_RSBAC_DAC_OWNER
 +	if(euid != (uid_t) -1) {
@@ -25228,25 +25125,28 @@ index f88dadc..fa611da 100644
 +					T_PROCESS,
 +					rsbac_target_id,
 +					A_owner,
-+					rsbac_attribute_value))
-+			return -EPERM;
++					rsbac_attribute_value)) {
++			retval = -EPERM;
++			goto error;
++		}
 +		rsbac_pr_debug(aef, "calling ADF for fsuid\n");
 +		if(!rsbac_adf_request(R_CHANGE_DAC_FS_OWNER,
 +					task_pid(current),
 +					T_PROCESS,
 +					rsbac_target_id,
 +					A_owner,
-+					rsbac_attribute_value))
-+			return -EPERM;
++					rsbac_attribute_value)) {
++			retval = -EPERM;
++			goto error;
++		}
 +	}
 +#endif
 +#endif
 +
-+
  	if (ruid != (uid_t) -1) {
  		new->uid = ruid;
  		if (ruid != old->uid) {
-@@ -766,7 +1171,58 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
+@@ -803,7 +1210,58 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
  	if (retval < 0)
  		goto error;
  
@@ -25306,7 +25206,7 @@ index f88dadc..fa611da 100644
  
  error:
  	abort_creds(new);
-@@ -794,6 +1250,11 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
+@@ -831,6 +1289,11 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
  	struct cred *new;
  	int retval;
  
@@ -25318,7 +25218,7 @@ index f88dadc..fa611da 100644
  	new = prepare_creds();
  	if (!new)
  		return -ENOMEM;
-@@ -812,10 +1273,44 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
+@@ -849,10 +1312,50 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
  			goto error;
  	}
  
@@ -25333,8 +25233,10 @@ index f88dadc..fa611da 100644
 +					T_PROCESS,
 +					rsbac_target_id,
 +					A_group,
-+					rsbac_attribute_value))
-+			return -EPERM;
++					rsbac_attribute_value)) {
++			retval = -EPERM;
++			goto error;
++		}
 +#endif
  		new->gid = rgid;
 -	if (egid != (gid_t) -1)
@@ -25350,22 +25252,26 @@ index f88dadc..fa611da 100644
 +					T_PROCESS,
 +					rsbac_target_id,
 +					A_group,
-+					rsbac_attribute_value))
-+			return -EPERM;
++					rsbac_attribute_value)) {
++			retval = -EPERM;
++			goto error;
++		}
 +		if (!rsbac_adf_request(R_CHANGE_DAC_FS_GROUP,
 +					task_pid(current),
 +					T_PROCESS,
 +					rsbac_target_id,
 +					A_group,
-+					rsbac_attribute_value))
-+			return -EPERM;
++					rsbac_attribute_value)) {
++			retval = -EPERM;
++			goto error;
++		}
 +#endif
  		new->egid = egid;
 +	}
  	if (sgid != (gid_t) -1)
  		new->sgid = sgid;
  	new->fsgid = new->egid;
-@@ -852,12 +1347,30 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
+@@ -889,12 +1392,32 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
  	struct cred *new;
  	uid_t old_fsuid;
  
@@ -25390,13 +25296,15 @@ index f88dadc..fa611da 100644
 +				T_PROCESS,
 +				rsbac_target_id,
 +				A_owner,
-+				rsbac_attribute_value))
++				rsbac_attribute_value)) {
++		abort_creds(new);
 +		return old_fsuid;
++	}
 +#endif
  	if (uid == old->uid  || uid == old->euid  ||
  	    uid == old->suid || uid == old->fsuid ||
  	    nsown_capable(CAP_SETUID)) {
-@@ -873,6 +1386,25 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
+@@ -910,6 +1433,25 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
  
  change_okay:
  	commit_creds(new);
@@ -25422,7 +25330,7 @@ index f88dadc..fa611da 100644
  	return old_fsuid;
  }
  
-@@ -885,12 +1417,29 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
+@@ -922,12 +1464,31 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
  	struct cred *new;
  	gid_t old_fsgid;
  
@@ -25446,13 +25354,15 @@ index f88dadc..fa611da 100644
 +				T_PROCESS,
 +				rsbac_target_id,
 +				A_group,
-+				rsbac_attribute_value))
++				rsbac_attribute_value)) {
++		abort_creds(new);
 +		return old_fsgid;
++	}
 +#endif
  	if (gid == old->gid  || gid == old->egid  ||
  	    gid == old->sgid || gid == old->fsgid ||
  	    nsown_capable(CAP_SETGID)) {
-@@ -955,6 +1504,11 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
+@@ -992,6 +1553,11 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
  	struct pid *pgrp;
  	int err;
  
@@ -25464,13 +25374,12 @@ index f88dadc..fa611da 100644
  	if (!pid)
  		pid = task_pid_vnr(group_leader);
  	if (!pgid)
-@@ -963,6 +1517,24 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
+@@ -1000,6 +1566,21 @@ SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
  		return -EINVAL;
  	rcu_read_lock();
  
 +#ifdef CONFIG_RSBAC
 +	rsbac_pr_debug(aef, "calling ADF\n");
-+	rcu_read_lock();
 +	rsbac_target_id.process = find_pid_ns(pid, &init_pid_ns);
 +	rsbac_attribute_value.dummy = 0;
 +	if (!rsbac_adf_request(R_MODIFY_SYSTEM_DATA,
@@ -25478,18 +25387,16 @@ index f88dadc..fa611da 100644
 +				T_PROCESS,
 +				rsbac_target_id,
 +				A_none,
-+				rsbac_attribute_value))
-+	{
++				rsbac_attribute_value)) {
 +		rcu_read_unlock();
 +		return -EPERM;
 +	}
-+	rcu_read_unlock();
 +#endif
 +
  	/* From this point forward we keep holding onto the tasklist lock
  	 * so that our parent does not change from under us. -DaveM
  	 */
-@@ -1029,6 +1601,11 @@ SYSCALL_DEFINE1(getpgid, pid_t, pid)
+@@ -1066,6 +1647,11 @@ SYSCALL_DEFINE1(getpgid, pid_t, pid)
  	if (!pid)
  		grp = task_pgrp(current);
  	else {
@@ -25501,7 +25408,7 @@ index f88dadc..fa611da 100644
  		retval = -ESRCH;
  		p = find_task_by_vpid(pid);
  		if (!p)
-@@ -1037,6 +1614,22 @@ SYSCALL_DEFINE1(getpgid, pid_t, pid)
+@@ -1074,6 +1660,22 @@ SYSCALL_DEFINE1(getpgid, pid_t, pid)
  		if (!grp)
  			goto out;
  
@@ -25524,7 +25431,7 @@ index f88dadc..fa611da 100644
  		retval = security_task_getpgid(p);
  		if (retval)
  			goto out;
-@@ -1066,6 +1659,11 @@ SYSCALL_DEFINE1(getsid, pid_t, pid)
+@@ -1103,6 +1705,11 @@ SYSCALL_DEFINE1(getsid, pid_t, pid)
  	if (!pid)
  		sid = task_session(current);
  	else {
@@ -25536,7 +25443,7 @@ index f88dadc..fa611da 100644
  		retval = -ESRCH;
  		p = find_task_by_vpid(pid);
  		if (!p)
-@@ -1074,6 +1672,22 @@ SYSCALL_DEFINE1(getsid, pid_t, pid)
+@@ -1111,6 +1718,22 @@ SYSCALL_DEFINE1(getsid, pid_t, pid)
  		if (!sid)
  			goto out;
  
@@ -25559,7 +25466,7 @@ index f88dadc..fa611da 100644
  		retval = security_task_getsid(p);
  		if (retval)
  			goto out;
-@@ -1235,11 +1849,32 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len)
+@@ -1272,11 +1895,32 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len)
  	int errno;
  	char tmp[__NEW_UTS_LEN];
  
@@ -25592,7 +25499,7 @@ index f88dadc..fa611da 100644
  	down_write(&uts_sem);
  	errno = -EFAULT;
  	if (!copy_from_user(tmp, name, len)) {
-@@ -1285,11 +1920,31 @@ SYSCALL_DEFINE2(setdomainname, char __user *, name, int, len)
+@@ -1322,11 +1966,31 @@ SYSCALL_DEFINE2(setdomainname, char __user *, name, int, len)
  	int errno;
  	char tmp[__NEW_UTS_LEN];
  
@@ -25624,7 +25531,7 @@ index f88dadc..fa611da 100644
  	down_write(&uts_sem);
  	errno = -EFAULT;
  	if (!copy_from_user(tmp, name, len)) {
-@@ -1380,6 +2035,12 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource,
+@@ -1417,6 +2081,12 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource,
  	struct rlimit *rlim;
  	int retval = 0;
  
@@ -25637,7 +25544,7 @@ index f88dadc..fa611da 100644
  	if (resource >= RLIM_NLIMITS)
  		return -EINVAL;
  	if (new_rlim) {
-@@ -1405,6 +2066,25 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource,
+@@ -1442,6 +2112,23 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource,
  		if (new_rlim->rlim_max > rlim->rlim_max &&
  				!capable(CAP_SYS_RESOURCE))
  			retval = -EPERM;
@@ -25654,16 +25561,14 @@ index f88dadc..fa611da 100644
 +						rsbac_target_id,
 +						A_rlimit,
 +						rsbac_attribute_value))
-+			{
-+				return -EPERM;
-+			}
++				retval = -EPERM;
 +		}
 +#endif
 +
  		if (!retval)
  			retval = security_task_setrlimit(tsk->group_leader,
  					resource, new_rlim);
-@@ -1426,6 +2106,22 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource,
+@@ -1463,6 +2150,22 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource,
  	}
  	task_unlock(tsk->group_leader);
  
@@ -25687,7 +25592,7 @@ index f88dadc..fa611da 100644
  	 * RLIMIT_CPU handling.   Note that the kernel fails to return an error
  	 * code if it rejected the user's attempt to set RLIMIT_CPU.  This is a
 diff --git a/kernel/sysctl.c b/kernel/sysctl.c
-index f175d98..ca6cc38 100644
+index 11d65b5..ef6fe69 100644
 --- a/kernel/sysctl.c
 +++ b/kernel/sysctl.c
 @@ -61,6 +61,8 @@
@@ -25699,7 +25604,7 @@ index f175d98..ca6cc38 100644
  #ifdef CONFIG_X86
  #include <asm/nmi.h>
  #include <asm/stacktrace.h>
-@@ -1715,11 +1717,33 @@ int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
+@@ -1710,11 +1712,33 @@ int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
  {
  	int mode;
  
@@ -25734,7 +25639,7 @@ index f175d98..ca6cc38 100644
  }
  
 diff --git a/kernel/time.c b/kernel/time.c
-index 8e8dc6d..6d8e6b2 100644
+index d776062..70beee5 100644
 --- a/kernel/time.c
 +++ b/kernel/time.c
 @@ -41,6 +41,8 @@
@@ -26043,7 +25948,7 @@ index 048260c..cc6be1b 100644
  
  	down_write(&current->mm->mmap_sem);
 diff --git a/mm/mmap.c b/mm/mmap.c
-index d49736f..e0e23ac 100644
+index a65efd4..18b038e 100644
 --- a/mm/mmap.c
 +++ b/mm/mmap.c
 @@ -34,6 +34,7 @@
@@ -26054,7 +25959,7 @@ index d49736f..e0e23ac 100644
  #include <asm/mmu_context.h>
  
  #include "internal.h"
-@@ -957,6 +958,12 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -949,6 +950,12 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
  	int error;
  	unsigned long reqprot = prot;
  
@@ -26067,7 +25972,7 @@ index d49736f..e0e23ac 100644
  	/*
  	 * Does the application expect PROT_READ to imply PROT_EXEC?
  	 *
-@@ -1081,6 +1088,33 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1073,6 +1080,33 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
  	if (error)
  		return error;
  
@@ -26193,7 +26098,7 @@ index 5a688a2..30b739d 100644
  	return error;
  }
 diff --git a/mm/swapfile.c b/mm/swapfile.c
-index ff8dc1a..7d76e2a 100644
+index 17bc224..a62363e 100644
 --- a/mm/swapfile.c
 +++ b/mm/swapfile.c
 @@ -36,6 +36,7 @@
@@ -26272,7 +26177,7 @@ index ff8dc1a..7d76e2a 100644
  	mapping = victim->f_mapping;
  	prev = -1;
  	spin_lock(&swap_lock);
-@@ -2031,9 +2083,28 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+@@ -2022,9 +2074,28 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
  	struct page *page = NULL;
  	struct inode *inode = NULL;
  
@@ -26301,7 +26206,7 @@ index ff8dc1a..7d76e2a 100644
  	p = alloc_swap_info();
  	if (IS_ERR(p))
  		return PTR_ERR(p);
-@@ -2066,6 +2137,45 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+@@ -2057,6 +2128,45 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
  	}
  
  	inode = mapping->host;
@@ -26348,7 +26253,7 @@ index ff8dc1a..7d76e2a 100644
  	error = claim_swapfile(p, inode);
  	if (unlikely(error))
 diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
-index 6f156c1..cd588d6 100644
+index 1d420f6..173d67e 100644
 --- a/net/bridge/br_if.c
 +++ b/net/bridge/br_if.c
 @@ -23,6 +23,8 @@
@@ -26360,7 +26265,7 @@ index 6f156c1..cd588d6 100644
  #include "br_private.h"
  
  /*
-@@ -322,6 +324,11 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
+@@ -323,6 +325,11 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
  	int err = 0;
  	bool changed_addr;
  
@@ -26372,7 +26277,7 @@ index 6f156c1..cd588d6 100644
  	/* Don't allow bridging non-ethernet like devices */
  	if ((dev->flags & IFF_LOOPBACK) ||
  	    dev->type != ARPHRD_ETHER || dev->addr_len != ETH_ALEN)
-@@ -335,6 +342,34 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
+@@ -336,6 +343,34 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
  	if (br_port_exists(dev))
  		return -EBUSY;
  
@@ -26407,9 +26312,9 @@ index 6f156c1..cd588d6 100644
  	/* No bridging devices that dislike that (e.g. wireless) */
  	if (dev->priv_flags & IFF_DONT_BRIDGE)
  		return -EOPNOTSUPP;
-@@ -422,10 +457,45 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
- {
+@@ -424,10 +459,45 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
  	struct net_bridge_port *p;
+ 	bool changed_addr;
  
 +#ifdef CONFIG_RSBAC_NET
 +	union rsbac_target_id_t rsbac_target_id;
@@ -26454,7 +26359,7 @@ index 6f156c1..cd588d6 100644
  
  	spin_lock_bh(&br->lock);
 diff --git a/net/core/dev.c b/net/core/dev.c
-index 9c58c1e..5f6d626 100644
+index ae5cf2d..3dbe64e 100644
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
 @@ -134,6 +134,8 @@
@@ -26466,7 +26371,7 @@ index 9c58c1e..5f6d626 100644
  #include "net-sysfs.h"
  
  /* Instead of increasing this, you should create a hash table. */
-@@ -4926,6 +4928,11 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+@@ -4944,6 +4946,11 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  	int ret;
  	char *colon;
  
@@ -26478,7 +26383,7 @@ index 9c58c1e..5f6d626 100644
  	/* One special case: SIOCGIFCONF takes ifconf argument
  	   and requires shared lock, because it sleeps writing
  	   to user space.
-@@ -4945,10 +4952,20 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+@@ -4963,10 +4970,20 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  
  	ifr.ifr_name[IFNAMSIZ-1] = 0;
  
@@ -26499,7 +26404,7 @@ index 9c58c1e..5f6d626 100644
  	/*
  	 *	See which interface the caller is talking about.
  	 */
-@@ -4968,6 +4985,21 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+@@ -4986,6 +5003,21 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  	case SIOCGIFMAP:
  	case SIOCGIFINDEX:
  	case SIOCGIFTXQLEN:
@@ -26521,7 +26426,7 @@ index 9c58c1e..5f6d626 100644
  		dev_load(net, ifr.ifr_name);
  		rcu_read_lock();
  		ret = dev_ifsioc_locked(net, &ifr, cmd);
-@@ -5045,6 +5077,21 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+@@ -5063,6 +5095,21 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  	case SIOCSHWTSTAMP:
  		if (!capable(CAP_NET_ADMIN))
  			return -EPERM;
@@ -26543,7 +26448,7 @@ index 9c58c1e..5f6d626 100644
  		/* fall through */
  	case SIOCBONDSLAVEINFOQUERY:
  	case SIOCBONDINFOQUERY:
-@@ -5070,6 +5117,21 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+@@ -5088,6 +5135,21 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  		if (cmd == SIOCWANDEV ||
  		    (cmd >= SIOCDEVPRIVATE &&
  		     cmd <= SIOCDEVPRIVATE + 15)) {
@@ -26566,7 +26471,7 @@ index 9c58c1e..5f6d626 100644
  			rtnl_lock();
  			ret = dev_ifsioc(net, &ifr, cmd);
 diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
-index f39ef5c..85d66cc 100644
+index 27071ee..fe0cb26 100644
 --- a/net/core/fib_rules.c
 +++ b/net/core/fib_rules.c
 @@ -15,6 +15,7 @@
@@ -26645,7 +26550,7 @@ index f39ef5c..85d66cc 100644
  	list_for_each_entry(rule, &ops->rules_list, list) {
  		if (frh->action && (frh->action != rule->action))
  			continue;
-@@ -530,6 +571,25 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
+@@ -533,6 +574,25 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
  {
  	struct nlmsghdr *nlh;
  	struct fib_rule_hdr *frh;
@@ -26672,10 +26577,10 @@ index f39ef5c..85d66cc 100644
  	nlh = nlmsg_put(skb, pid, seq, type, sizeof(*frh), flags);
  	if (nlh == NULL)
 diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
-index 1b74d3b..56ed72a 100644
+index 96a164a..e339b59 100644
 --- a/net/ipv4/arp.c
 +++ b/net/ipv4/arp.c
-@@ -124,6 +124,8 @@ EXPORT_SYMBOL(clip_tbl_hook);
+@@ -123,6 +123,8 @@ EXPORT_SYMBOL(clip_tbl_hook);
  
  #include <linux/netfilter_arp.h>
  
@@ -26684,7 +26589,7 @@ index 1b74d3b..56ed72a 100644
  /*
   *	Interface to generic neighbour cache.
   */
-@@ -1205,15 +1207,32 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+@@ -1172,15 +1174,32 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  	struct arpreq r;
  	struct net_device *dev = NULL;
  
@@ -26717,7 +26622,7 @@ index 1b74d3b..56ed72a 100644
  		break;
  	default:
  		return -EINVAL;
-@@ -1241,6 +1260,24 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+@@ -1208,6 +1227,24 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  		err = -EINVAL;
  		if ((r.arp_flags & ATF_COM) && r.arp_ha.sa_family != dev->type)
  			goto out;
@@ -26743,7 +26648,7 @@ index 1b74d3b..56ed72a 100644
  		err = -ENODEV;
  		goto out;
 diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
-index 4155abc..a703e15 100644
+index bc19bd0..3722291 100644
 --- a/net/ipv4/devinet.c
 +++ b/net/ipv4/devinet.c
 @@ -66,6 +66,8 @@
@@ -26767,7 +26672,7 @@ index 4155abc..a703e15 100644
  	ASSERT_RTNL();
  
  	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv4_policy);
-@@ -554,6 +561,38 @@ static int inet_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
+@@ -554,6 +561,37 @@ static int inet_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
  		goto errout;
  	}
  
@@ -26797,7 +26702,6 @@ index 4155abc..a703e15 100644
 +				rsbac_target_id,
 +				A_none,
 +				rsbac_attribute_value)) {
-+		__in_dev_put(in_dev);
 +		err = -EPERM;
 +		goto errout;
 +	}
@@ -26806,7 +26710,7 @@ index 4155abc..a703e15 100644
  	for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL;
  	     ifap = &ifa->ifa_next) {
  		if (tb[IFA_LOCAL] &&
-@@ -586,6 +625,11 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh)
+@@ -586,6 +624,11 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh)
  	struct in_device *in_dev;
  	int err;
  
@@ -26818,7 +26722,7 @@ index 4155abc..a703e15 100644
  	err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv4_policy);
  	if (err < 0)
  		goto errout;
-@@ -605,6 +649,37 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh)
+@@ -605,6 +648,37 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh)
  	if (in_dev == NULL)
  		goto errout;
  
@@ -26856,7 +26760,7 @@ index 4155abc..a703e15 100644
  	ifa = inet_alloc_ifa();
  	if (ifa == NULL)
  		/*
-@@ -695,6 +770,12 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+@@ -695,6 +769,12 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  	int ret = -EFAULT;
  	int tryaddrmatch = 0;
  
@@ -26869,7 +26773,7 @@ index 4155abc..a703e15 100644
  	/*
  	 *	Fetch the caller's info block into kernel space
  	 */
-@@ -703,6 +784,11 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+@@ -703,6 +783,11 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  		goto out;
  	ifr.ifr_name[IFNAMSIZ - 1] = 0;
  
@@ -26881,7 +26785,7 @@ index 4155abc..a703e15 100644
  	/* save original address for comparison */
  	memcpy(&sin_orig, sin, sizeof(*sin));
  
-@@ -710,6 +796,11 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+@@ -710,6 +795,11 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  	if (colon)
  		*colon = 0;
  
@@ -26893,7 +26797,7 @@ index 4155abc..a703e15 100644
  	dev_load(net, ifr.ifr_name);
  
  	switch (cmd) {
-@@ -724,12 +815,19 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+@@ -724,12 +814,19 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  		tryaddrmatch = (sin_orig.sin_family == AF_INET);
  		memset(sin, 0, sizeof(*sin));
  		sin->sin_family = AF_INET;
@@ -26913,7 +26817,7 @@ index 4155abc..a703e15 100644
  		break;
  	case SIOCSIFADDR:	/* Set interface address (and family) */
  	case SIOCSIFBRDADDR:	/* Set the broadcast address */
-@@ -741,6 +839,9 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+@@ -741,6 +838,9 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  		ret = -EINVAL;
  		if (sin->sin_family != AF_INET)
  			goto out;
@@ -26923,7 +26827,7 @@ index 4155abc..a703e15 100644
  		break;
  	default:
  		ret = -EINVAL;
-@@ -754,6 +855,21 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+@@ -754,6 +854,21 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
  	if (!dev)
  		goto done;
  
@@ -26946,7 +26850,7 @@ index 4155abc..a703e15 100644
  		*colon = ':';
  
 diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
-index 2252471..0255d53 100644
+index 92fc5f6..55430a8 100644
 --- a/net/ipv4/fib_frontend.c
 +++ b/net/ipv4/fib_frontend.c
 @@ -46,6 +46,8 @@
@@ -27055,7 +26959,7 @@ index 2252471..0255d53 100644
  	if (tb == NULL) {
  		err = -ENOBUFS;
 diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
-index 3267d38..164395a 100644
+index 389a2e6..eae9fa7 100644
 --- a/net/ipv4/inet_diag.c
 +++ b/net/ipv4/inet_diag.c
 @@ -34,6 +34,8 @@
@@ -27100,7 +27004,7 @@ index 3267d38..164395a 100644
  					       INET_DIAG_REQ_BYTECODE);
  			if (attr == NULL ||
 diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
-index f81af8d..02fd1cf 100644
+index 58e8791..c82d09d 100644
 --- a/net/ipv4/ipmr.c
 +++ b/net/ipv4/ipmr.c
 @@ -66,6 +66,8 @@
@@ -27268,19 +27172,19 @@ index 24e556e..27c35d3 100644
  	case IPT_SO_SET_REPLACE:
  		ret = do_replace(sock_net(sk), user, len);
 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index 75ef66f..6318a39 100644
+index 05ac666c..c324972 100644
 --- a/net/ipv4/route.c
 +++ b/net/ipv4/route.c
-@@ -110,6 +110,8 @@
- #endif
+@@ -111,6 +111,8 @@
+ #include <net/atmclip.h>
  #include <net/secure_seq.h>
  
 +#include <rsbac/hooks.h>
 +
  #define RT_FL_TOS(oldflp4) \
-     ((u32)(oldflp4->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK)))
+ 	((oldflp4)->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK))
  
-@@ -2891,6 +2893,27 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
+@@ -2979,6 +2981,27 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
  	int mark;
  	struct sk_buff *skb;
  
@@ -27309,7 +27213,7 @@ index 75ef66f..6318a39 100644
  	if (err < 0)
  		goto errout;
 diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
-index bb2c523..a468c81 100644
+index a69d44f..0ad5d09 100644
 --- a/net/sched/cls_api.c
 +++ b/net/sched/cls_api.c
 @@ -31,6 +31,8 @@
@@ -27377,7 +27281,7 @@ index bb2c523..a468c81 100644
  		return skb->len;
  	dev = __dev_get_by_index(net, tcm->tcm_ifindex);
 diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
-index 6b86276..128368d 100644
+index dca6c1a..6fd628d 100644
 --- a/net/sched/sch_api.c
 +++ b/net/sched/sch_api.c
 @@ -35,6 +35,8 @@
@@ -27601,7 +27505,7 @@ index 6b86276..128368d 100644
  	t = 0;
  
 diff --git a/net/socket.c b/net/socket.c
-index 1ad42d3..d4bc79a 100644
+index ffe92ca..5c20917 100644
 --- a/net/socket.c
 +++ b/net/socket.c
 @@ -89,6 +89,14 @@
@@ -28065,7 +27969,7 @@ index 1ad42d3..d4bc79a 100644
 +					rsbac_target_id,
 +					A_sock_type,
 +					rsbac_attribute_value)) {
-+			rsbac_pr_debug(aef, "[sys_socketcall()]: ADF returned NOT_GRANTED\n");
++			rsbac_pr_debug(aef, "sys_listen() [sys_socketcall()]: ADF returned NOT_GRANTED\n");
 +			fput_light(sock->file, fput_needed);
 +			return -EPERM;
 +		}
@@ -28548,7 +28452,7 @@ index 1ad42d3..d4bc79a 100644
  		if (level == SOL_SOCKET)
  			err =
  			    sock_getsockopt(sock, level, optname, optval,
-@@ -1854,11 +2592,82 @@ SYSCALL_DEFINE2(shutdown, int, fd, int, how)
+@@ -1854,11 +2592,84 @@ SYSCALL_DEFINE2(shutdown, int, fd, int, how)
  	int err, fput_needed;
  	struct socket *sock;
  
@@ -28566,42 +28470,44 @@ index 1ad42d3..d4bc79a 100644
  		err = security_socket_shutdown(sock, how);
 +
 +#ifdef CONFIG_RSBAC
-+		rsbac_pr_debug(aef, "[sys_socketcall()]: calling ADF\n");
-+		if (sock->ops->family == AF_UNIX) {
-+			if (sock->file
-+			&& sock->file->f_dentry
-+			&& sock->file->f_dentry->d_inode) {
-+				if (sock->file->f_dentry->d_sb->s_magic == SOCKFS_MAGIC) {
-+					rsbac_target = T_IPC;
-+					rsbac_target_id.ipc.type = I_anonunix;
-+					rsbac_target_id.ipc.id.id_nr = sock->file->f_dentry->d_inode->i_ino;
-+				} else {
-+					rsbac_target = T_UNIXSOCK;
-+					rsbac_target_id.unixsock.device = sock->file->f_dentry->d_sb->s_dev;
-+					rsbac_target_id.unixsock.inode  = sock->file->f_dentry->d_inode->i_ino;
-+					rsbac_target_id.unixsock.dentry_p = sock->file->f_dentry;
++		if (!err) {
++			rsbac_pr_debug(aef, "[sys_socketcall()]: calling ADF\n");
++			if (sock->ops->family == AF_UNIX) {
++				if (sock->file
++				&& sock->file->f_dentry
++				&& sock->file->f_dentry->d_inode) {
++					if (sock->file->f_dentry->d_sb->s_magic == SOCKFS_MAGIC) {
++						rsbac_target = T_IPC;
++						rsbac_target_id.ipc.type = I_anonunix;
++						rsbac_target_id.ipc.id.id_nr = sock->file->f_dentry->d_inode->i_ino;
++					} else {
++						rsbac_target = T_UNIXSOCK;
++						rsbac_target_id.unixsock.device = sock->file->f_dentry->d_sb->s_dev;
++						rsbac_target_id.unixsock.inode  = sock->file->f_dentry->d_inode->i_ino;
++						rsbac_target_id.unixsock.dentry_p = sock->file->f_dentry;
++					}
 +				}
 +			}
-+		}
 +#ifdef CONFIG_RSBAC_NET_OBJ
-+		else {
-+			rsbac_target = T_NETOBJ;
-+			rsbac_target_id.netobj.sock_p = sock;
-+			rsbac_target_id.netobj.local_addr = NULL;
-+			rsbac_target_id.netobj.local_len = 0;
-+			rsbac_target_id.netobj.remote_addr = NULL;
-+			rsbac_target_id.netobj.remote_len = 0;
-+		}
++			else {
++				rsbac_target = T_NETOBJ;
++				rsbac_target_id.netobj.sock_p = sock;
++				rsbac_target_id.netobj.local_addr = NULL;
++				rsbac_target_id.netobj.local_len = 0;
++				rsbac_target_id.netobj.remote_addr = NULL;
++				rsbac_target_id.netobj.remote_len = 0;
++			}
 +#endif
-+		rsbac_attribute_value.sock_type = sock->type;
-+		if ((rsbac_target != T_NONE)
-+				&& !rsbac_adf_request(R_NET_SHUTDOWN,
-+					task_pid(current),
-+					rsbac_target,
-+					rsbac_target_id,
-+					A_sock_type,
-+					rsbac_attribute_value)) {
-+			err = -EPERM;
++			rsbac_attribute_value.sock_type = sock->type;
++			if ((rsbac_target != T_NONE)
++					&& !rsbac_adf_request(R_NET_SHUTDOWN,
++						task_pid(current),
++						rsbac_target,
++						rsbac_target_id,
++						A_sock_type,
++						rsbac_attribute_value)) {
++				err = -EPERM;
++			}
 +		}
 +#endif
 +
@@ -28631,7 +28537,7 @@ index 1ad42d3..d4bc79a 100644
  		fput_light(sock->file, fput_needed);
  	}
  	return err;
-@@ -2534,6 +3343,10 @@ static int __init sock_init(void)
+@@ -2534,6 +3345,10 @@ static int __init sock_init(void)
  	if (err)
  		goto out_fs;
  	sock_mnt = kern_mount(&sock_fs_type);
@@ -28643,7 +28549,7 @@ index 1ad42d3..d4bc79a 100644
  		err = PTR_ERR(sock_mnt);
  		goto out_mount;
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 0722a25..8cb4965 100644
+index ec68e1c..d18a8c3 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -115,6 +115,8 @@
@@ -28745,7 +28651,7 @@ index 0722a25..8cb4965 100644
  out:	mutex_unlock(&u->readlock);
  	return err;
  }
-@@ -815,6 +875,12 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+@@ -816,6 +876,12 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
  	struct unix_address *addr;
  	struct hlist_head *list;
  
@@ -28758,7 +28664,7 @@ index 0722a25..8cb4965 100644
  	err = -EINVAL;
  	if (sunaddr->sun_family != AF_UNIX)
  		goto out;
-@@ -835,6 +901,31 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+@@ -836,6 +902,31 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
  	if (u->addr)
  		goto out_up;
  
@@ -28790,9 +28696,9 @@ index 0722a25..8cb4965 100644
  	err = -ENOMEM;
  	addr = kmalloc(sizeof(*addr)+addr_len, GFP_KERNEL);
  	if (!addr)
-@@ -861,6 +952,11 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+@@ -858,6 +949,11 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
  		if (IS_ERR(dentry))
- 			goto out_mknod_unlock;
+ 			goto out_mknod_parent;
  
 +#ifdef CONFIG_RSBAC
 +		/* RSBAC add: set credentials so connect and send can copy them */
@@ -28802,7 +28708,7 @@ index 0722a25..8cb4965 100644
  		/*
  		 * All right, let's create it.
  		 */
-@@ -895,6 +991,21 @@ out_mknod_drop_write:
+@@ -892,6 +988,21 @@ out_mknod_drop_write:
  		}
  
  		list = &unix_socket_table[addr->hash];
@@ -28823,8 +28729,8 @@ index 0722a25..8cb4965 100644
 +
  	} else {
  		list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
- 		u->dentry = nd.path.dentry;
-@@ -960,6 +1071,14 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
+ 		u->dentry = path.dentry;
+@@ -956,6 +1067,14 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
  	unsigned hash;
  	int err;
  
@@ -28839,7 +28745,7 @@ index 0722a25..8cb4965 100644
  	if (addr->sa_family != AF_UNSPEC) {
  		err = unix_mkname(sunaddr, alen, &hash);
  		if (err < 0)
-@@ -975,6 +1094,46 @@ restart:
+@@ -971,6 +1090,46 @@ restart:
  		if (!other)
  			goto out;
  
@@ -28886,7 +28792,7 @@ index 0722a25..8cb4965 100644
  		unix_state_double_lock(sk, other);
  
  		/* Apparently VFS overslept socket death. Retry. */
-@@ -1015,6 +1174,23 @@ restart:
+@@ -1011,6 +1170,23 @@ restart:
  		unix_peer(sk) = other;
  		unix_state_double_unlock(sk, other);
  	}
@@ -28905,12 +28811,12 @@ index 0722a25..8cb4965 100644
 +			rsbac_printk(KERN_WARNING
 +					"unix_dgram_connect() [sys_connect() [sys_socketcall()]]: rsbac_adf_set_attr() returned error\n");
 +	}
-+        #endif
++#endif
 +
  	return 0;
  
  out_unlock:
-@@ -1060,6 +1236,15 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
+@@ -1056,6 +1232,15 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
  	int err;
  	long timeo;
  
@@ -28926,7 +28832,7 @@ index 0722a25..8cb4965 100644
  	err = unix_mkname(sunaddr, addr_len, &hash);
  	if (err < 0)
  		goto out;
-@@ -1094,6 +1279,48 @@ restart:
+@@ -1090,6 +1275,48 @@ restart:
  	if (!other)
  		goto out;
  
@@ -28975,7 +28881,7 @@ index 0722a25..8cb4965 100644
  	/* Latch state of peer */
  	unix_state_lock(other);
  
-@@ -1165,6 +1392,55 @@ restart:
+@@ -1161,6 +1388,55 @@ restart:
  		goto out_unlock;
  	}
  
@@ -29031,7 +28937,7 @@ index 0722a25..8cb4965 100644
  	/* The way is open! Fastly set all the necessary fields... */
  
  	sock_hold(sk);
-@@ -1204,6 +1480,51 @@ restart:
+@@ -1200,6 +1476,53 @@ restart:
  	spin_unlock(&other->sk_receive_queue.lock);
  	unix_state_unlock(other);
  	other->sk_data_ready(other, 0);
@@ -29065,6 +28971,7 @@ index 0722a25..8cb4965 100644
 +			rsbac_printk(KERN_WARNING
 +					"unix_stream_connect() [sys_connect() [sys_socketcall()]]: rsbac_adf_set_attr() returned error\n");
 +#ifdef CONFIG_RSBAC_NET
++#ifdef CONFIG_RSBAC_DEBUG
 +		if (   rsbac_debug_aef_net
 +		    && sk->sk_socket
 +		    && newsk->sk_socket
@@ -29077,13 +28984,14 @@ index 0722a25..8cb4965 100644
 +			other->sk_socket->file->f_dentry->d_inode->i_ino);
 +		}
 +#endif
++#endif
 +	}
 +#endif
 +
  	sock_put(other);
  	return 0;
  
-@@ -1256,6 +1577,11 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
+@@ -1252,6 +1575,11 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
  	if (sk->sk_state != TCP_LISTEN)
  		goto out;
  
@@ -29095,10 +29003,11 @@ index 0722a25..8cb4965 100644
  	/* If socket state is TCP_LISTEN it cannot change (for now...),
  	 * so that no locks are necessary.
  	 */
-@@ -1275,6 +1601,19 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
+@@ -1271,6 +1599,21 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
  	/* attach accepted sock to socket */
  	unix_state_lock(tsk);
  	newsock->state = SS_CONNECTED;
++
 +#ifdef CONFIG_RSBAC
 +	/* copy dentry and mnt, if there */
 +	if (unix_sk(sk)->dentry) {
@@ -29112,10 +29021,11 @@ index 0722a25..8cb4965 100644
 +		}
 +	}
 +#endif
++
  	sock_graft(tsk, newsock);
  	unix_state_unlock(tsk);
  	return 0;
-@@ -1416,6 +1755,14 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
+@@ -1412,6 +1755,14 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
  	struct scm_cookie tmp_scm;
  	int max_level;
  
@@ -29130,7 +29040,7 @@ index 0722a25..8cb4965 100644
  	if (NULL == siocb->scm)
  		siocb->scm = &tmp_scm;
  	wait_for_unix_gc();
-@@ -1525,6 +1872,55 @@ restart:
+@@ -1521,6 +1872,55 @@ restart:
  			goto out_unlock;
  	}
  
@@ -29178,7 +29088,7 @@ index 0722a25..8cb4965 100644
 +					rsbac_attribute,
 +					rsbac_attribute_value))	{
 +			err = -EPERM;
-+			goto out_free;
++			goto out_unlock;
 +		}
 +	}
 +#endif
@@ -29186,7 +29096,7 @@ index 0722a25..8cb4965 100644
  	if (unix_peer(other) != sk && unix_recvq_full(other)) {
  		if (!timeo) {
  			err = -EAGAIN;
-@@ -1549,6 +1945,24 @@ restart:
+@@ -1545,6 +1945,24 @@ restart:
  	other->sk_data_ready(other, len);
  	sock_put(other);
  	scm_destroy(siocb->scm);
@@ -29211,7 +29121,7 @@ index 0722a25..8cb4965 100644
  	return len;
  
  out_unlock:
-@@ -1576,6 +1990,14 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
+@@ -1572,6 +1990,14 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
  	bool fds_sent = false;
  	int max_level;
  
@@ -29226,7 +29136,7 @@ index 0722a25..8cb4965 100644
  	if (NULL == siocb->scm)
  		siocb->scm = &tmp_scm;
  	wait_for_unix_gc();
-@@ -1600,6 +2022,55 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
+@@ -1596,6 +2022,55 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
  	if (sk->sk_shutdown & SEND_SHUTDOWN)
  		goto pipe_err;
  
@@ -29282,7 +29192,7 @@ index 0722a25..8cb4965 100644
  	while (sent < len) {
  		/*
  		 *	Optimisation for the fact that under 0.01% of X
-@@ -1667,6 +2138,23 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
+@@ -1663,6 +2138,23 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
  	scm_destroy(siocb->scm);
  	siocb->scm = NULL;
  
@@ -29306,7 +29216,7 @@ index 0722a25..8cb4965 100644
  	return sent;
  
  pipe_err_free:
-@@ -1679,6 +2167,24 @@ pipe_err:
+@@ -1675,6 +2167,24 @@ pipe_err:
  out_err:
  	scm_destroy(siocb->scm);
  	siocb->scm = NULL;
@@ -29331,7 +29241,7 @@ index 0722a25..8cb4965 100644
  	return sent ? : err;
  }
  
-@@ -1736,10 +2242,78 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
+@@ -1732,10 +2242,78 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
  	struct sk_buff *skb;
  	int err;
  
@@ -29410,7 +29320,7 @@ index 0722a25..8cb4965 100644
  	msg->msg_namelen = 0;
  
  	err = mutex_lock_interruptible(&u->readlock);
-@@ -1812,6 +2386,24 @@ out_free:
+@@ -1808,6 +2386,24 @@ out_free:
  out_unlock:
  	mutex_unlock(&u->readlock);
  out:
@@ -29435,7 +29345,7 @@ index 0722a25..8cb4965 100644
  	return err;
  }
  
-@@ -1864,6 +2456,14 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+@@ -1860,6 +2456,14 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
  	int err = 0;
  	long timeo;
  
@@ -29450,7 +29360,7 @@ index 0722a25..8cb4965 100644
  	err = -EINVAL;
  	if (sk->sk_state != TCP_ESTABLISHED)
  		goto out;
-@@ -1872,6 +2472,66 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+@@ -1868,6 +2472,66 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
  	if (flags&MSG_OOB)
  		goto out;
  
@@ -29517,7 +29427,7 @@ index 0722a25..8cb4965 100644
  	target = sock_rcvlowat(sk, flags&MSG_WAITALL, size);
  	timeo = sock_rcvtimeo(sk, flags&MSG_DONTWAIT);
  
-@@ -1995,6 +2655,23 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+@@ -1991,6 +2655,23 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
  	mutex_unlock(&u->readlock);
  	scm_recv(sock, msg, siocb->scm, flags);
  out:
@@ -35448,7 +35358,7 @@ index 0000000..84fd7d8
 +}
 diff --git a/rsbac/adf/adf_main.c b/rsbac/adf/adf_main.c
 new file mode 100644
-index 0000000..09df74f
+index 0000000..49e9e23
 --- /dev/null
 +++ b/rsbac/adf/adf_main.c
 @@ -0,0 +1,3394 @@
@@ -38149,8 +38059,8 @@ index 0000000..09df74f
 +          }
 +#endif
 +
-+	if(may_sync)
-+          err = generic_file_fsync(&file, 1);
++	if(may_sync && (dentry_p->d_inode->i_size > 0))
++          err = generic_file_fsync(&file, 0, dentry_p->d_inode->i_size - 1, 1);
 +          
 +        rsbac_kfree(buffer);
 +      }
@@ -41164,10 +41074,10 @@ index 0000000..002f0b7
 +endif
 diff --git a/rsbac/adf/daz/daz_main.c b/rsbac/adf/daz/daz_main.c
 new file mode 100644
-index 0000000..a5bdebb
+index 0000000..991838d
 --- /dev/null
 +++ b/rsbac/adf/daz/daz_main.c
-@@ -0,0 +1,1150 @@
+@@ -0,0 +1,1167 @@
 +/*************************************************** */
 +/* Rule Set Based Access Control                     */
 +/* Implementation of the Access Control Decision     */
@@ -41274,6 +41184,8 @@ index 0000000..a5bdebb
 +	union rsbac_target_id_t       i_tid;
 +
 +	/* reset scanned status for file */
++	rsbac_pr_debug(adf_daz, "pid %u (%.15s), resetting scanned status!\n",
++				       current->pid, current->comm);
 +	i_tid.file=file;
 +	i_attr_val1.daz_scanned = DAZ_unscanned;
 +	if(rsbac_set_attr(SW_DAZ,
@@ -41516,6 +41428,10 @@ index 0000000..a5bdebb
 +		return -1;
 +	rsbac_get_full_path(dfs->extra_data->dentry, dfs->extra_data->full_filename, DAZ_MAX_FILENAME);
 +
++	rsbac_pr_debug(adf_daz, "pid %u (%.15s), file is %s!\n",
++				       current->pid, current->comm,
++				       dfs->extra_data->full_filename);
++
 +	/* find the actual value of the length */
 +	dfs->extra_data->full_filename_length = strlen(dfs->extra_data->full_filename);
 +
@@ -42030,6 +41946,8 @@ index 0000000..a5bdebb
 +		return GRANTED;
 +#endif
 +
++	rsbac_pr_debug(adf_daz, "pid %u (%.15s), scanning required!\n",
++				       current->pid, current->comm);
 +	xp_id.pid = current->pid;
 +	xp_id.file = NULL;
 +
@@ -42078,6 +41996,8 @@ index 0000000..a5bdebb
 +					}
 +				}
 +#endif
++				rsbac_pr_debug(adf_daz, "pid %u (%.15s), dazuko_sys_pre() result is %i\n",
++				       current->pid, current->comm, error);
 +			}
 +			else
 +			{
@@ -42087,14 +42007,21 @@ index 0000000..a5bdebb
 +
 +			dazuko_file_struct_cleanup(&dfs);
 +		}
++		if(error == 2)
++			return DO_NOT_CARE;
++		if(error == 0) {
++			rsbac_pr_debug(adf_daz, "pid %u (%.15s), file clean!\n",
++				       current->pid, current->comm);
++			return GRANTED;
++		} else {
++			rsbac_pr_debug(adf_daz, "pid %u (%.15s), file infected!\n",
++				       current->pid, current->comm);
++			return NOT_GRANTED;
++		}
 +	}
-+
-+	if(error == 2)
-+		return DO_NOT_CARE;
-+	if(error == 0)
-+		return GRANTED;
-+	else
-+		return NOT_GRANTED;
++	rsbac_pr_debug(adf_daz, "pid %u (%.15s), dazuko_sys_check() result is %i\n",
++	       current->pid, current->comm, check_error);
++	return DO_NOT_CARE;
 +} /* end of rsbac_adf_request_daz() */
 +
 +
@@ -42998,15 +42925,15 @@ index 0000000..3519be9
 +#endif
 diff --git a/rsbac/adf/daz/dazuko_xp.c b/rsbac/adf/daz/dazuko_xp.c
 new file mode 100644
-index 0000000..ee81ab9
+index 0000000..cc9265b
 --- /dev/null
 +++ b/rsbac/adf/daz/dazuko_xp.c
-@@ -0,0 +1,2902 @@
+@@ -0,0 +1,2903 @@
 +/* DazukoXP. Allow cross platform file access control for 3rd-party applications.
 +   Written by John Ogness <jogness@×××××××.de>
 +
 +   Copyright (c) 2002, 2003, 2004 H+BEDV Datentechnik GmbH
-+   Copyright (c) 2004-2010 Amon Ott <ao@×××××.org>
++   Copyright (c) 2004-2011 Amon Ott <ao@×××××.org>
 +   
 +   All rights reserved.
 +
@@ -43038,6 +42965,9 @@ index 0000000..ee81ab9
 +   POSSIBILITY OF SUCH DAMAGE.
 +*/
 +
++#include <rsbac/types.h>
++#include <rsbac/debug.h>
++
 +#include "dazuko_platform.h"
 +
 +#include "dazuko_xp.h"
@@ -43750,7 +43680,7 @@ index 0000000..ee81ab9
 +	struct slot_list	*sl;
 +	int		i;
 +
-+	DPRINT(("dazuko: dazuko_register_daemon() [%d]\n", did->unique));
++	rsbac_pr_debug(adf_daz, "Registering daemon %s [%d]\n", reg_name, did->unique);
 +
 +	if (did == NULL || reg_name == NULL)
 +		return XP_ERROR_PERMISSION;
@@ -43892,9 +43822,7 @@ index 0000000..ee81ab9
 +	/* the daemon is registered, but not yet
 +	 * ready to receive files */
 +	__dazuko_change_slot_state(s, DAZUKO_FREE, DAZUKO_FREE);
-+
-+	DPRINT(("dazuko: slot[%d] assigned to daemon %d\n", s->id, s->did.unique));
-+
++	rsbac_pr_debug(adf_daz, "slot[%d] assigned to daemon %s [%d]", s->id, reg_name, did->unique);
 +	call_xp_up(&(s->mutex));
 +/* UP */
 +
@@ -45582,18 +45510,18 @@ index 0000000..ee81ab9
 +			/* will need to scan if ON_CLOSE_MODIFIED is in the mask too */
 +
 +			if ((SCAN_ON_CLOSE || SCAN_ON_CLOSE_MODIFIED) == 0)
-+				return -1;
++				return -2;
 +			break;
 +
 +		default:
 +			if ((access_mask & event) == 0)
-+				return -1;
++				return -3;
 +			break;
 +	}
 +
 +	/* do we have any daemons? */
 +	if (call_xp_atomic_read(&active) <= 0)
-+		return -1;
++		return -4;
 +
 +	/* should daemons be allowed this event without a scan? */
 +	if (daemon_is_allowed)
@@ -45603,7 +45531,7 @@ index 0000000..ee81ab9
 +			/* this is one of our daemons, so we will report as
 +			 * as if this event was not in the mask */
 +
-+			return -1;
++			return -5;
 +		}
 +	}
 +
@@ -47109,19 +47037,19 @@ index 0000000..7efcd46
 +
 diff --git a/rsbac/adf/jail/jail_main.c b/rsbac/adf/jail/jail_main.c
 new file mode 100644
-index 0000000..67bc197
+index 0000000..0c838ee
 --- /dev/null
 +++ b/rsbac/adf/jail/jail_main.c
-@@ -0,0 +1,1278 @@
+@@ -0,0 +1,1395 @@
 +/**************************************************** */
 +/* Rule Set Based Access Control                      */
 +/* Implementation of the Access Control Decision      */
 +/* Facility (ADF) - Authorization module              */
 +/* File: rsbac/adf/jail/jail_main.c                   */
 +/*                                                    */
-+/* Author and (c) 1999-2010: Amon Ott <ao@×××××.org>  */
++/* Author and (c) 1999-2011: Amon Ott <ao@×××××.org>  */
 +/*                                                    */
-+/* Last modified: 14/Sep/2010                         */
++/* Last modified: 17/Oct/2011                         */
 +/**************************************************** */
 +
 +#include <linux/string.h>
@@ -47326,7 +47254,7 @@ index 0000000..67bc197
 +					|| (
 +						(jail_flags &
 +						JAIL_allow_inet_localhost)
-+						&& (addr->sin_addr.s_addr == 
++						&& (addr->sin_addr.s_addr ==
 +						RSBAC_JAIL_LOCALHOST)
 +					)
 +#if defined(CONFIG_RSBAC_JAIL_NET_ADJUST)
@@ -47363,7 +47291,7 @@ index 0000000..67bc197
 +				    || (
 +					    (jail_flags &
 +					     JAIL_allow_inet_localhost)
-+					    && 
++					    &&
 +					    ((inet_sk(tid.netobj.sock_p->sk)->
 +					      inet_saddr == RSBAC_JAIL_LOCALHOST)
 +				    || (
@@ -48308,83 +48236,200 @@ index 0000000..67bc197
 +		}
 +
 +	case R_CREATE:
-+		if (target == T_IPC) {
-+			/* Get jail_id from process */
-+			i_tid.process = caller_pid;
-+			if (rsbac_get_attr(SW_JAIL,
-+					   T_PROCESS,
-+					   i_tid,
-+					   A_jail_id,
-+					   &i_attr_val1, FALSE)) {
-+				rsbac_ds_get_error
-+				    ("rsbac_adf_set_attr_jail()",
-+				     A_jail_id);
-+				return (-RSBAC_EREADFAILED);
-+			}
-+			/* Set jail_id for new IPC */
-+			if (rsbac_set_attr(SW_JAIL,
-+					   T_IPC,
-+					   tid, A_jail_id, i_attr_val1)) {
-+				rsbac_ds_set_error
-+				    ("rsbac_adf_set_attr_jail()",
-+				     A_jail_id);
-+				return (-RSBAC_EWRITEFAILED);
-+			}
-+			return 0;
-+		}
-+		/* fall through */
++		switch (target) {
++			case T_IPC:
++				/* Get jail_id from process */
++				i_tid.process = caller_pid;
++				if (rsbac_get_attr(SW_JAIL,
++						   T_PROCESS,
++						   i_tid,
++						   A_jail_id,
++						   &i_attr_val1, FALSE)) {
++					rsbac_ds_get_error
++					    ("rsbac_adf_set_attr_jail()",
++					     A_jail_id);
++					return -RSBAC_EREADFAILED;
++				}
++				if (i_attr_val1.jail_id) {
++					/* Set jail_id for new IPC */
++					if (rsbac_set_attr(SW_JAIL,
++							   T_IPC,
++							   tid, A_jail_id, i_attr_val1)) {
++						rsbac_ds_set_error
++						    ("rsbac_adf_set_attr_jail()",
++						     A_jail_id);
++						return -RSBAC_EWRITEFAILED;
++					}
++				}
++				return 0;
 +
 +#ifdef CONFIG_RSBAC_JAIL_NET_ADJUST
-+	case R_BIND:
-+		if (target != T_NETOBJ)
-+			return 0;
-+		if (!tid.netobj.sock_p) {
-+			rsbac_printk(KERN_WARNING
-+				     "rsbac_adf_set_attr_jail(): NULL sock_p!\n");
-+			return 0;
++			case T_NETOBJ:
++				if (!tid.netobj.sock_p) {
++					rsbac_printk(KERN_WARNING
++						     "rsbac_adf_set_attr_jail(): NULL sock_p!\n");
++					return 0;
++				}
++				if (!tid.netobj.sock_p->ops) {
++					return 0;
++				}
++				switch (tid.netobj.sock_p->ops->family) {
++				case AF_INET:
++					i_tid.process = caller_pid;
++					if ((err = rsbac_get_attr(SW_JAIL,
++								  T_PROCESS,
++								  i_tid,
++								  A_jail_ip,
++								  &i_attr_val1, TRUE))) {
++						rsbac_ds_get_error
++						    ("rsbac_adf_set_attr_jail()",
++						     A_jail_ip);
++						return -RSBAC_EREADFAILED;
++					}
++					if (i_attr_val1.jail_ip == INADDR_ANY)
++						return 0;
++					if ((err = rsbac_get_attr(SW_JAIL,
++								  T_PROCESS,
++								  i_tid,
++								  A_jail_flags,
++								  &i_attr_val2, TRUE))) {
++						rsbac_ds_get_error
++						    ("rsbac_adf_set_attr_jail()",
++						     A_jail_flags);
++						return -RSBAC_EREADFAILED;
++					}
++					if (i_attr_val2.
++					    jail_flags & JAIL_auto_adjust_inet_any) {
++						inet_sk(tid.netobj.sock_p->sk)->inet_rcv_saddr =
++						    i_attr_val1.jail_ip;
++						inet_sk(tid.netobj.sock_p->sk)->inet_saddr =
++						    i_attr_val1.jail_ip;
++					}
++					return 0;
++
++				default:
++					break;
++				}
++#endif
++
++			default:
++				return 0;
 +		}
-+		if (!tid.netobj.sock_p->ops) {
-+			return 0;
++
++	case R_BIND:
++		switch (target) {
++			case T_IPC:
++				/* Get jail_id from process */
++				i_tid.process = caller_pid;
++				if (rsbac_get_attr(SW_JAIL,
++						   T_PROCESS,
++						   i_tid,
++						   A_jail_id,
++						   &i_attr_val1, FALSE)) {
++					rsbac_ds_get_error
++					    ("rsbac_adf_set_attr_jail()",
++					     A_jail_id);
++					return -RSBAC_EREADFAILED;
++				}
++				if (i_attr_val1.jail_id) {
++					/* Set jail_id for new IPC */
++					if (rsbac_set_attr(SW_JAIL,
++							   T_IPC,
++							   tid, A_jail_id, i_attr_val1)) {
++						rsbac_ds_set_error
++						    ("rsbac_adf_set_attr_jail()",
++						     A_jail_id);
++						return -RSBAC_EWRITEFAILED;
++					}
++				}
++				return 0;
++
++#ifdef CONFIG_RSBAC_JAIL_NET_ADJUST
++			case T_NETOBJ:
++				if (!tid.netobj.sock_p) {
++					rsbac_printk(KERN_WARNING
++						     "rsbac_adf_set_attr_jail(): NULL sock_p!\n");
++					return 0;
++				}
++				if (!tid.netobj.sock_p->ops) {
++					return 0;
++				}
++				switch (tid.netobj.sock_p->ops->family) {
++				case AF_INET:
++					i_tid.process = caller_pid;
++					if ((err = rsbac_get_attr(SW_JAIL,
++								  T_PROCESS,
++								  i_tid,
++								  A_jail_ip,
++								  &i_attr_val1, TRUE))) {
++						rsbac_ds_get_error
++						    ("rsbac_adf_set_attr_jail()",
++						     A_jail_ip);
++						return -RSBAC_EREADFAILED;
++					}
++					if (i_attr_val1.jail_ip == INADDR_ANY)
++						return 0;
++					if ((err = rsbac_get_attr(SW_JAIL,
++								  T_PROCESS,
++								  i_tid,
++								  A_jail_flags,
++								  &i_attr_val2, TRUE))) {
++						rsbac_ds_get_error
++						    ("rsbac_adf_set_attr_jail()",
++						     A_jail_flags);
++						return -RSBAC_EREADFAILED;
++					}
++					if (i_attr_val2.
++					    jail_flags & JAIL_auto_adjust_inet_any) {
++						inet_sk(tid.netobj.sock_p->sk)->inet_rcv_saddr =
++						    i_attr_val1.jail_ip;
++						inet_sk(tid.netobj.sock_p->sk)->inet_saddr =
++						    i_attr_val1.jail_ip;
++					}
++					return 0;
++
++				default:
++					break;
++				}
++#endif
++			default:
++				return 0;
 +		}
-+		switch (tid.netobj.sock_p->ops->family) {
-+		case AF_INET:
-+			i_tid.process = caller_pid;
-+			if ((err = rsbac_get_attr(SW_JAIL,
-+						  T_PROCESS,
-+						  i_tid,
-+						  A_jail_ip,
-+						  &i_attr_val1, TRUE))) {
-+				rsbac_ds_get_error
-+				    ("rsbac_adf_set_attr_jail()",
-+				     A_jail_ip);
-+				return -RSBAC_EREADFAILED;
-+			}
-+			if (i_attr_val1.jail_ip == INADDR_ANY)
++
++	case R_CONNECT:
++		switch (target) {
++			case T_IPC:
++				if (new_target != T_IPC)
++					return 0;
++				/* Get jail_id from old IPC */
++				i_tid.process = caller_pid;
++				if (rsbac_get_attr(SW_JAIL,
++						   T_IPC,
++						   tid,
++						   A_jail_id,
++						   &i_attr_val1, FALSE)) {
++					rsbac_ds_get_error
++					    ("rsbac_adf_set_attr_jail()",
++					     A_jail_id);
++					return -RSBAC_EREADFAILED;
++				}
++				if (i_attr_val1.jail_id) {
++					/* Set jail_id for new IPC */
++					if (rsbac_set_attr(SW_JAIL,
++							   T_IPC,
++							   new_tid, A_jail_id, i_attr_val1)) {
++						rsbac_ds_set_error
++						    ("rsbac_adf_set_attr_jail()",
++						     A_jail_id);
++						return -RSBAC_EWRITEFAILED;
++					}
++				}
 +				return 0;
-+			if ((err = rsbac_get_attr(SW_JAIL,
-+						  T_PROCESS,
-+						  i_tid,
-+						  A_jail_flags,
-+						  &i_attr_val2, TRUE))) {
-+				rsbac_ds_get_error
-+				    ("rsbac_adf_set_attr_jail()",
-+				     A_jail_flags);
-+				return -RSBAC_EREADFAILED;
-+			}
-+			if (i_attr_val2.
-+			    jail_flags & JAIL_auto_adjust_inet_any) {
-+				inet_sk(tid.netobj.sock_p->sk)->inet_rcv_saddr =
-+				    i_attr_val1.jail_ip;
-+				inet_sk(tid.netobj.sock_p->sk)->inet_saddr =
-+				    i_attr_val1.jail_ip;
-+			}
-+			return 0;
 +
-+		default:
-+			break;
++			default:
++				return 0;
 +		}
-+#endif
-+		return 0;
++
 +	default:
 +		return 0;
 +	}
@@ -61193,10 +61238,10 @@ index 0000000..e9c0162
 +endif
 diff --git a/rsbac/adf/rc/rc_main.c b/rsbac/adf/rc/rc_main.c
 new file mode 100644
-index 0000000..55e4bb0a
+index 0000000..58d48c0
 --- /dev/null
 +++ b/rsbac/adf/rc/rc_main.c
-@@ -0,0 +1,2983 @@
+@@ -0,0 +1,3153 @@
 +/*************************************************** */
 +/* Rule Set Based Access Control                     */
 +/* Implementation of the Access Control Decision     */
@@ -61205,7 +61250,7 @@ index 0000000..55e4bb0a
 +/*                                                   */
 +/* Author and (c) 1999-2011: Amon Ott <ao@×××××.org> */
 +/*                                                   */
-+/* Last modified: 12/Jul/2011                        */
++/* Last modified: 29/Nov/2011                        */
 +/*************************************************** */
 +
 +#include <linux/string.h>
@@ -61477,7 +61522,9 @@ index 0000000..55e4bb0a
 +				i_rc_subtid, RI_type_comp_scd, request)) {
 +		return GRANTED;
 +	} else {
++#if defined(CONFIG_RSBAC_RC_LEARN) || defined(CONFIG_RSBAC_DEBUG)
 +		char tmp[RSBAC_MAXNAMELEN];
++#endif
 +
 +#if defined(CONFIG_RSBAC_RC_LEARN)
 +		if (rsbac_rc_learn) {
@@ -61833,10 +61880,12 @@ index 0000000..55e4bb0a
 +				i_rc_subtid, i_rc_item, request))
 +		return GRANTED;
 +	else {
++#ifdef CONFIG_RSBAC_DEBUG
 +		char tmp[RSBAC_MAXNAMELEN];
 +		rsbac_pr_debug(adf_rc, "rc_role is %i, rc_type is %i, request is %s -> NOT_GRANTED!\n",
 +			       i_attr_val1.rc_role, type,
 +			       get_rc_special_right_name(tmp, request));
++#endif
 +		return NOT_GRANTED;
 +	}
 +}
@@ -63222,9 +63271,68 @@ index 0000000..55e4bb0a
 +		}
 +
 +
-+#if defined(CONFIG_RSBAC_NET)
 +	case R_BIND:
 +		switch (target) {
++		case T_IPC:
++			/* check, whether we may create IPC of def_ipc_create_type */
++			/* get rc_role from process */
++			i_tid.process = caller_pid;
++			if ((err = rsbac_get_attr(SW_RC, T_PROCESS,
++						  i_tid,
++						  A_rc_role,
++						  &i_attr_val1, FALSE))) {
++				rsbac_pr_get_error(A_rc_role);
++				return NOT_GRANTED;
++			}
++			/* get def_ipc_create_type of role */
++			i_rc_tid.role = i_attr_val1.rc_role;
++			if ((err = rsbac_rc_get_item(0,
++						     RT_ROLE,
++						     i_rc_tid,
++						     i_rc_tid,
++						     RI_def_ipc_create_type,
++						     &i_rc_item_val1,
++						     NULL))) {
++				rsbac_rc_pr_get_error
++				    (RI_def_ipc_create_type);
++				return NOT_GRANTED;
++			}
++			switch (i_rc_item_val1.type_id) {
++			case RC_type_no_create:
++				rsbac_pr_debug(adf_rc, "pid %u (%.15s), owner %u, rc_role %u, def_ipc_create_type no_create, request CREATE -> NOT_GRANTED!\n",
++					       pid_nr(caller_pid), current->comm,
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,29)
++					       current_uid(),
++#else
++					       current->uid,
++#endif
++					       i_attr_val1.rc_role);
++				return NOT_GRANTED;
++
++			case RC_type_use_new_role_def_create:
++				/* error - complain and return error */
++				rsbac_printk(KERN_WARNING "rsbac_adf_request_rc(): invalid type use_new_role_def_create in def_ipc_create_type of role %i!\n",
++					     i_attr_val1.rc_role);
++				return NOT_GRANTED;
++
++			case RC_type_inherit_parent:
++			case RC_type_inherit_process:
++			case RC_type_use_fd:
++				/* error - complain and return error */
++				rsbac_printk(KERN_WARNING "rsbac_adf_request_rc(): invalid type inherit_parent in def_ipc_create_type of role %i!\n",
++					     i_attr_val1.rc_role);
++				return NOT_GRANTED;
++
++			default:
++				/* check, whether role has CREATE right to new type */
++				/* get type_comp_ipc of role */
++				i_rc_subtid.type = i_rc_item_val1.type_id;
++				return rc_check_create(caller_pid,
++							target,
++							i_rc_tid,
++							i_rc_subtid,
++							RI_type_comp_ipc);
++			}
 +#if defined(CONFIG_RSBAC_RC_NET_DEV_PROT)
 +		case T_NETDEV:
 +			return check_comp_rc
@@ -63241,7 +63349,6 @@ index 0000000..55e4bb0a
 +		default:
 +			return DO_NOT_CARE;
 +		}
-+#endif
 +
 +	case R_IOCTL:
 +		switch (target) {
@@ -64136,6 +64243,114 @@ index 0000000..55e4bb0a
 +		default:
 +			return 0;
 +		}
++	case R_BIND:
++		switch (target) {
++		case T_IPC:
++			/* get rc_role from process */
++			i_tid.process = caller_pid;
++			if ((err = rsbac_get_attr(SW_RC, T_PROCESS,
++						  i_tid,
++						  A_rc_role,
++						  &i_attr_val1, FALSE))) {
++				rsbac_pr_get_error(A_rc_role);
++				return -RSBAC_EREADFAILED;
++			}
++			/* get def_ipc_create_type of role */
++			i_rc_tid.role = i_attr_val1.rc_role;
++			if ((err = rsbac_rc_get_item(0,
++						     RT_ROLE,
++						     i_rc_tid,
++						     i_rc_tid,
++						     RI_def_ipc_create_type,
++						     &i_rc_item_val1,
++						     NULL))) {
++				rsbac_rc_pr_get_error
++				    (RI_def_ipc_create_type);
++				return -RSBAC_EREADFAILED;
++			}
++			switch (i_rc_item_val1.type_id) {
++			case RC_type_no_create:
++				return -RSBAC_EDECISIONMISMATCH;
++				break;
++
++			case RC_type_use_new_role_def_create:
++				/* error - complain and return error */
++				rsbac_printk(KERN_WARNING "rsbac_adf_set_attr_rc(): invalid type use_new_role_def_create in def_ipc_create_type of role %i!\n",
++					     i_attr_val1.rc_role);
++				return -RSBAC_EINVALIDVALUE;
++
++			case RC_type_inherit_parent:
++			case RC_type_inherit_process:
++				/* error - complain and return error */
++				rsbac_printk(KERN_WARNING "rsbac_adf_set_attr_rc(): invalid type inherit_parent in def_ipc_create_type of role %i!\n",
++					     i_attr_val1.rc_role);
++				return -RSBAC_EINVALIDVALUE;
++
++			default:
++				/* set rc_type for ipc target */
++				i_attr_val1.rc_type =
++				    i_rc_item_val1.type_id;
++				/* get type from target */
++				if ((err = rsbac_get_attr(SW_RC,
++							  target,
++							  tid,
++							  A_rc_type,
++							  &i_attr_val2,
++							  FALSE))) {
++					rsbac_pr_get_error(A_rc_type);
++					return -RSBAC_EREADFAILED;
++				}
++				/* set it for new target, if different */
++				if (i_attr_val1.rc_type !=
++				    i_attr_val2.rc_type) {
++					if ((err =
++					     rsbac_set_attr(SW_RC, target,
++							    tid, A_rc_type,
++							    i_attr_val1)))
++					{
++						rsbac_pr_set_error
++						    (A_rc_type);
++						return -RSBAC_EWRITEFAILED;
++					}
++				}
++			}
++			return 0;
++
++			/* all other cases are unknown */
++		default:
++			return 0;
++		}
++
++	case R_CONNECT:
++		switch (target) {
++		case T_IPC:
++			if (new_target == T_IPC) {
++				/* get type from old target */
++				i_tid.process = caller_pid;
++				if ((err = rsbac_get_attr(SW_RC, T_IPC,
++							  tid,
++							  A_rc_type,
++							  &i_attr_val1, FALSE))) {
++					rsbac_pr_get_error(A_rc_role);
++					return -RSBAC_EREADFAILED;
++				}
++				/* set rc_type for new ipc target, if not 0 */
++				if (i_attr_val1.rc_type) {
++					if ((err = rsbac_set_attr(SW_RC, T_IPC,
++							    new_tid, A_rc_type,
++							    i_attr_val1))) {
++						rsbac_pr_set_error(A_rc_type);
++						return -RSBAC_EWRITEFAILED;
++					}
++				}
++			}
++			return 0;
++
++			/* all other cases are unknown */
++		default:
++			return 0;
++		}
++
 +	default:
 +		return 0;
 +	}
@@ -66068,14 +66283,15 @@ index 0000000..93d0328
 +
 diff --git a/rsbac/adf/reg/modules_off.c b/rsbac/adf/reg/modules_off.c
 new file mode 100644
-index 0000000..c6f8042
+index 0000000..e19a488
 --- /dev/null
 +++ b/rsbac/adf/reg/modules_off.c
-@@ -0,0 +1,106 @@
+@@ -0,0 +1,90 @@
 +/*
 + *   RSBAC REG decision module kproc_hide. Disabling kernel modules support.
 + *   
-+ *   Author and (c) 2004 Michal Purzynski <albeiro@×××××.org>
++ *   Author and (c) 2004 Michal Purzynski <michal@×××××.org>
++ *   Adjusted 2011 Amon Ott <ao@×××××.org>
 + */
 +
 +#include <linux/module.h>
@@ -66098,9 +66314,6 @@ index 0000000..c6f8042
 +
 +static long handle = 9999991;
 +
-+static rsbac_inode_nr_t inode_nr = 0;
-+static kdev_t device_nr = 0;
-+
 +/**** Decision Functions ****/
 +
 +static int request_func (enum rsbac_adf_request_t	request,
@@ -66115,14 +66328,6 @@ index 0000000..c6f8042
 +		case R_ADD_TO_KERNEL:
 +		case R_REMOVE_FROM_KERNEL:
 +			return NOT_GRANTED;
-+		case R_GET_STATUS_DATA:
-+			switch (target) {
-+				case T_FILE:
-+					if (tid.file.device == device_nr && tid.file.inode == inode_nr)
-+					return NOT_GRANTED;
-+				default:
-+					return DO_NOT_CARE;
-+			}
 +		default:
 +			return DO_NOT_CARE;
 +	}
@@ -66134,12 +66339,6 @@ index 0000000..c6f8042
 +{
 +
 +	struct rsbac_reg_entry_t entry;
-+	struct nameidata nd;
-+
-+	path_lookup("/proc/modules", 0, &nd);
-+	device_nr = nd.path.dentry->d_sb->s_dev;
-+	inode_nr = nd.path.dentry->d_inode->i_ino;
-+	path_put(&nd.path);
 +
 +	rsbac_printk(KERN_INFO "RSBAC REG decision module modules_off: Initializing.\n");
 +
@@ -68954,10 +69153,10 @@ index 0000000..926a336
 +
 diff --git a/rsbac/data_structures/aci_data_structures.c b/rsbac/data_structures/aci_data_structures.c
 new file mode 100644
-index 0000000..3296c53
+index 0000000..3515076
 --- /dev/null
 +++ b/rsbac/data_structures/aci_data_structures.c
-@@ -0,0 +1,14476 @@
+@@ -0,0 +1,14457 @@
 +/*************************************************** */
 +/* Rule Set Based Access Control                     */
 +/* Implementation of ACI data structures             */
@@ -68965,7 +69164,7 @@ index 0000000..3296c53
 +/* (some smaller parts copied from fs/namei.c        */
 +/*  and others)                                      */
 +/*                                                   */
-+/* Last modified: 12/Jul/2011                        */
++/* Last modified: 17/Oct/2011                        */
 +/*************************************************** */
 +
 +#include <linux/types.h>
@@ -69020,6 +69219,7 @@ index 0000000..3296c53
 +#include <linux/kdev_t.h>
 +
 +#define FUSE_SUPER_MAGIC 0x65735546
++#define CEPH_SUPER_MAGIC 0x00c36400
 +
 +#ifdef CONFIG_RSBAC_MAC
 +#include <rsbac/mac.h>
@@ -69300,7 +69500,8 @@ index 0000000..3296c53
 +	    || (sb_p->s_magic == SMB_SUPER_MAGIC)
 +	    || (sb_p->s_magic == ISOFS_SUPER_MAGIC)
 +	    || (sb_p->s_magic == OCFS2_SUPER_MAGIC)
-+	    || (sb_p->s_magic == FUSE_SUPER_MAGIC))
++	    || (sb_p->s_magic == FUSE_SUPER_MAGIC)
++	    || (sb_p->s_magic == CEPH_SUPER_MAGIC))
 +		return FALSE;
 +	else
 +		return TRUE;
@@ -70589,7 +70790,7 @@ index 0000000..3296c53
 +		tmperr = rsbac_list_register_hashed(RSBAC_LIST_VERSION,
 +					     &device_p->handles.rc,
 +					     info_p,
-+					     RSBAC_LIST_PERSIST | (RSBAC_MAJOR(kdev) ? RSBAC_LIST_OWN_SLAB : 0) |
++					     RSBAC_LIST_PERSIST | RSBAC_LIST_OWN_SLAB |
 +					     RSBAC_LIST_DEF_DATA | RSBAC_LIST_AUTO_HASH_RESIZE,
 +					     NULL,
 +					     NULL, &def_rc_fd_aci,
@@ -71462,16 +71663,8 @@ index 0000000..3296c53
 +				new_dir_p =
 +				    dget(new_file_dentry_p->d_parent);
 +				double_lock(new_dir_p, old_dir_p);
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,34)
 +				dquot_initialize(old_dir_p->d_inode);
 +				dquot_initialize(new_dir_p->d_inode);
-+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
-+				vfs_dq_init(old_dir_p->d_inode);
-+				vfs_dq_init(new_dir_p->d_inode);
-+#else
-+				DQUOT_INIT(old_dir_p->d_inode);
-+				DQUOT_INIT(new_dir_p->d_inode);
-+#endif
 +				/* try to rename file in rsbac dir */
 +				/* rsbac_pr_debug(write, "calling rename function\n"); */
 +				err =
@@ -71536,14 +71729,7 @@ index 0000000..3296c53
 +						old_dir_p =
 +						    lock_parent
 +						    (file_dentry_p);
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,34)
 +						dquot_initialize(old_dir_p->d_inode);
-+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
-+						vfs_dq_init(old_dir_p->d_inode);
-+#else
-+						DQUOT_INIT(old_dir_p->
-+							   d_inode);
-+#endif
 +						err = -ENOENT;
 +							err =
 +							    dir_dentry_p->
@@ -71629,13 +71815,7 @@ index 0000000..3296c53
 +		}
 +		/* try to create file in rsbac dir */
 +		/* rsbac_pr_debug(write, "calling create function\n"); */
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,34)
 +		dquot_initialize(ldir_dentry_p->d_inode);
-+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
-+		vfs_dq_init(ldir_dentry_p->d_inode);
-+#else
-+		DQUOT_INIT(ldir_dentry_p->d_inode);
-+#endif
 +		err =
 +		    dir_dentry_p->d_inode->i_op->create(ldir_dentry_p->
 +							d_inode,
@@ -83436,10 +83616,10 @@ index 0000000..3296c53
 +}
 diff --git a/rsbac/data_structures/acl_data_structures.c b/rsbac/data_structures/acl_data_structures.c
 new file mode 100644
-index 0000000..65714b914
+index 0000000..6f71257
 --- /dev/null
 +++ b/rsbac/data_structures/acl_data_structures.c
-@@ -0,0 +1,8392 @@
+@@ -0,0 +1,8398 @@
 +/*************************************************** */
 +/* Rule Set Based Access Control                     */
 +/* Implementation of ACL data structures             */
@@ -88118,7 +88298,9 @@ index 0000000..65714b914
 +	int err = 0;
 +	struct rsbac_acl_device_list_item_t *device_p;
 +	struct rsbac_acl_entry_desc_t desc;
++#ifdef CONFIG_RSBAC_DEBUG
 +	char tmp[RSBAC_MAXNAMELEN];
++#endif
 +	rsbac_acl_rights_vector_t mask;
 +	int srcu_idx;
 +
@@ -88494,7 +88676,9 @@ index 0000000..65714b914
 +			 union rsbac_target_id_t tid)
 +{
 +	int err = 0;
++#ifdef CONFIG_RSBAC_DEBUG
 +	char tmp[RSBAC_MAXNAMELEN];
++#endif
 +	struct rsbac_acl_device_list_item_t *device_p;
 +	int srcu_idx;
 +
@@ -89482,7 +89666,9 @@ index 0000000..65714b914
 +		       rsbac_acl_rights_vector_t mask)
 +{
 +	int err = 0;
++#ifdef CONFIG_RSBAC_DEBUG
 +	char tmp[80];
++#endif
 +	struct rsbac_acl_device_list_item_t *device_p;
 +	int srcu_idx;
 +
@@ -124617,10 +124803,10 @@ index 0000000..738fb52
 +
 diff --git a/rsbac/help/getname.c b/rsbac/help/getname.c
 new file mode 100644
-index 0000000..e435580
+index 0000000..9dbfd88
 --- /dev/null
 +++ b/rsbac/help/getname.c
-@@ -0,0 +1,1821 @@
+@@ -0,0 +1,1834 @@
 +/************************************* */
 +/* Rule Set Based Access Control       */
 +/* Author and (c) 1999-2009:           */
@@ -126153,8 +126339,21 @@ index 0000000..e435580
 +	case T_PROCESS:
 +		if(target_type_name)
 +			strcpy(target_type_name, "PROCESS");
-+		if (target_id_name)
-+			sprintf(target_id_name, "%u", pid_nr(tid.process));
++		if (target_id_name) {
++			struct task_struct *task_p;
++
++			read_lock(&tasklist_lock);
++			task_p = pid_task(tid.process, PIDTYPE_PID);
++			if (task_p) {
++				if(task_p->parent)
++					sprintf(target_id_name, "%u(%s,parent=%u(%s))", task_p->pid, task_p->comm, task_p->parent->pid, task_p->parent->comm);
++				else
++					sprintf(target_id_name, "%u(%s)", task_p->pid, task_p->comm);
++			}
++			else
++				sprintf(target_id_name, "%u", pid_nr(tid.process));
++			read_unlock(&tasklist_lock);
++		}
 +		break;
 +	case T_GROUP:
 +		if(target_type_name)
@@ -129332,16 +129531,16 @@ index 0000000..9faf4f2
 +}
 diff --git a/rsbac/help/syscalls.c b/rsbac/help/syscalls.c
 new file mode 100644
-index 0000000..120db4d
+index 0000000..5204b1e
 --- /dev/null
 +++ b/rsbac/help/syscalls.c
-@@ -0,0 +1,8724 @@
+@@ -0,0 +1,8732 @@
 +/*************************************************** */
 +/* Rule Set Based Access Control                     */
 +/* Implementation of RSBAC general system calls      */
 +/* Author and (C) 1999-2011: Amon Ott <ao@×××××.org> */
 +/*                                                   */
-+/* Last modified: 12/Jul/2011                        */
++/* Last modified: 17/Oct/2011                        */
 +/*************************************************** */
 +
 +#include <rsbac/types.h>
@@ -129993,6 +130192,14 @@ index 0000000..120db4d
 +#endif
 +            break;
 +
++          case T_FD:
++          case T_FILE:
++          case T_DIR:
++          case T_FIFO:
++          case T_SYMLINK:
++          case T_UNIXSOCK:
++            return -RSBAC_EINVALIDTARGET;
++
 +          default:
 +            break;
 +        }