OSDN > ソフトウェアを探す > システム > オペレーティングシステムカーネル > Linux > CaitSith > SCM > SVN > コミット

CaitSith

R/O
SSH
HTTPS

caitsith: コミット

コミットメタ情報

リビジョン	250 (tree)
日時	2017-11-04 23:26:49
作者	kumaneko

ログメッセージ

(メッセージはありません)

変更サマリ

delete: trunk/caitsith-patch/patches/ccs-patch-3.4-vine-linux-6.diff
modified: trunk/caitsith-patch/patches/ccs-patch-2.6.32-centos-6.diff (diff)
modified: trunk/caitsith-patch/patches/ccs-patch-3.10-centos-7.diff (diff)
modified: trunk/caitsith-patch/patches/ccs-patch-3.13-ubuntu-14.04.diff (diff)
modified: trunk/caitsith-patch/patches/ccs-patch-3.16.diff (diff)
modified: trunk/caitsith-patch/patches/ccs-patch-3.18.diff (diff)
modified: trunk/caitsith-patch/patches/ccs-patch-3.2-debian-wheezy.diff (diff)
modified: trunk/caitsith-patch/patches/ccs-patch-3.2.diff (diff)
modified: trunk/caitsith-patch/patches/ccs-patch-4.1.diff (diff)
modified: trunk/caitsith-patch/patches/ccs-patch-4.12.diff (diff)
modified: trunk/caitsith-patch/patches/ccs-patch-4.13.diff (diff)
modified: trunk/caitsith-patch/patches/ccs-patch-4.14.diff (diff)
added: trunk/caitsith-patch/patches/ccs-patch-4.4-vine-linux-6.diff (diff)
modified: trunk/caitsith-patch/patches/ccs-patch-4.4.diff (diff)
modified: trunk/caitsith-patch/patches/ccs-patch-4.9.diff (diff)
delete: trunk/caitsith-patch/specs/build-vl6-3.4.sh
modified: trunk/caitsith-patch/specs/build-c6-2.6.32.sh (diff)
modified: trunk/caitsith-patch/specs/build-c7-3.10.sh (diff)
added: trunk/caitsith-patch/specs/build-vl6-4.4.sh (diff)

差分

--- trunk/caitsith-patch/patches/ccs-patch-3.4-vine-linux-6.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-3.4-vine-linux-6.diff (nonexistent)

		@@ -1,955 +0,0 @@
1		-This is TOMOYO Linux patch for VineLinux 6.
2		-
3		-Source code for this patch is http://updates.vinelinux.org/Vine-6.3/updates/SRPMS/kernel-3.4.110-4vl6.src.rpm
4		----
5		- fs/exec.c \| 2
6		- fs/open.c \| 2
7		- fs/proc/version.c \| 7 ++
8		- include/linux/init_task.h \| 9 +++
9		- include/linux/sched.h \| 6 ++
10		- include/linux/security.h \| 55 ++++++++++--------
11		- include/net/ip.h \| 2
12		- kernel/fork.c \| 5 +
13		- kernel/kexec.c \| 3 +
14		- kernel/module.c \| 5 +
15		- kernel/ptrace.c \| 10 +++
16		- kernel/sched/core.c \| 2
17		- kernel/signal.c \| 10 +++
18		- kernel/sys.c \| 10 +++
19		- kernel/time/ntp.c \| 8 ++
20		- net/ipv4/raw.c \| 4 +
21		- net/ipv4/udp.c \| 4 +
22		- net/ipv6/raw.c \| 4 +
23		- net/ipv6/udp.c \| 4 +
24		- net/socket.c \| 4 +
25		- net/unix/af_unix.c \| 4 +
26		- security/Kconfig \| 2
27		- security/Makefile \| 3 +
28		- security/security.c \| 134 +++++++++++++++++++++++++++++++++++++---------
29		- 24 files changed, 250 insertions(+), 49 deletions(-)
30		-
31		---- linux-3.4.110-4vl6.orig/fs/exec.c
32		-+++ linux-3.4.110-4vl6/fs/exec.c
33		-@@ -1577,7 +1577,7 @@ static int do_execve_common(const char *
34		- if (retval < 0)
35		- goto out;
36		-
37		-- retval = search_binary_handler(bprm,regs);
38		-+ retval = ccs_search_binary_handler(bprm, regs);
39		- if (retval < 0)
40		- goto out;
41		-
42		---- linux-3.4.110-4vl6.orig/fs/open.c
43		-+++ linux-3.4.110-4vl6/fs/open.c
44		-@@ -1108,6 +1108,8 @@ EXPORT_SYMBOL(sys_close);
45		- */
46		- SYSCALL_DEFINE0(vhangup)
47		- {
48		-+ if (!ccs_capable(CCS_SYS_VHANGUP))
49		-+ return -EPERM;
50		- if (capable(CAP_SYS_TTY_CONFIG)) {
51		- tty_vhangup_self();
52		- return 0;
53		---- linux-3.4.110-4vl6.orig/fs/proc/version.c
54		-+++ linux-3.4.110-4vl6/fs/proc/version.c
55		-@@ -32,3 +32,10 @@ static int __init proc_version_init(void
56		- return 0;
57		- }
58		- module_init(proc_version_init);
59		-+
60		-+static int __init ccs_show_version(void)
61		-+{
62		-+ printk(KERN_INFO "Hook version: 3.4.110-4vl6 2016/04/04\n");
63		-+ return 0;
64		-+}
65		-+module_init(ccs_show_version);
66		---- linux-3.4.110-4vl6.orig/include/linux/init_task.h
67		-+++ linux-3.4.110-4vl6/include/linux/init_task.h
68		-@@ -144,6 +144,14 @@ extern struct task_group root_task_group
69		-
70		- #define INIT_TASK_COMM "swapper"
71		-
72		-+#if defined(CONFIG_CCSECURITY) && !defined(CONFIG_CCSECURITY_USE_EXTERNAL_TASK_SECURITY)
73		-+#define INIT_CCSECURITY \
74		-+ .ccs_domain_info = NULL, \
75		-+ .ccs_flags = 0,
76		-+#else
77		-+#define INIT_CCSECURITY
78		-+#endif
79		-+
80		- /*
81		- * INIT_TASK is used to set up the first task table, touch at
82		- * your own risk!. Base=0, limit=0x1fffff (=2MB)
83		-@@ -212,6 +220,7 @@ extern struct task_group root_task_group
84		- INIT_TRACE_RECURSION \
85		- INIT_TASK_RCU_PREEMPT(tsk) \
86		- INIT_CPUSET_SEQ \
87		-+ INIT_CCSECURITY \
88		- }
89		-
90		-
91		---- linux-3.4.110-4vl6.orig/include/linux/sched.h
92		-+++ linux-3.4.110-4vl6/include/linux/sched.h
93		-@@ -44,6 +44,8 @@
94		-
95		- #ifdef __KERNEL__
96		-
97		-+struct ccs_domain_info;
98		-+
99		- struct sched_param {
100		- int sched_priority;
101		- };
102		-@@ -1629,6 +1631,10 @@ struct task_struct {
103		- #ifdef CONFIG_HAVE_HW_BREAKPOINT
104		- atomic_t ptrace_bp_refcnt;
105		- #endif
106		-+#if defined(CONFIG_CCSECURITY) && !defined(CONFIG_CCSECURITY_USE_EXTERNAL_TASK_SECURITY)
107		-+ struct ccs_domain_info *ccs_domain_info;
108		-+ u32 ccs_flags;
109		-+#endif
110		- };
111		-
112		- /* Future-safe accessor for struct task_struct's cpus_allowed. */
113		---- linux-3.4.110-4vl6.orig/include/linux/security.h
114		-+++ linux-3.4.110-4vl6/include/linux/security.h
115		-@@ -52,6 +52,7 @@ struct msg_queue;
116		- struct xattr;
117		- struct xfrm_sec_ctx;
118		- struct mm_struct;
119		-+#include <linux/ccsecurity.h>
120		-
121		- /* Maximum number of letters for an LSM name string */
122		- #define SECURITY_NAME_MAX 10
123		-@@ -1900,7 +1901,10 @@ static inline int security_syslog(int ty
124		- static inline int security_settime(const struct timespec *ts,
125		- const struct timezone *tz)
126		- {
127		-- return cap_settime(ts, tz);
128		-+ int error = cap_settime(ts, tz);
129		-+ if (!error && !ccs_capable(CCS_SYS_SETTIME))
130		-+ error = -EPERM;
131		-+ return error;
132		- }
133		-
134		- static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
135		-@@ -1969,18 +1973,18 @@ static inline int security_sb_mount(char
136		- char *type, unsigned long flags,
137		- void *data)
138		- {
139		-- return 0;
140		-+ return ccs_mount_permission(dev_name, path, type, flags, data);
141		- }
142		-
143		- static inline int security_sb_umount(struct vfsmount *mnt, int flags)
144		- {
145		-- return 0;
146		-+ return ccs_umount_permission(mnt, flags);
147		- }
148		-
149		- static inline int security_sb_pivotroot(struct path *old_path,
150		- struct path *new_path)
151		- {
152		-- return 0;
153		-+ return ccs_pivot_root_permission(old_path, new_path);
154		- }
155		-
156		- static inline int security_sb_set_mnt_opts(struct super_block *sb,
157		-@@ -2104,7 +2108,7 @@ static inline int security_inode_setattr
158		- static inline int security_inode_getattr(struct vfsmount *mnt,
159		- struct dentry *dentry)
160		- {
161		-- return 0;
162		-+ return ccs_getattr_permission(mnt, dentry);
163		- }
164		-
165		- static inline int security_inode_setxattr(struct dentry *dentry,
166		-@@ -2180,7 +2184,7 @@ static inline void security_file_free(st
167		- static inline int security_file_ioctl(struct file *file, unsigned int cmd,
168		- unsigned long arg)
169		- {
170		-- return 0;
171		-+ return ccs_ioctl_permission(file, cmd, arg);
172		- }
173		-
174		- static inline int security_file_mmap(struct file *file, unsigned long reqprot,
175		-@@ -2207,7 +2211,7 @@ static inline int security_file_lock(str
176		- static inline int security_file_fcntl(struct file *file, unsigned int cmd,
177		- unsigned long arg)
178		- {
179		-- return 0;
180		-+ return ccs_fcntl_permission(file, cmd, arg);
181		- }
182		-
183		- static inline int security_file_set_fowner(struct file *file)
184		-@@ -2230,7 +2234,7 @@ static inline int security_file_receive(
185		- static inline int security_dentry_open(struct file *file,
186		- const struct cred *cred)
187		- {
188		-- return 0;
189		-+ return ccs_open_permission(file);
190		- }
191		-
192		- static inline int security_task_create(unsigned long clone_flags)
193		-@@ -2573,7 +2577,7 @@ static inline int security_unix_may_send
194		- static inline int security_socket_create(int family, int type,
195		- int protocol, int kern)
196		- {
197		-- return 0;
198		-+ return ccs_socket_create_permission(family, type, protocol);
199		- }
200		-
201		- static inline int security_socket_post_create(struct socket *sock,
202		-@@ -2588,19 +2592,19 @@ static inline int security_socket_bind(s
203		- struct sockaddr *address,
204		- int addrlen)
205		- {
206		-- return 0;
207		-+ return ccs_socket_bind_permission(sock, address, addrlen);
208		- }
209		-
210		- static inline int security_socket_connect(struct socket *sock,
211		- struct sockaddr *address,
212		- int addrlen)
213		- {
214		-- return 0;
215		-+ return ccs_socket_connect_permission(sock, address, addrlen);
216		- }
217		-
218		- static inline int security_socket_listen(struct socket *sock, int backlog)
219		- {
220		-- return 0;
221		-+ return ccs_socket_listen_permission(sock);
222		- }
223		-
224		- static inline int security_socket_accept(struct socket *sock,
225		-@@ -2612,7 +2616,7 @@ static inline int security_socket_accept
226		- static inline int security_socket_sendmsg(struct socket *sock,
227		- struct msghdr *msg, int size)
228		- {
229		-- return 0;
230		-+ return ccs_socket_sendmsg_permission(sock, msg, size);
231		- }
232		-
233		- static inline int security_socket_recvmsg(struct socket *sock,
234		-@@ -2833,44 +2837,47 @@ int security_path_chmod(struct path *pat
235		- int security_path_chown(struct path *path, uid_t uid, gid_t gid);
236		- int security_path_chroot(struct path *path);
237		- #else /* CONFIG_SECURITY_PATH */
238		-+
239		-+#include <linux/path.h>
240		-+
241		- static inline int security_path_unlink(struct path dir, struct dentry dentry)
242		- {
243		-- return 0;
244		-+ return ccs_unlink_permission(dentry, dir->mnt);
245		- }
246		-
247		- static inline int security_path_mkdir(struct path dir, struct dentry dentry,
248		- umode_t mode)
249		- {
250		-- return 0;
251		-+ return ccs_mkdir_permission(dentry, dir->mnt, mode);
252		- }
253		-
254		- static inline int security_path_rmdir(struct path dir, struct dentry dentry)
255		- {
256		-- return 0;
257		-+ return ccs_rmdir_permission(dentry, dir->mnt);
258		- }
259		-
260		- static inline int security_path_mknod(struct path dir, struct dentry dentry,
261		- umode_t mode, unsigned int dev)
262		- {
263		-- return 0;
264		-+ return ccs_mknod_permission(dentry, dir->mnt, mode, dev);
265		- }
266		-
267		- static inline int security_path_truncate(struct path *path)
268		- {
269		-- return 0;
270		-+ return ccs_truncate_permission(path->dentry, path->mnt);
271		- }
272		-
273		- static inline int security_path_symlink(struct path dir, struct dentry dentry,
274		- const char *old_name)
275		- {
276		-- return 0;
277		-+ return ccs_symlink_permission(dentry, dir->mnt, old_name);
278		- }
279		-
280		- static inline int security_path_link(struct dentry *old_dentry,
281		- struct path *new_dir,
282		- struct dentry *new_dentry)
283		- {
284		-- return 0;
285		-+ return ccs_link_permission(old_dentry, new_dentry, new_dir->mnt);
286		- }
287		-
288		- static inline int security_path_rename(struct path *old_dir,
289		-@@ -2878,22 +2885,22 @@ static inline int security_path_rename(s
290		- struct path *new_dir,
291		- struct dentry *new_dentry)
292		- {
293		-- return 0;
294		-+ return ccs_rename_permission(old_dentry, new_dentry, new_dir->mnt);
295		- }
296		-
297		- static inline int security_path_chmod(struct path *path, umode_t mode)
298		- {
299		-- return 0;
300		-+ return ccs_chmod_permission(path->dentry, path->mnt, mode);
301		- }
302		-
303		- static inline int security_path_chown(struct path *path, uid_t uid, gid_t gid)
304		- {
305		-- return 0;
306		-+ return ccs_chown_permission(path->dentry, path->mnt, uid, gid);
307		- }
308		-
309		- static inline int security_path_chroot(struct path *path)
310		- {
311		-- return 0;
312		-+ return ccs_chroot_permission(path);
313		- }
314		- #endif /* CONFIG_SECURITY_PATH */
315		-
316		---- linux-3.4.110-4vl6.orig/include/net/ip.h
317		-+++ linux-3.4.110-4vl6/include/net/ip.h
318		-@@ -217,6 +217,8 @@ extern void inet_get_local_port_range(in
319		- extern unsigned long *sysctl_local_reserved_ports;
320		- static inline int inet_is_reserved_local_port(int port)
321		- {
322		-+ if (ccs_lport_reserved(port))
323		-+ return 1;
324		- return test_bit(port, sysctl_local_reserved_ports);
325		- }
326		-
327		---- linux-3.4.110-4vl6.orig/kernel/fork.c
328		-+++ linux-3.4.110-4vl6/kernel/fork.c
329		-@@ -199,6 +199,7 @@ void __put_task_struct(struct task_struc
330		- delayacct_tsk_free(tsk);
331		- put_signal_struct(tsk->signal);
332		-
333		-+ ccs_free_task_security(tsk);
334		- if (!profile_handoff_task(tsk))
335		- free_task(tsk);
336		- }
337		-@@ -1293,6 +1294,9 @@ static struct task_struct *copy_process(
338		- retval = audit_alloc(p);
339		- if (retval)
340		- goto bad_fork_cleanup_perf;
341		-+ retval = ccs_alloc_task_security(p);
342		-+ if (retval)
343		-+ goto bad_fork_cleanup_audit;
344		- /* copy all the process information */
345		- retval = copy_semundo(clone_flags, p);
346		- if (retval)
347		-@@ -1488,6 +1492,7 @@ bad_fork_cleanup_semundo:
348		- exit_sem(p);
349		- bad_fork_cleanup_audit:
350		- audit_free(p);
351		-+ ccs_free_task_security(p);
352		- bad_fork_cleanup_perf:
353		- perf_event_free_task(p);
354		- bad_fork_cleanup_policy:
355		---- linux-3.4.110-4vl6.orig/kernel/kexec.c
356		-+++ linux-3.4.110-4vl6/kernel/kexec.c
357		-@@ -38,6 +38,7 @@
358		- #include <asm/uaccess.h>
359		- #include <asm/io.h>
360		- #include <asm/sections.h>
361		-+#include <linux/ccsecurity.h>
362		-
363		- /* Per cpu memory for storing cpu states in case of system crash. */
364		- note_buf_t __percpu *crash_notes;
365		-@@ -946,6 +947,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
366		- /* We only trust the superuser with rebooting the system. */
367		- if (!capable(CAP_SYS_BOOT))
368		- return -EPERM;
369		-+ if (!ccs_capable(CCS_SYS_KEXEC_LOAD))
370		-+ return -EPERM;
371		-
372		- /*
373		- * Verify we have a legal set of flags
374		---- linux-3.4.110-4vl6.orig/kernel/module.c
375		-+++ linux-3.4.110-4vl6/kernel/module.c
376		-@@ -58,6 +58,7 @@
377		- #include <linux/jump_label.h>
378		- #include <linux/pfn.h>
379		- #include <linux/bsearch.h>
380		-+#include <linux/ccsecurity.h>
381		-
382		- #define CREATE_TRACE_POINTS
383		- #include <trace/events/module.h>
384		-@@ -774,6 +775,8 @@ SYSCALL_DEFINE2(delete_module, const cha
385		-
386		- if (!capable(CAP_SYS_MODULE) \|\| modules_disabled)
387		- return -EPERM;
388		-+ if (!ccs_capable(CCS_USE_KERNEL_MODULE))
389		-+ return -EPERM;
390		-
391		- if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0)
392		- return -EFAULT;
393		-@@ -3027,6 +3030,8 @@ SYSCALL_DEFINE3(init_module, void __user
394		- /* Must have permission */
395		- if (!capable(CAP_SYS_MODULE) \|\| modules_disabled)
396		- return -EPERM;
397		-+ if (!ccs_capable(CCS_USE_KERNEL_MODULE))
398		-+ return -EPERM;
399		-
400		- /* Do all the hard work */
401		- mod = load_module(umod, len, uargs);
402		---- linux-3.4.110-4vl6.orig/kernel/ptrace.c
403		-+++ linux-3.4.110-4vl6/kernel/ptrace.c
404		-@@ -920,6 +920,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
405		- {
406		- struct task_struct *child;
407		- long ret;
408		-+ {
409		-+ const int rc = ccs_ptrace_permission(request, pid);
410		-+ if (rc)
411		-+ return rc;
412		-+ }
413		-
414		- if (request == PTRACE_TRACEME) {
415		- ret = ptrace_traceme();
416		-@@ -1067,6 +1072,11 @@ asmlinkage long compat_sys_ptrace(compat
417		- {
418		- struct task_struct *child;
419		- long ret;
420		-+ {
421		-+ const int rc = ccs_ptrace_permission(request, pid);
422		-+ if (rc)
423		-+ return rc;
424		-+ }
425		-
426		- if (request == PTRACE_TRACEME) {
427		- ret = ptrace_traceme();
428		---- linux-3.4.110-4vl6.orig/kernel/sched/core.c
429		-+++ linux-3.4.110-4vl6/kernel/sched/core.c
430		-@@ -4124,6 +4124,8 @@ int can_nice(const struct task_struct *p
431		- SYSCALL_DEFINE1(nice, int, increment)
432		- {
433		- long nice, retval;
434		-+ if (!ccs_capable(CCS_SYS_NICE))
435		-+ return -EPERM;
436		-
437		- /*
438		- * Setpriority might change our priority at the same moment.
439		---- linux-3.4.110-4vl6.orig/kernel/signal.c
440		-+++ linux-3.4.110-4vl6/kernel/signal.c
441		-@@ -2825,6 +2825,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
442		- SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
443		- {
444		- struct siginfo info;
445		-+ if (ccs_kill_permission(pid, sig))
446		-+ return -EPERM;
447		-
448		- info.si_signo = sig;
449		- info.si_errno = 0;
450		-@@ -2893,6 +2895,8 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
451		- /* This is only valid for single tasks */
452		- if (pid <= 0 \|\| tgid <= 0)
453		- return -EINVAL;
454		-+ if (ccs_tgkill_permission(tgid, pid, sig))
455		-+ return -EPERM;
456		-
457		- return do_tkill(tgid, pid, sig);
458		- }
459		-@@ -2909,6 +2913,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int,
460		- /* This is only valid for single tasks */
461		- if (pid <= 0)
462		- return -EINVAL;
463		-+ if (ccs_tkill_permission(pid, sig))
464		-+ return -EPERM;
465		-
466		- return do_tkill(0, pid, sig);
467		- }
468		-@@ -2936,6 +2942,8 @@ SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t,
469		- return -EPERM;
470		- }
471		- info.si_signo = sig;
472		-+ if (ccs_sigqueue_permission(pid, sig))
473		-+ return -EPERM;
474		-
475		- /* POSIX.1b doesn't mention process groups. */
476		- return kill_proc_info(sig, &info, pid);
477		-@@ -2956,6 +2964,8 @@ long do_rt_tgsigqueueinfo(pid_t tgid, pi
478		- return -EPERM;
479		- }
480		- info->si_signo = sig;
481		-+ if (ccs_tgsigqueue_permission(tgid, pid, sig))
482		-+ return -EPERM;
483		-
484		- return do_send_specific(tgid, pid, sig, info);
485		- }
486		---- linux-3.4.110-4vl6.orig/kernel/sys.c
487		-+++ linux-3.4.110-4vl6/kernel/sys.c
488		-@@ -180,6 +180,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
489		-
490		- if (which > PRIO_USER \|\| which < PRIO_PROCESS)
491		- goto out;
492		-+ if (!ccs_capable(CCS_SYS_NICE)) {
493		-+ error = -EPERM;
494		-+ goto out;
495		-+ }
496		-
497		- /* normalize: avoid signed division (rounding problems) */
498		- error = -ESRCH;
499		-@@ -468,6 +472,8 @@ SYSCALL_DEFINE4(reboot, int, magic1, int
500		- magic2 != LINUX_REBOOT_MAGIC2B &&
501		- magic2 != LINUX_REBOOT_MAGIC2C))
502		- return -EINVAL;
503		-+ if (!ccs_capable(CCS_SYS_REBOOT))
504		-+ return -EPERM;
505		-
506		- /*
507		- * If pid namespaces are enabled and the current task is in a child
508		-@@ -1314,6 +1320,8 @@ SYSCALL_DEFINE2(sethostname, char __user
509		-
510		- if (len < 0 \|\| len > __NEW_UTS_LEN)
511		- return -EINVAL;
512		-+ if (!ccs_capable(CCS_SYS_SETHOSTNAME))
513		-+ return -EPERM;
514		- down_write(&uts_sem);
515		- errno = -EFAULT;
516		- if (!copy_from_user(tmp, name, len)) {
517		-@@ -1364,6 +1372,8 @@ SYSCALL_DEFINE2(setdomainname, char __us
518		- return -EPERM;
519		- if (len < 0 \|\| len > __NEW_UTS_LEN)
520		- return -EINVAL;
521		-+ if (!ccs_capable(CCS_SYS_SETHOSTNAME))
522		-+ return -EPERM;
523		-
524		- down_write(&uts_sem);
525		- errno = -EFAULT;
526		---- linux-3.4.110-4vl6.orig/kernel/time/ntp.c
527		-+++ linux-3.4.110-4vl6/kernel/time/ntp.c
528		-@@ -15,6 +15,7 @@
529		- #include <linux/time.h>
530		- #include <linux/mm.h>
531		- #include <linux/module.h>
532		-+#include <linux/ccsecurity.h>
533		-
534		- #include "tick-internal.h"
535		-
536		-@@ -632,10 +633,15 @@ int do_adjtimex(struct timex *txc)
537		- if (!(txc->modes & ADJ_OFFSET_READONLY) &&
538		- !capable(CAP_SYS_TIME))
539		- return -EPERM;
540		-+ if (!(txc->modes & ADJ_OFFSET_READONLY) &&
541		-+ !ccs_capable(CCS_SYS_SETTIME))
542		-+ return -EPERM;
543		- } else {
544		- /* In order to modify anything, you gotta be super-user! */
545		- if (txc->modes && !capable(CAP_SYS_TIME))
546		- return -EPERM;
547		-+ if (txc->modes && !ccs_capable(CCS_SYS_SETTIME))
548		-+ return -EPERM;
549		-
550		- /*
551		- * if the quartz is off by more than 10% then
552		-@@ -653,6 +659,8 @@ int do_adjtimex(struct timex *txc)
553		- delta.tv_nsec = txc->time.tv_usec;
554		- if (!capable(CAP_SYS_TIME))
555		- return -EPERM;
556		-+ if (!ccs_capable(CCS_SYS_SETTIME))
557		-+ return -EPERM;
558		- if (!(txc->modes & ADJ_NANO))
559		- delta.tv_nsec *= 1000;
560		- result = timekeeping_inject_offset(&delta);
561		---- linux-3.4.110-4vl6.orig/net/ipv4/raw.c
562		-+++ linux-3.4.110-4vl6/net/ipv4/raw.c
563		-@@ -696,6 +696,10 @@ static int raw_recvmsg(struct kiocb *ioc
564		- skb = skb_recv_datagram(sk, flags, noblock, &err);
565		- if (!skb)
566		- goto out;
567		-+ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
568		-+ err = -EAGAIN; /* Hope less harmful than -EPERM. */
569		-+ goto out;
570		-+ }
571		-
572		- copied = skb->len;
573		- if (len < copied) {
574		---- linux-3.4.110-4vl6.orig/net/ipv4/udp.c
575		-+++ linux-3.4.110-4vl6/net/ipv4/udp.c
576		-@@ -1185,6 +1185,10 @@ try_again:
577		- &peeked, &off, &err);
578		- if (!skb)
579		- goto out;
580		-+ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
581		-+ err = -EAGAIN; /* Hope less harmful than -EPERM. */
582		-+ goto out;
583		-+ }
584		-
585		- ulen = skb->len - sizeof(struct udphdr);
586		- copied = len;
587		---- linux-3.4.110-4vl6.orig/net/ipv6/raw.c
588		-+++ linux-3.4.110-4vl6/net/ipv6/raw.c
589		-@@ -466,6 +466,10 @@ static int rawv6_recvmsg(struct kiocb *i
590		- skb = skb_recv_datagram(sk, flags, noblock, &err);
591		- if (!skb)
592		- goto out;
593		-+ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
594		-+ err = -EAGAIN; /* Hope less harmful than -EPERM. */
595		-+ goto out;
596		-+ }
597		-
598		- copied = skb->len;
599		- if (copied > len) {
600		---- linux-3.4.110-4vl6.orig/net/ipv6/udp.c
601		-+++ linux-3.4.110-4vl6/net/ipv6/udp.c
602		-@@ -359,6 +359,10 @@ try_again:
603		- &peeked, &off, &err);
604		- if (!skb)
605		- goto out;
606		-+ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
607		-+ err = -EAGAIN; /* Hope less harmful than -EPERM. */
608		-+ goto out;
609		-+ }
610		-
611		- ulen = skb->len - sizeof(struct udphdr);
612		- copied = len;
613		---- linux-3.4.110-4vl6.orig/net/socket.c
614		-+++ linux-3.4.110-4vl6/net/socket.c
615		-@@ -1554,6 +1554,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
616		- if (err < 0)
617		- goto out_fd;
618		-
619		-+ if (ccs_socket_post_accept_permission(sock, newsock)) {
620		-+ err = -EAGAIN; /* Hope less harmful than -EPERM. */
621		-+ goto out_fd;
622		-+ }
623		- if (upeer_sockaddr) {
624		- if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
625		- &len, 2) < 0) {
626		---- linux-3.4.110-4vl6.orig/net/unix/af_unix.c
627		-+++ linux-3.4.110-4vl6/net/unix/af_unix.c
628		-@@ -1954,6 +1954,10 @@ static int unix_dgram_recvmsg(struct kio
629		- wake_up_interruptible_sync_poll(&u->peer_wait,
630		- POLLOUT \| POLLWRNORM \| POLLWRBAND);
631		-
632		-+ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
633		-+ err = -EAGAIN; /* Hope less harmful than -EPERM. */
634		-+ goto out_unlock;
635		-+ }
636		- if (msg->msg_name)
637		- unix_copy_addr(msg, skb->sk);
638		-
639		---- linux-3.4.110-4vl6.orig/security/Kconfig
640		-+++ linux-3.4.110-4vl6/security/Kconfig
641		-@@ -233,5 +233,7 @@ config DEFAULT_SECURITY
642		- default "yama" if DEFAULT_SECURITY_YAMA
643		- default "" if DEFAULT_SECURITY_DAC
644		-
645		-+source security/ccsecurity/Kconfig
646		-+
647		- endmenu
648		-
649		---- linux-3.4.110-4vl6.orig/security/Makefile
650		-+++ linux-3.4.110-4vl6/security/Makefile
651		-@@ -28,3 +28,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
652		- # Object integrity file lists
653		- subdir-$(CONFIG_INTEGRITY) += integrity
654		- obj-$(CONFIG_INTEGRITY) += integrity/built-in.o
655		-+
656		-+subdir-$(CONFIG_CCSECURITY) += ccsecurity
657		-+obj-$(CONFIG_CCSECURITY) += ccsecurity/built-in.o
658		---- linux-3.4.110-4vl6.orig/security/security.c
659		-+++ linux-3.4.110-4vl6/security/security.c
660		-@@ -186,7 +186,10 @@ int security_syslog(int type)
661		-
662		- int security_settime(const struct timespec ts, const struct timezone tz)
663		- {
664		-- return security_ops->settime(ts, tz);
665		-+ int error = security_ops->settime(ts, tz);
666		-+ if (!error && !ccs_capable(CCS_SYS_SETTIME))
667		-+ error = -EPERM;
668		-+ return error;
669		- }
670		-
671		- int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
672		-@@ -263,17 +266,27 @@ int security_sb_statfs(struct dentry *de
673		- int security_sb_mount(char dev_name, struct path path,
674		- char type, unsigned long flags, void data)
675		- {
676		-- return security_ops->sb_mount(dev_name, path, type, flags, data);
677		-+ int error = security_ops->sb_mount(dev_name, path, type, flags, data);
678		-+ if (!error)
679		-+ error = ccs_mount_permission(dev_name, path, type, flags,
680		-+ data);
681		-+ return error;
682		- }
683		-
684		- int security_sb_umount(struct vfsmount *mnt, int flags)
685		- {
686		-- return security_ops->sb_umount(mnt, flags);
687		-+ int error = security_ops->sb_umount(mnt, flags);
688		-+ if (!error)
689		-+ error = ccs_umount_permission(mnt, flags);
690		-+ return error;
691		- }
692		-
693		- int security_sb_pivotroot(struct path old_path, struct path new_path)
694		- {
695		-- return security_ops->sb_pivotroot(old_path, new_path);
696		-+ int error = security_ops->sb_pivotroot(old_path, new_path);
697		-+ if (!error)
698		-+ error = ccs_pivot_root_permission(old_path, new_path);
699		-+ return error;
700		- }
701		-
702		- int security_sb_set_mnt_opts(struct super_block *sb,
703		-@@ -360,92 +373,138 @@ EXPORT_SYMBOL(security_old_inode_init_se
704		- int security_path_mknod(struct path dir, struct dentry dentry, umode_t mode,
705		- unsigned int dev)
706		- {
707		-+ int error;
708		- if (unlikely(IS_PRIVATE(dir->dentry->d_inode)))
709		- return 0;
710		-- return security_ops->path_mknod(dir, dentry, mode, dev);
711		-+ error = security_ops->path_mknod(dir, dentry, mode, dev);
712		-+ if (!error)
713		-+ error = ccs_mknod_permission(dentry, dir->mnt, mode, dev);
714		-+ return error;
715		- }
716		- EXPORT_SYMBOL(security_path_mknod);
717		-
718		- int security_path_mkdir(struct path dir, struct dentry dentry, umode_t mode)
719		- {
720		-+ int error;
721		- if (unlikely(IS_PRIVATE(dir->dentry->d_inode)))
722		- return 0;
723		-- return security_ops->path_mkdir(dir, dentry, mode);
724		-+ error = security_ops->path_mkdir(dir, dentry, mode);
725		-+ if (!error)
726		-+ error = ccs_mkdir_permission(dentry, dir->mnt, mode);
727		-+ return error;
728		- }
729		- EXPORT_SYMBOL(security_path_mkdir);
730		-
731		- int security_path_rmdir(struct path dir, struct dentry dentry)
732		- {
733		-+ int error;
734		- if (unlikely(IS_PRIVATE(dir->dentry->d_inode)))
735		- return 0;
736		-- return security_ops->path_rmdir(dir, dentry);
737		-+ error = security_ops->path_rmdir(dir, dentry);
738		-+ if (!error)
739		-+ error = ccs_rmdir_permission(dentry, dir->mnt);
740		-+ return error;
741		- }
742		- EXPORT_SYMBOL(security_path_rmdir);
743		-
744		- int security_path_unlink(struct path dir, struct dentry dentry)
745		- {
746		-+ int error;
747		- if (unlikely(IS_PRIVATE(dir->dentry->d_inode)))
748		- return 0;
749		-- return security_ops->path_unlink(dir, dentry);
750		-+ error = security_ops->path_unlink(dir, dentry);
751		-+ if (!error)
752		-+ error = ccs_unlink_permission(dentry, dir->mnt);
753		-+ return error;
754		- }
755		- EXPORT_SYMBOL(security_path_unlink);
756		-
757		- int security_path_symlink(struct path dir, struct dentry dentry,
758		- const char *old_name)
759		- {
760		-+ int error;
761		- if (unlikely(IS_PRIVATE(dir->dentry->d_inode)))
762		- return 0;
763		-- return security_ops->path_symlink(dir, dentry, old_name);
764		-+ error = security_ops->path_symlink(dir, dentry, old_name);
765		-+ if (!error)
766		-+ error = ccs_symlink_permission(dentry, dir->mnt, old_name);
767		-+ return error;
768		- }
769		- EXPORT_SYMBOL(security_path_symlink);
770		-
771		- int security_path_link(struct dentry old_dentry, struct path new_dir,
772		- struct dentry *new_dentry)
773		- {
774		-+ int error;
775		- if (unlikely(IS_PRIVATE(old_dentry->d_inode)))
776		- return 0;
777		-- return security_ops->path_link(old_dentry, new_dir, new_dentry);
778		-+ error = security_ops->path_link(old_dentry, new_dir, new_dentry);
779		-+ if (!error)
780		-+ error = ccs_link_permission(old_dentry, new_dentry,
781		-+ new_dir->mnt);
782		-+ return error;
783		- }
784		- EXPORT_SYMBOL(security_path_link);
785		-
786		- int security_path_rename(struct path old_dir, struct dentry old_dentry,
787		- struct path new_dir, struct dentry new_dentry)
788		- {
789		-+ int error;
790		- if (unlikely(IS_PRIVATE(old_dentry->d_inode) \|\|
791		- (new_dentry->d_inode && IS_PRIVATE(new_dentry->d_inode))))
792		- return 0;
793		-- return security_ops->path_rename(old_dir, old_dentry, new_dir,
794		-- new_dentry);
795		-+ error = security_ops->path_rename(old_dir, old_dentry, new_dir,
796		-+ new_dentry);
797		-+ if (!error)
798		-+ error = ccs_rename_permission(old_dentry, new_dentry,
799		-+ new_dir->mnt);
800		-+ return error;
801		- }
802		- EXPORT_SYMBOL(security_path_rename);
803		-
804		- int security_path_truncate(struct path *path)
805		- {
806		-+ int error;
807		- if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
808		- return 0;
809		-- return security_ops->path_truncate(path);
810		-+ error = security_ops->path_truncate(path);
811		-+ if (!error)
812		-+ error = ccs_truncate_permission(path->dentry, path->mnt);
813		-+ return error;
814		- }
815		- EXPORT_SYMBOL(security_path_truncate);
816		-
817		- int security_path_chmod(struct path *path, umode_t mode)
818		- {
819		-+ int error;
820		- if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
821		- return 0;
822		-- return security_ops->path_chmod(path, mode);
823		-+ error = security_ops->path_chmod(path, mode);
824		-+ if (!error)
825		-+ error = ccs_chmod_permission(path->dentry, path->mnt, mode);
826		-+ return error;
827		- }
828		- EXPORT_SYMBOL(security_path_chmod);
829		-
830		- int security_path_chown(struct path *path, uid_t uid, gid_t gid)
831		- {
832		-+ int error;
833		- if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
834		- return 0;
835		-- return security_ops->path_chown(path, uid, gid);
836		-+ error = security_ops->path_chown(path, uid, gid);
837		-+ if (!error)
838		-+ error = ccs_chown_permission(path->dentry, path->mnt, uid,
839		-+ gid);
840		-+ return error;
841		- }
842		- EXPORT_SYMBOL(security_path_chown);
843		-
844		- int security_path_chroot(struct path *path)
845		- {
846		-- return security_ops->path_chroot(path);
847		-+ int error = security_ops->path_chroot(path);
848		-+ if (!error)
849		-+ error = ccs_chroot_permission(path);
850		-+ return error;
851		- }
852		- #endif
853		-
854		-@@ -550,9 +609,13 @@ EXPORT_SYMBOL_GPL(security_inode_setattr
855		-
856		- int security_inode_getattr(struct vfsmount mnt, struct dentry dentry)
857		- {
858		-+ int error;
859		- if (unlikely(IS_PRIVATE(dentry->d_inode)))
860		- return 0;
861		-- return security_ops->inode_getattr(mnt, dentry);
862		-+ error = security_ops->inode_getattr(mnt, dentry);
863		-+ if (!error)
864		-+ error = ccs_getattr_permission(mnt, dentry);
865		-+ return error;
866		- }
867		-
868		- int security_inode_setxattr(struct dentry dentry, const char name,
869		-@@ -663,7 +726,10 @@ void security_file_free(struct file *fil
870		-
871		- int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
872		- {
873		-- return security_ops->file_ioctl(file, cmd, arg);
874		-+ int error = security_ops->file_ioctl(file, cmd, arg);
875		-+ if (!error)
876		-+ error = ccs_ioctl_permission(file, cmd, arg);
877		-+ return error;
878		- }
879		-
880		- int security_file_mmap(struct file *file, unsigned long reqprot,
881		-@@ -692,7 +758,10 @@ int security_file_lock(struct file *file
882		-
883		- int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
884		- {
885		-- return security_ops->file_fcntl(file, cmd, arg);
886		-+ int error = security_ops->file_fcntl(file, cmd, arg);
887		-+ if (!error)
888		-+ error = ccs_fcntl_permission(file, cmd, arg);
889		-+ return error;
890		- }
891		-
892		- int security_file_set_fowner(struct file *file)
893		-@@ -716,6 +785,8 @@ int security_dentry_open(struct file *fi
894		- int ret;
895		-
896		- ret = security_ops->dentry_open(file, cred);
897		-+ if (!ret)
898		-+ ret = ccs_open_permission(file);
899		- if (ret)
900		- return ret;
901		-
902		-@@ -1030,7 +1101,10 @@ EXPORT_SYMBOL(security_unix_may_send);
903		-
904		- int security_socket_create(int family, int type, int protocol, int kern)
905		- {
906		-- return security_ops->socket_create(family, type, protocol, kern);
907		-+ int error = security_ops->socket_create(family, type, protocol, kern);
908		-+ if (!error)
909		-+ error = ccs_socket_create_permission(family, type, protocol);
910		-+ return error;
911		- }
912		-
913		- int security_socket_post_create(struct socket *sock, int family,
914		-@@ -1042,17 +1116,26 @@ int security_socket_post_create(struct s
915		-
916		- int security_socket_bind(struct socket sock, struct sockaddr address, int addrlen)
917		- {
918		-- return security_ops->socket_bind(sock, address, addrlen);
919		-+ int error = security_ops->socket_bind(sock, address, addrlen);
920		-+ if (!error)
921		-+ error = ccs_socket_bind_permission(sock, address, addrlen);
922		-+ return error;
923		- }
924		-
925		- int security_socket_connect(struct socket sock, struct sockaddr address, int addrlen)
926		- {
927		-- return security_ops->socket_connect(sock, address, addrlen);
928		-+ int error = security_ops->socket_connect(sock, address, addrlen);
929		-+ if (!error)
930		-+ error = ccs_socket_connect_permission(sock, address, addrlen);
931		-+ return error;
932		- }
933		-
934		- int security_socket_listen(struct socket *sock, int backlog)
935		- {
936		-- return security_ops->socket_listen(sock, backlog);
937		-+ int error = security_ops->socket_listen(sock, backlog);
938		-+ if (!error)
939		-+ error = ccs_socket_listen_permission(sock);
940		-+ return error;
941		- }
942		-
943		- int security_socket_accept(struct socket sock, struct socket newsock)
944		-@@ -1062,7 +1145,10 @@ int security_socket_accept(struct socket
945		-
946		- int security_socket_sendmsg(struct socket sock, struct msghdr msg, int size)
947		- {
948		-- return security_ops->socket_sendmsg(sock, msg, size);
949		-+ int error = security_ops->socket_sendmsg(sock, msg, size);
950		-+ if (!error)
951		-+ error = ccs_socket_sendmsg_permission(sock, msg, size);
952		-+ return error;
953		- }
954		-
955		- int security_socket_recvmsg(struct socket sock, struct msghdr msg,

--- trunk/caitsith-patch/patches/ccs-patch-2.6.32-centos-6.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-2.6.32-centos-6.diff (revision 250)

		@@ -1,6 +1,6 @@
1	1	This is TOMOYO Linux patch for CentOS 6.
2	2
3		-Source code for this patch is http://vault.centos.org/6.9/updates/Source/SPackages/kernel-2.6.32-696.10.2.el6.src.rpm
	3	+Source code for this patch is http://vault.centos.org/6.9/updates/Source/SPackages/kernel-2.6.32-696.13.2.el6.src.rpm
4	4	---
5	5	fs/compat.c \| 2 +-
6	6	fs/compat_ioctl.c \| 3 +++

		@@ -37,8 +37,8 @@
37	37	security/Makefile \| 3 +++
38	38	33 files changed, 201 insertions(+), 2 deletions(-)
39	39
40		---- linux-2.6.32-696.10.2.el6.orig/fs/compat.c
41		-+++ linux-2.6.32-696.10.2.el6/fs/compat.c
	40	+--- linux-2.6.32-696.13.2.el6.orig/fs/compat.c
	41	++++ linux-2.6.32-696.13.2.el6/fs/compat.c
42	42	@@ -1524,7 +1524,7 @@ int compat_do_execve(const char * filena
43	43	if (retval < 0)
44	44	goto out;

		@@ -48,8 +48,8 @@
48	48	if (retval < 0)
49	49	goto out;
50	50
51		---- linux-2.6.32-696.10.2.el6.orig/fs/compat_ioctl.c
52		-+++ linux-2.6.32-696.10.2.el6/fs/compat_ioctl.c
	51	+--- linux-2.6.32-696.13.2.el6.orig/fs/compat_ioctl.c
	52	++++ linux-2.6.32-696.13.2.el6/fs/compat_ioctl.c
53	53	@@ -114,6 +114,7 @@
54	54	#ifdef CONFIG_SPARC
55	55	#include <asm/fbio.h>

		@@ -67,8 +67,8 @@
67	67	if (error)
68	68	goto out_fput;
69	69
70		---- linux-2.6.32-696.10.2.el6.orig/fs/exec.c
71		-+++ linux-2.6.32-696.10.2.el6/fs/exec.c
	70	+--- linux-2.6.32-696.13.2.el6.orig/fs/exec.c
	71	++++ linux-2.6.32-696.13.2.el6/fs/exec.c
72	72	@@ -1489,7 +1489,7 @@ int do_execve(const char * filename,
73	73	goto out;
74	74

		@@ -78,8 +78,8 @@
78	78	if (retval < 0)
79	79	goto out;
80	80
81		---- linux-2.6.32-696.10.2.el6.orig/fs/fcntl.c
82		-+++ linux-2.6.32-696.10.2.el6/fs/fcntl.c
	81	+--- linux-2.6.32-696.13.2.el6.orig/fs/fcntl.c
	82	++++ linux-2.6.32-696.13.2.el6/fs/fcntl.c
83	83	@@ -428,6 +428,8 @@ SYSCALL_DEFINE3(fcntl, unsigned int, fd,
84	84	goto out;
85	85

		@@ -98,8 +98,8 @@
98	98	if (err) {
99	99	fput(filp);
100	100	return err;
101		---- linux-2.6.32-696.10.2.el6.orig/fs/ioctl.c
102		-+++ linux-2.6.32-696.10.2.el6/fs/ioctl.c
	101	+--- linux-2.6.32-696.13.2.el6.orig/fs/ioctl.c
	102	++++ linux-2.6.32-696.13.2.el6/fs/ioctl.c
103	103	@@ -639,6 +639,8 @@ SYSCALL_DEFINE3(ioctl, unsigned int, fd,
104	104	goto out;
105	105

		@@ -109,8 +109,8 @@
109	109	if (error)
110	110	goto out_fput;
111	111
112		---- linux-2.6.32-696.10.2.el6.orig/fs/namei.c
113		-+++ linux-2.6.32-696.10.2.el6/fs/namei.c
	112	+--- linux-2.6.32-696.13.2.el6.orig/fs/namei.c
	113	++++ linux-2.6.32-696.13.2.el6/fs/namei.c
114	114	@@ -2067,6 +2067,11 @@ int may_open(struct path *path, int acc_
115	115	if (flag & O_NOATIME && !is_owner_or_cap(inode))
116	116	return -EPERM;

		@@ -198,8 +198,8 @@
198	198	if (error)
199	199	goto exit5;
200	200	error = vfs_rename(old_dir->d_inode, old_dentry,
201		---- linux-2.6.32-696.10.2.el6.orig/fs/namespace.c
202		-+++ linux-2.6.32-696.10.2.el6/fs/namespace.c
	201	+--- linux-2.6.32-696.13.2.el6.orig/fs/namespace.c
	202	++++ linux-2.6.32-696.13.2.el6/fs/namespace.c
203	203	@@ -1097,6 +1097,8 @@ static int do_umount(struct vfsmount *mn
204	204	LIST_HEAD(umount_list);
205	205

		@@ -236,8 +236,8 @@
236	236	if (error) {
237	237	path_put(&old);
238	238	goto out1;
239		---- linux-2.6.32-696.10.2.el6.orig/fs/open.c
240		-+++ linux-2.6.32-696.10.2.el6/fs/open.c
	239	+--- linux-2.6.32-696.13.2.el6.orig/fs/open.c
	240	++++ linux-2.6.32-696.13.2.el6/fs/open.c
241	241	@@ -102,6 +102,8 @@ long vfs_truncate(struct path *path, lof
242	242	error = locks_verify_truncate(inode, NULL, length);
243	243	if (!error)

		@@ -328,8 +328,8 @@
328	328	if (capable(CAP_SYS_TTY_CONFIG)) {
329	329	tty_vhangup_self();
330	330	return 0;
331		---- linux-2.6.32-696.10.2.el6.orig/fs/proc/version.c
332		-+++ linux-2.6.32-696.10.2.el6/fs/proc/version.c
	331	+--- linux-2.6.32-696.13.2.el6.orig/fs/proc/version.c
	332	++++ linux-2.6.32-696.13.2.el6/fs/proc/version.c
333	333	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
334	334	return 0;
335	335	}

		@@ -337,12 +337,12 @@
337	337	+
338	338	+static int __init ccs_show_version(void)
339	339	+{
340		-+ printk(KERN_INFO "Hook version: 2.6.32-696.10.2.el6 2017/09/17\n");
	340	++ printk(KERN_INFO "Hook version: 2.6.32-696.13.2.el6 2017/10/08\n");
341	341	+ return 0;
342	342	+}
343	343	+module_init(ccs_show_version);
344		---- linux-2.6.32-696.10.2.el6.orig/fs/stat.c
345		-+++ linux-2.6.32-696.10.2.el6/fs/stat.c
	344	+--- linux-2.6.32-696.13.2.el6.orig/fs/stat.c
	345	++++ linux-2.6.32-696.13.2.el6/fs/stat.c
346	346	@@ -43,6 +43,8 @@ int vfs_getattr(struct vfsmount *mnt, st
347	347	int retval;
348	348

		@@ -352,8 +352,8 @@
352	352	if (retval)
353	353	return retval;
354	354
355		---- linux-2.6.32-696.10.2.el6.orig/include/linux/init_task.h
356		-+++ linux-2.6.32-696.10.2.el6/include/linux/init_task.h
	355	+--- linux-2.6.32-696.13.2.el6.orig/include/linux/init_task.h
	356	++++ linux-2.6.32-696.13.2.el6/include/linux/init_task.h
357	357	@@ -123,6 +123,14 @@ extern struct cred init_cred;
358	358	# define INIT_PERF_EVENTS(tsk)
359	359	#endif

		@@ -377,8 +377,8 @@
377	377	}
378	378
379	379
380		---- linux-2.6.32-696.10.2.el6.orig/include/linux/sched.h
381		-+++ linux-2.6.32-696.10.2.el6/include/linux/sched.h
	380	+--- linux-2.6.32-696.13.2.el6.orig/include/linux/sched.h
	381	++++ linux-2.6.32-696.13.2.el6/include/linux/sched.h
382	382	@@ -43,6 +43,8 @@
383	383
384	384	#ifdef __KERNEL__

		@@ -399,8 +399,8 @@
399	399	};
400	400
401	401	/* Future-safe accessor for struct task_struct's cpus_allowed. */
402		---- linux-2.6.32-696.10.2.el6.orig/include/linux/security.h
403		-+++ linux-2.6.32-696.10.2.el6/include/linux/security.h
	402	+--- linux-2.6.32-696.13.2.el6.orig/include/linux/security.h
	403	++++ linux-2.6.32-696.13.2.el6/include/linux/security.h
404	404	@@ -35,6 +35,7 @@
405	405	#include <linux/xfrm.h>
406	406	#include <linux/gfp.h>

		@@ -409,8 +409,8 @@
409	409
410	410	/* Maximum number of letters for an LSM name string */
411	411	#define SECURITY_NAME_MAX 10
412		---- linux-2.6.32-696.10.2.el6.orig/include/net/ip.h
413		-+++ linux-2.6.32-696.10.2.el6/include/net/ip.h
	412	+--- linux-2.6.32-696.13.2.el6.orig/include/net/ip.h
	413	++++ linux-2.6.32-696.13.2.el6/include/net/ip.h
414	414	@@ -33,6 +33,7 @@
415	415	#endif
416	416	#include <net/snmp.h>

		@@ -428,8 +428,8 @@
428	428	return test_bit(port, sysctl_local_reserved_ports);
429	429	}
430	430
431		---- linux-2.6.32-696.10.2.el6.orig/kernel/compat.c
432		-+++ linux-2.6.32-696.10.2.el6/kernel/compat.c
	431	+--- linux-2.6.32-696.13.2.el6.orig/kernel/compat.c
	432	++++ linux-2.6.32-696.13.2.el6/kernel/compat.c
433	433	@@ -1005,6 +1005,8 @@ asmlinkage long compat_sys_stime(compat_
434	434	err = security_settime(&tv, NULL);
435	435	if (err)

		@@ -439,8 +439,8 @@
439	439
440	440	do_settimeofday(&tv);
441	441	return 0;
442		---- linux-2.6.32-696.10.2.el6.orig/kernel/fork.c
443		-+++ linux-2.6.32-696.10.2.el6/kernel/fork.c
	442	+--- linux-2.6.32-696.13.2.el6.orig/kernel/fork.c
	443	++++ linux-2.6.32-696.13.2.el6/kernel/fork.c
444	444	@@ -205,6 +205,7 @@ void __put_task_struct(struct task_struc
445	445	exit_creds(tsk);
446	446	delayacct_tsk_free(tsk);

		@@ -467,8 +467,8 @@
467	467	bad_fork_cleanup_perf:
468	468	perf_event_free_task(p);
469	469	bad_fork_cleanup_policy:
470		---- linux-2.6.32-696.10.2.el6.orig/kernel/kexec.c
471		-+++ linux-2.6.32-696.10.2.el6/kernel/kexec.c
	470	+--- linux-2.6.32-696.13.2.el6.orig/kernel/kexec.c
	471	++++ linux-2.6.32-696.13.2.el6/kernel/kexec.c
472	472	@@ -41,6 +41,7 @@
473	473	#include <asm/system.h>
474	474	#include <asm/sections.h>

		@@ -486,8 +486,8 @@
486	486
487	487	if (kexec_load_disabled)
488	488	return -EPERM;
489		---- linux-2.6.32-696.10.2.el6.orig/kernel/module.c
490		-+++ linux-2.6.32-696.10.2.el6/kernel/module.c
	489	+--- linux-2.6.32-696.13.2.el6.orig/kernel/module.c
	490	++++ linux-2.6.32-696.13.2.el6/kernel/module.c
491	491	@@ -56,6 +56,7 @@
492	492	#include <linux/percpu.h>
493	493	#include <linux/kmemleak.h>

		@@ -514,8 +514,8 @@
514	514
515	515	/* Only one module load at a time, please */
516	516	if (mutex_lock_interruptible(&module_mutex) != 0)
517		---- linux-2.6.32-696.10.2.el6.orig/kernel/ptrace.c
518		-+++ linux-2.6.32-696.10.2.el6/kernel/ptrace.c
	517	+--- linux-2.6.32-696.13.2.el6.orig/kernel/ptrace.c
	518	++++ linux-2.6.32-696.13.2.el6/kernel/ptrace.c
519	519	@@ -195,6 +195,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
520	520	{
521	521	struct task_struct *child;

		@@ -540,8 +540,8 @@
540	540
541	541	if (request == PTRACE_TRACEME) {
542	542	ret = ptrace_traceme();
543		---- linux-2.6.32-696.10.2.el6.orig/kernel/sched.c
544		-+++ linux-2.6.32-696.10.2.el6/kernel/sched.c
	543	+--- linux-2.6.32-696.13.2.el6.orig/kernel/sched.c
	544	++++ linux-2.6.32-696.13.2.el6/kernel/sched.c
545	545	@@ -6852,6 +6852,8 @@ int can_nice(const struct task_struct *p
546	546	SYSCALL_DEFINE1(nice, int, increment)
547	547	{

		@@ -551,8 +551,8 @@
551	551
552	552	/*
553	553	* Setpriority might change our priority at the same moment.
554		---- linux-2.6.32-696.10.2.el6.orig/kernel/signal.c
555		-+++ linux-2.6.32-696.10.2.el6/kernel/signal.c
	554	+--- linux-2.6.32-696.13.2.el6.orig/kernel/signal.c
	555	++++ linux-2.6.32-696.13.2.el6/kernel/signal.c
556	556	@@ -2312,6 +2312,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
557	557	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
558	558	{

		@@ -598,8 +598,8 @@
598	598
599	599	return do_send_specific(tgid, pid, sig, info);
600	600	}
601		---- linux-2.6.32-696.10.2.el6.orig/kernel/sys.c
602		-+++ linux-2.6.32-696.10.2.el6/kernel/sys.c
	601	+--- linux-2.6.32-696.13.2.el6.orig/kernel/sys.c
	602	++++ linux-2.6.32-696.13.2.el6/kernel/sys.c
603	603	@@ -157,6 +157,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
604	604
605	605	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -638,8 +638,8 @@
638	638
639	639	down_write(&uts_sem);
640	640	errno = -EFAULT;
641		---- linux-2.6.32-696.10.2.el6.orig/kernel/sysctl.c
642		-+++ linux-2.6.32-696.10.2.el6/kernel/sysctl.c
	641	+--- linux-2.6.32-696.13.2.el6.orig/kernel/sysctl.c
	642	++++ linux-2.6.32-696.13.2.el6/kernel/sysctl.c
643	643	@@ -2130,6 +2130,9 @@ int do_sysctl(int __user *name, int nlen
644	644
645	645	for (head = sysctl_head_next(NULL); head;

		@@ -650,8 +650,8 @@
650	650	error = parse_table(name, nlen, oldval, oldlenp,
651	651	newval, newlen,
652	652	head->root, head->ctl_table);
653		---- linux-2.6.32-696.10.2.el6.orig/kernel/time.c
654		-+++ linux-2.6.32-696.10.2.el6/kernel/time.c
	653	+--- linux-2.6.32-696.13.2.el6.orig/kernel/time.c
	654	++++ linux-2.6.32-696.13.2.el6/kernel/time.c
655	655	@@ -92,6 +92,8 @@ SYSCALL_DEFINE1(stime, time_t __user *,
656	656	err = security_settime(&tv, NULL);
657	657	if (err)

		@@ -670,8 +670,8 @@
670	670
671	671	if (tz) {
672	672	/* SMP safe, global irq locking makes it work. */
673		---- linux-2.6.32-696.10.2.el6.orig/kernel/time/ntp.c
674		-+++ linux-2.6.32-696.10.2.el6/kernel/time/ntp.c
	673	+--- linux-2.6.32-696.13.2.el6.orig/kernel/time/ntp.c
	674	++++ linux-2.6.32-696.13.2.el6/kernel/time/ntp.c
675	675	@@ -14,6 +14,7 @@
676	676	#include <linux/timex.h>
677	677	#include <linux/time.h>

		@@ -696,8 +696,8 @@
696	696
697	697	/*
698	698	* if the quartz is off by more than 10% then
699		---- linux-2.6.32-696.10.2.el6.orig/net/ipv4/raw.c
700		-+++ linux-2.6.32-696.10.2.el6/net/ipv4/raw.c
	699	+--- linux-2.6.32-696.13.2.el6.orig/net/ipv4/raw.c
	700	++++ linux-2.6.32-696.13.2.el6/net/ipv4/raw.c
701	701	@@ -77,6 +77,7 @@
702	702	#include <linux/seq_file.h>
703	703	#include <linux/netfilter.h>

		@@ -717,8 +717,8 @@
717	717
718	718	copied = skb->len;
719	719	if (len < copied) {
720		---- linux-2.6.32-696.10.2.el6.orig/net/ipv4/udp.c
721		-+++ linux-2.6.32-696.10.2.el6/net/ipv4/udp.c
	720	+--- linux-2.6.32-696.13.2.el6.orig/net/ipv4/udp.c
	721	++++ linux-2.6.32-696.13.2.el6/net/ipv4/udp.c
722	722	@@ -108,6 +108,7 @@
723	723	#include <trace/events/udp.h>
724	724	#include <net/busy_poll.h>

		@@ -738,8 +738,8 @@
738	738
739	739	ulen = skb->len - sizeof(struct udphdr);
740	740	copied = len;
741		---- linux-2.6.32-696.10.2.el6.orig/net/ipv6/raw.c
742		-+++ linux-2.6.32-696.10.2.el6/net/ipv6/raw.c
	741	+--- linux-2.6.32-696.13.2.el6.orig/net/ipv6/raw.c
	742	++++ linux-2.6.32-696.13.2.el6/net/ipv6/raw.c
743	743	@@ -59,6 +59,7 @@
744	744
745	745	#include <linux/proc_fs.h>

		@@ -759,8 +759,8 @@
759	759
760	760	copied = skb->len;
761	761	if (copied > len) {
762		---- linux-2.6.32-696.10.2.el6.orig/net/ipv6/udp.c
763		-+++ linux-2.6.32-696.10.2.el6/net/ipv6/udp.c
	762	+--- linux-2.6.32-696.13.2.el6.orig/net/ipv6/udp.c
	763	++++ linux-2.6.32-696.13.2.el6/net/ipv6/udp.c
764	764	@@ -50,6 +50,7 @@
765	765	#include <linux/proc_fs.h>
766	766	#include <linux/seq_file.h>

		@@ -780,8 +780,8 @@
780	780
781	781	ulen = skb->len - sizeof(struct udphdr);
782	782	copied = len;
783		---- linux-2.6.32-696.10.2.el6.orig/net/socket.c
784		-+++ linux-2.6.32-696.10.2.el6/net/socket.c
	783	+--- linux-2.6.32-696.13.2.el6.orig/net/socket.c
	784	++++ linux-2.6.32-696.13.2.el6/net/socket.c
785	785	@@ -578,6 +578,8 @@ static inline int __sock_sendmsg(struct
786	786	struct msghdr *msg, size_t size)
787	787	{

		@@ -842,8 +842,8 @@
842	842	if (err)
843	843	goto out_put;
844	844
845		---- linux-2.6.32-696.10.2.el6.orig/net/unix/af_unix.c
846		-+++ linux-2.6.32-696.10.2.el6/net/unix/af_unix.c
	845	+--- linux-2.6.32-696.13.2.el6.orig/net/unix/af_unix.c
	846	++++ linux-2.6.32-696.13.2.el6/net/unix/af_unix.c
847	847	@@ -981,6 +981,9 @@ static int unix_bind(struct socket *sock
848	848	mode = S_IFSOCK \|
849	849	(SOCK_INODE(sock)->i_mode & ~current_umask());

		@@ -865,8 +865,8 @@
865	865	if (msg->msg_name)
866	866	unix_copy_addr(msg, skb->sk);
867	867
868		---- linux-2.6.32-696.10.2.el6.orig/security/Kconfig
869		-+++ linux-2.6.32-696.10.2.el6/security/Kconfig
	868	+--- linux-2.6.32-696.13.2.el6.orig/security/Kconfig
	869	++++ linux-2.6.32-696.13.2.el6/security/Kconfig
870	870	@@ -177,5 +177,7 @@ source security/tomoyo/Kconfig
871	871
872	872	source security/integrity/ima/Kconfig

		@@ -875,8 +875,8 @@
875	875	+
876	876	endmenu
877	877
878		---- linux-2.6.32-696.10.2.el6.orig/security/Makefile
879		-+++ linux-2.6.32-696.10.2.el6/security/Makefile
	878	+--- linux-2.6.32-696.13.2.el6.orig/security/Makefile
	879	++++ linux-2.6.32-696.13.2.el6/security/Makefile
880	880	@@ -25,3 +25,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
881	881	# Object integrity file lists
882	882	subdir-$(CONFIG_IMA) += integrity/ima

--- trunk/caitsith-patch/patches/ccs-patch-3.10-centos-7.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-3.10-centos-7.diff (revision 250)

		@@ -1,6 +1,6 @@
1	1	This is TOMOYO Linux patch for CentOS 7.
2	2
3		-Source code for this patch is http://vault.centos.org/centos/7/updates/Source/SPackages/kernel-3.10.0-693.2.2.el7.src.rpm
	3	+Source code for this patch is http://vault.centos.org/centos/7/updates/Source/SPackages/kernel-3.10.0-693.5.2.el7.src.rpm
4	4	---
5	5	fs/exec.c \| 2
6	6	fs/open.c \| 2

		@@ -28,8 +28,8 @@
28	28	security/security.c \| 111 +++++++++++++++++++++++++++++++++++++++++-----
29	29	24 files changed, 248 insertions(+), 37 deletions(-)
30	30
31		---- linux-3.10.0-693.2.2.el7.orig/fs/exec.c
32		-+++ linux-3.10.0-693.2.2.el7/fs/exec.c
	31	+--- linux-3.10.0-693.5.2.el7.orig/fs/exec.c
	32	++++ linux-3.10.0-693.5.2.el7/fs/exec.c
33	33	@@ -1580,7 +1580,7 @@ static int do_execve_common(struct filen
34	34	if (retval < 0)
35	35	goto out;

		@@ -39,8 +39,8 @@
39	39	if (retval < 0)
40	40	goto out;
41	41
42		---- linux-3.10.0-693.2.2.el7.orig/fs/open.c
43		-+++ linux-3.10.0-693.2.2.el7/fs/open.c
	42	+--- linux-3.10.0-693.5.2.el7.orig/fs/open.c
	43	++++ linux-3.10.0-693.5.2.el7/fs/open.c
44	44	@@ -1131,6 +1131,8 @@ EXPORT_SYMBOL(sys_close);
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-3.10.0-693.2.2.el7.orig/fs/proc/version.c
54		-+++ linux-3.10.0-693.2.2.el7/fs/proc/version.c
	53	+--- linux-3.10.0-693.5.2.el7.orig/fs/proc/version.c
	54	++++ linux-3.10.0-693.5.2.el7/fs/proc/version.c
55	55	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 3.10.0-693.2.2.el7 2017/09/15\n");
	62	++ printk(KERN_INFO "Hook version: 3.10.0-693.5.2.el7 2017/11/04\n");
63	63	+ return 0;
64	64	+}
65	65	+module_init(ccs_show_version);
66		---- linux-3.10.0-693.2.2.el7.orig/include/linux/init_task.h
67		-+++ linux-3.10.0-693.2.2.el7/include/linux/init_task.h
	66	+--- linux-3.10.0-693.5.2.el7.orig/include/linux/init_task.h
	67	++++ linux-3.10.0-693.5.2.el7/include/linux/init_task.h
68	68	@@ -173,6 +173,14 @@ extern struct task_group root_task_group
69	69	# define INIT_RT_MUTEXES(tsk)
70	70	#endif

		@@ -88,8 +88,8 @@
88	88	}
89	89
90	90
91		---- linux-3.10.0-693.2.2.el7.orig/include/linux/sched.h
92		-+++ linux-3.10.0-693.2.2.el7/include/linux/sched.h
	91	+--- linux-3.10.0-693.5.2.el7.orig/include/linux/sched.h
	92	++++ linux-3.10.0-693.5.2.el7/include/linux/sched.h
93	93	@@ -4,6 +4,8 @@
94	94	#include <uapi/linux/sched.h>
95	95	#include <linux/rh_kabi.h>

		@@ -110,8 +110,8 @@
110	110	};
111	111
112	112	/* Future-safe accessor for struct task_struct's cpus_allowed. */
113		---- linux-3.10.0-693.2.2.el7.orig/include/linux/security.h
114		-+++ linux-3.10.0-693.2.2.el7/include/linux/security.h
	113	+--- linux-3.10.0-693.5.2.el7.orig/include/linux/security.h
	114	++++ linux-3.10.0-693.5.2.el7/include/linux/security.h
115	115	@@ -54,6 +54,7 @@ struct msg_queue;
116	116	struct xattr;
117	117	struct xfrm_sec_ctx;

		@@ -323,8 +323,8 @@
323	323	}
324	324	#endif /* CONFIG_SECURITY_PATH */
325	325
326		---- linux-3.10.0-693.2.2.el7.orig/include/net/ip.h
327		-+++ linux-3.10.0-693.2.2.el7/include/net/ip.h
	326	+--- linux-3.10.0-693.5.2.el7.orig/include/net/ip.h
	327	++++ linux-3.10.0-693.5.2.el7/include/net/ip.h
328	328	@@ -230,6 +230,8 @@ void inet_get_local_port_range(struct ne
329	329	extern unsigned long *sysctl_local_reserved_ports;
330	330	static inline int inet_is_reserved_local_port(int port)

		@@ -334,8 +334,8 @@
334	334	return test_bit(port, sysctl_local_reserved_ports);
335	335	}
336	336
337		---- linux-3.10.0-693.2.2.el7.orig/kernel/fork.c
338		-+++ linux-3.10.0-693.2.2.el7/kernel/fork.c
	337	+--- linux-3.10.0-693.5.2.el7.orig/kernel/fork.c
	338	++++ linux-3.10.0-693.5.2.el7/kernel/fork.c
339	339	@@ -276,6 +276,7 @@ void __put_task_struct(struct task_struc
340	340	delayacct_tsk_free(tsk);
341	341	put_signal_struct(tsk->signal);

		@@ -362,8 +362,8 @@
362	362	bad_fork_cleanup_perf:
363	363	perf_event_free_task(p);
364	364	bad_fork_cleanup_policy:
365		---- linux-3.10.0-693.2.2.el7.orig/kernel/kexec.c
366		-+++ linux-3.10.0-693.2.2.el7/kernel/kexec.c
	365	+--- linux-3.10.0-693.5.2.el7.orig/kernel/kexec.c
	366	++++ linux-3.10.0-693.5.2.el7/kernel/kexec.c
367	367	@@ -132,6 +132,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
368	368	/* We only trust the superuser with rebooting the system. */
369	369	if (!capable(CAP_SYS_BOOT) \|\| kexec_load_disabled)

		@@ -373,8 +373,8 @@
373	373
374	374	if (get_securelevel() > 0)
375	375	return -EPERM;
376		---- linux-3.10.0-693.2.2.el7.orig/kernel/module.c
377		-+++ linux-3.10.0-693.2.2.el7/kernel/module.c
	376	+--- linux-3.10.0-693.5.2.el7.orig/kernel/module.c
	377	++++ linux-3.10.0-693.5.2.el7/kernel/module.c
378	378	@@ -65,6 +65,7 @@
379	379	#endif /* __GENKSYMS__ */
380	380	#include <uapi/linux/module.h>

		@@ -401,8 +401,8 @@
401	401
402	402	return 0;
403	403	}
404		---- linux-3.10.0-693.2.2.el7.orig/kernel/ptrace.c
405		-+++ linux-3.10.0-693.2.2.el7/kernel/ptrace.c
	404	+--- linux-3.10.0-693.5.2.el7.orig/kernel/ptrace.c
	405	++++ linux-3.10.0-693.5.2.el7/kernel/ptrace.c
406	406	@@ -1044,6 +1044,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
407	407	{
408	408	struct task_struct *child;

		@@ -427,8 +427,8 @@
427	427
428	428	if (request == PTRACE_TRACEME) {
429	429	ret = ptrace_traceme();
430		---- linux-3.10.0-693.2.2.el7.orig/kernel/sched/core.c
431		-+++ linux-3.10.0-693.2.2.el7/kernel/sched/core.c
	430	+--- linux-3.10.0-693.5.2.el7.orig/kernel/sched/core.c
	431	++++ linux-3.10.0-693.5.2.el7/kernel/sched/core.c
432	432	@@ -4279,6 +4279,8 @@ int can_nice(const struct task_struct *p
433	433	SYSCALL_DEFINE1(nice, int, increment)
434	434	{

		@@ -438,8 +438,8 @@
438	438
439	439	/*
440	440	* Setpriority might change our priority at the same moment.
441		---- linux-3.10.0-693.2.2.el7.orig/kernel/signal.c
442		-+++ linux-3.10.0-693.2.2.el7/kernel/signal.c
	441	+--- linux-3.10.0-693.5.2.el7.orig/kernel/signal.c
	442	++++ linux-3.10.0-693.5.2.el7/kernel/signal.c
443	443	@@ -2923,6 +2923,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
444	444	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
445	445	{

		@@ -485,8 +485,8 @@
485	485
486	486	return do_send_specific(tgid, pid, sig, info);
487	487	}
488		---- linux-3.10.0-693.2.2.el7.orig/kernel/sys.c
489		-+++ linux-3.10.0-693.2.2.el7/kernel/sys.c
	488	+--- linux-3.10.0-693.5.2.el7.orig/kernel/sys.c
	489	++++ linux-3.10.0-693.5.2.el7/kernel/sys.c
490	490	@@ -192,6 +192,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
491	491
492	492	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -525,8 +525,8 @@
525	525
526	526	down_write(&uts_sem);
527	527	errno = -EFAULT;
528		---- linux-3.10.0-693.2.2.el7.orig/kernel/time/ntp.c
529		-+++ linux-3.10.0-693.2.2.el7/kernel/time/ntp.c
	528	+--- linux-3.10.0-693.5.2.el7.orig/kernel/time/ntp.c
	529	++++ linux-3.10.0-693.5.2.el7/kernel/time/ntp.c
530	530	@@ -16,6 +16,7 @@
531	531	#include <linux/mm.h>
532	532	#include <linux/module.h>

		@@ -560,8 +560,8 @@
560	560
561	561	return 0;
562	562	}
563		---- linux-3.10.0-693.2.2.el7.orig/net/ipv4/raw.c
564		-+++ linux-3.10.0-693.2.2.el7/net/ipv4/raw.c
	563	+--- linux-3.10.0-693.5.2.el7.orig/net/ipv4/raw.c
	564	++++ linux-3.10.0-693.5.2.el7/net/ipv4/raw.c
565	565	@@ -706,6 +706,10 @@ static int raw_recvmsg(struct kiocb *ioc
566	566	skb = skb_recv_datagram(sk, flags, noblock, &err);
567	567	if (!skb)

		@@ -573,8 +573,8 @@
573	573
574	574	copied = skb->len;
575	575	if (len < copied) {
576		---- linux-3.10.0-693.2.2.el7.orig/net/ipv4/udp.c
577		-+++ linux-3.10.0-693.2.2.el7/net/ipv4/udp.c
	576	+--- linux-3.10.0-693.5.2.el7.orig/net/ipv4/udp.c
	577	++++ linux-3.10.0-693.5.2.el7/net/ipv4/udp.c
578	578	@@ -1364,6 +1364,10 @@ try_again:
579	579	skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
580	580	if (!skb)

		@@ -586,8 +586,8 @@
586	586
587	587	ulen = skb->len - sizeof(struct udphdr);
588	588	copied = len;
589		---- linux-3.10.0-693.2.2.el7.orig/net/ipv6/raw.c
590		-+++ linux-3.10.0-693.2.2.el7/net/ipv6/raw.c
	589	+--- linux-3.10.0-693.5.2.el7.orig/net/ipv6/raw.c
	590	++++ linux-3.10.0-693.5.2.el7/net/ipv6/raw.c
591	591	@@ -468,6 +468,10 @@ static int rawv6_recvmsg(struct kiocb *i
592	592	skb = skb_recv_datagram(sk, flags, noblock, &err);
593	593	if (!skb)

		@@ -599,8 +599,8 @@
599	599
600	600	copied = skb->len;
601	601	if (copied > len) {
602		---- linux-3.10.0-693.2.2.el7.orig/net/ipv6/udp.c
603		-+++ linux-3.10.0-693.2.2.el7/net/ipv6/udp.c
	602	+--- linux-3.10.0-693.5.2.el7.orig/net/ipv6/udp.c
	603	++++ linux-3.10.0-693.5.2.el7/net/ipv6/udp.c
604	604	@@ -414,6 +414,10 @@ try_again:
605	605	skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
606	606	if (!skb)

		@@ -612,8 +612,8 @@
612	612
613	613	ulen = skb->len - sizeof(struct udphdr);
614	614	copied = len;
615		---- linux-3.10.0-693.2.2.el7.orig/net/socket.c
616		-+++ linux-3.10.0-693.2.2.el7/net/socket.c
	615	+--- linux-3.10.0-693.5.2.el7.orig/net/socket.c
	616	++++ linux-3.10.0-693.5.2.el7/net/socket.c
617	617	@@ -1609,6 +1609,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
618	618	if (err < 0)
619	619	goto out_fd;

		@@ -625,8 +625,8 @@
625	625	if (upeer_sockaddr) {
626	626	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
627	627	&len, 2) < 0) {
628		---- linux-3.10.0-693.2.2.el7.orig/net/unix/af_unix.c
629		-+++ linux-3.10.0-693.2.2.el7/net/unix/af_unix.c
	628	+--- linux-3.10.0-693.5.2.el7.orig/net/unix/af_unix.c
	629	++++ linux-3.10.0-693.5.2.el7/net/unix/af_unix.c
630	630	@@ -2137,6 +2137,10 @@ static int unix_dgram_recvmsg(struct kio
631	631	wake_up_interruptible_sync_poll(&u->peer_wait,
632	632	POLLOUT \| POLLWRNORM \| POLLWRBAND);

		@@ -638,8 +638,8 @@
638	638	if (msg->msg_name)
639	639	unix_copy_addr(msg, skb->sk);
640	640
641		---- linux-3.10.0-693.2.2.el7.orig/security/Kconfig
642		-+++ linux-3.10.0-693.2.2.el7/security/Kconfig
	641	+--- linux-3.10.0-693.5.2.el7.orig/security/Kconfig
	642	++++ linux-3.10.0-693.5.2.el7/security/Kconfig
643	643	@@ -175,5 +175,7 @@ config DEFAULT_SECURITY
644	644	default "yama" if DEFAULT_SECURITY_YAMA
645	645	default "" if DEFAULT_SECURITY_DAC

		@@ -648,8 +648,8 @@
648	648	+
649	649	endmenu
650	650
651		---- linux-3.10.0-693.2.2.el7.orig/security/Makefile
652		-+++ linux-3.10.0-693.2.2.el7/security/Makefile
	651	+--- linux-3.10.0-693.5.2.el7.orig/security/Makefile
	652	++++ linux-3.10.0-693.5.2.el7/security/Makefile
653	653	@@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
654	654	# Object integrity file lists
655	655	subdir-$(CONFIG_INTEGRITY) += integrity

		@@ -657,8 +657,8 @@
657	657	+
658	658	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
659	659	+obj-$(CONFIG_CCSECURITY) += ccsecurity/built-in.o
660		---- linux-3.10.0-693.2.2.el7.orig/security/security.c
661		-+++ linux-3.10.0-693.2.2.el7/security/security.c
	660	+--- linux-3.10.0-693.5.2.el7.orig/security/security.c
	661	++++ linux-3.10.0-693.5.2.el7/security/security.c
662	662	@@ -203,7 +203,10 @@ int security_syslog(int type)
663	663
664	664	int security_settime(const struct timespec ts, const struct timezone tz)

--- trunk/caitsith-patch/patches/ccs-patch-3.13-ubuntu-14.04.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-3.13-ubuntu-14.04.diff (revision 250)

		@@ -29,9 +29,9 @@
29	29	security/security.c \| 107 ++++++++++++++++++++++++++++++++++++++++------
30	30	25 files changed, 236 insertions(+), 37 deletions(-)
31	31
32		---- linux-3.13.0-129.178.orig/fs/exec.c
33		-+++ linux-3.13.0-129.178/fs/exec.c
34		-@@ -1476,7 +1476,7 @@ static int exec_binprm(struct linux_binp
	32	+--- linux-3.13.0-135.184.orig/fs/exec.c
	33	++++ linux-3.13.0-135.184/fs/exec.c
	34	+@@ -1482,7 +1482,7 @@ static int exec_binprm(struct linux_binp
35	35	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
36	36	rcu_read_unlock();
37	37

		@@ -40,8 +40,8 @@
40	40	if (ret >= 0) {
41	41	audit_bprm(bprm);
42	42	trace_sched_process_exec(current, old_pid, bprm);
43		---- linux-3.13.0-129.178.orig/fs/open.c
44		-+++ linux-3.13.0-129.178/fs/open.c
	43	+--- linux-3.13.0-135.184.orig/fs/open.c
	44	++++ linux-3.13.0-135.184/fs/open.c
45	45	@@ -1088,6 +1088,8 @@ EXPORT_SYMBOL(sys_close);
46	46	*/
47	47	SYSCALL_DEFINE0(vhangup)

		@@ -51,8 +51,8 @@
51	51	if (capable(CAP_SYS_TTY_CONFIG)) {
52	52	tty_vhangup_self();
53	53	return 0;
54		---- linux-3.13.0-129.178.orig/fs/proc/version.c
55		-+++ linux-3.13.0-129.178/fs/proc/version.c
	54	+--- linux-3.13.0-135.184.orig/fs/proc/version.c
	55	++++ linux-3.13.0-135.184/fs/proc/version.c
56	56	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
57	57	return 0;
58	58	}

		@@ -60,12 +60,12 @@
60	60	+
61	61	+static int __init ccs_show_version(void)
62	62	+{
63		-+ printk(KERN_INFO "Hook version: 3.13.0-129.178 2017/09/02\n");
	63	++ printk(KERN_INFO "Hook version: 3.13.0-135.184 2017/11/04\n");
64	64	+ return 0;
65	65	+}
66	66	+module_init(ccs_show_version);
67		---- linux-3.13.0-129.178.orig/include/linux/init_task.h
68		-+++ linux-3.13.0-129.178/include/linux/init_task.h
	67	+--- linux-3.13.0-135.184.orig/include/linux/init_task.h
	68	++++ linux-3.13.0-135.184/include/linux/init_task.h
69	69	@@ -155,6 +155,14 @@ extern struct task_group root_task_group
70	70
71	71	#define INIT_TASK_COMM "swapper"

		@@ -89,8 +89,8 @@
89	89	}
90	90
91	91
92		---- linux-3.13.0-129.178.orig/include/linux/sched.h
93		-+++ linux-3.13.0-129.178/include/linux/sched.h
	92	+--- linux-3.13.0-135.184.orig/include/linux/sched.h
	93	++++ linux-3.13.0-135.184/include/linux/sched.h
94	94	@@ -4,6 +4,8 @@
95	95	#include <uapi/linux/sched.h>
96	96

		@@ -111,8 +111,8 @@
111	111	};
112	112
113	113	/* Future-safe accessor for struct task_struct's cpus_allowed. */
114		---- linux-3.13.0-129.178.orig/include/linux/security.h
115		-+++ linux-3.13.0-129.178/include/linux/security.h
	114	+--- linux-3.13.0-135.184.orig/include/linux/security.h
	115	++++ linux-3.13.0-135.184/include/linux/security.h
116	116	@@ -53,6 +53,7 @@ struct msg_queue;
117	117	struct xattr;
118	118	struct xfrm_sec_ctx;

		@@ -314,8 +314,8 @@
314	314	}
315	315	#endif /* CONFIG_SECURITY_PATH */
316	316
317		---- linux-3.13.0-129.178.orig/include/net/ip.h
318		-+++ linux-3.13.0-129.178/include/net/ip.h
	317	+--- linux-3.13.0-135.184.orig/include/net/ip.h
	318	++++ linux-3.13.0-135.184/include/net/ip.h
319	319	@@ -225,6 +225,8 @@ void inet_get_local_port_range(struct ne
320	320	extern unsigned long *sysctl_local_reserved_ports;
321	321	static inline int inet_is_reserved_local_port(int port)

		@@ -325,8 +325,8 @@
325	325	return test_bit(port, sysctl_local_reserved_ports);
326	326	}
327	327
328		---- linux-3.13.0-129.178.orig/kernel/fork.c
329		-+++ linux-3.13.0-129.178/kernel/fork.c
	328	+--- linux-3.13.0-135.184.orig/kernel/fork.c
	329	++++ linux-3.13.0-135.184/kernel/fork.c
330	330	@@ -248,6 +248,7 @@ void __put_task_struct(struct task_struc
331	331	delayacct_tsk_free(tsk);
332	332	put_signal_struct(tsk->signal);

		@@ -353,8 +353,8 @@
353	353	bad_fork_cleanup_perf:
354	354	perf_event_free_task(p);
355	355	bad_fork_cleanup_policy:
356		---- linux-3.13.0-129.178.orig/kernel/kexec.c
357		-+++ linux-3.13.0-129.178/kernel/kexec.c
	356	+--- linux-3.13.0-135.184.orig/kernel/kexec.c
	357	++++ linux-3.13.0-135.184/kernel/kexec.c
358	358	@@ -38,6 +38,7 @@
359	359	#include <asm/uaccess.h>
360	360	#include <asm/io.h>

		@@ -372,8 +372,8 @@
372	372
373	373	/*
374	374	* Verify we have a legal set of flags
375		---- linux-3.13.0-129.178.orig/kernel/module.c
376		-+++ linux-3.13.0-129.178/kernel/module.c
	375	+--- linux-3.13.0-135.184.orig/kernel/module.c
	376	++++ linux-3.13.0-135.184/kernel/module.c
377	377	@@ -63,6 +63,7 @@
378	378	#include <linux/fips.h>
379	379	#include <uapi/linux/module.h>

		@@ -400,8 +400,8 @@
400	400
401	401	return 0;
402	402	}
403		---- linux-3.13.0-129.178.orig/kernel/ptrace.c
404		-+++ linux-3.13.0-129.178/kernel/ptrace.c
	403	+--- linux-3.13.0-135.184.orig/kernel/ptrace.c
	404	++++ linux-3.13.0-135.184/kernel/ptrace.c
405	405	@@ -1055,6 +1055,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
406	406	{
407	407	struct task_struct *child;

		@@ -426,8 +426,8 @@
426	426
427	427	if (request == PTRACE_TRACEME) {
428	428	ret = ptrace_traceme();
429		---- linux-3.13.0-129.178.orig/kernel/reboot.c
430		-+++ linux-3.13.0-129.178/kernel/reboot.c
	429	+--- linux-3.13.0-135.184.orig/kernel/reboot.c
	430	++++ linux-3.13.0-135.184/kernel/reboot.c
431	431	@@ -16,6 +16,7 @@
432	432	#include <linux/syscalls.h>
433	433	#include <linux/syscore_ops.h>

		@@ -445,8 +445,8 @@
445	445
446	446	/*
447	447	* If pid namespaces are enabled and the current task is in a child
448		---- linux-3.13.0-129.178.orig/kernel/sched/core.c
449		-+++ linux-3.13.0-129.178/kernel/sched/core.c
	448	+--- linux-3.13.0-135.184.orig/kernel/sched/core.c
	449	++++ linux-3.13.0-135.184/kernel/sched/core.c
450	450	@@ -2922,6 +2922,8 @@ int can_nice(const struct task_struct *p
451	451	SYSCALL_DEFINE1(nice, int, increment)
452	452	{

		@@ -456,8 +456,8 @@
456	456
457	457	/*
458	458	* Setpriority might change our priority at the same moment.
459		---- linux-3.13.0-129.178.orig/kernel/signal.c
460		-+++ linux-3.13.0-129.178/kernel/signal.c
	459	+--- linux-3.13.0-135.184.orig/kernel/signal.c
	460	++++ linux-3.13.0-135.184/kernel/signal.c
461	461	@@ -2909,6 +2909,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
462	462	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
463	463	{

		@@ -503,8 +503,8 @@
503	503
504	504	return do_send_specific(tgid, pid, sig, info);
505	505	}
506		---- linux-3.13.0-129.178.orig/kernel/sys.c
507		-+++ linux-3.13.0-129.178/kernel/sys.c
	506	+--- linux-3.13.0-135.184.orig/kernel/sys.c
	507	++++ linux-3.13.0-135.184/kernel/sys.c
508	508	@@ -171,6 +171,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
509	509
510	510	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -534,8 +534,8 @@
534	534
535	535	down_write(&uts_sem);
536	536	errno = -EFAULT;
537		---- linux-3.13.0-129.178.orig/kernel/time/ntp.c
538		-+++ linux-3.13.0-129.178/kernel/time/ntp.c
	537	+--- linux-3.13.0-135.184.orig/kernel/time/ntp.c
	538	++++ linux-3.13.0-135.184/kernel/time/ntp.c
539	539	@@ -16,6 +16,7 @@
540	540	#include <linux/mm.h>
541	541	#include <linux/module.h>

		@@ -569,8 +569,8 @@
569	569
570	570	/*
571	571	* Check for potential multiplication overflows that can
572		---- linux-3.13.0-129.178.orig/net/ipv4/raw.c
573		-+++ linux-3.13.0-129.178/net/ipv4/raw.c
	572	+--- linux-3.13.0-135.184.orig/net/ipv4/raw.c
	573	++++ linux-3.13.0-135.184/net/ipv4/raw.c
574	574	@@ -706,6 +706,10 @@ static int raw_recvmsg(struct kiocb *ioc
575	575	skb = skb_recv_datagram(sk, flags, noblock, &err);
576	576	if (!skb)

		@@ -582,8 +582,8 @@
582	582
583	583	copied = skb->len;
584	584	if (len < copied) {
585		---- linux-3.13.0-129.178.orig/net/ipv4/udp.c
586		-+++ linux-3.13.0-129.178/net/ipv4/udp.c
	585	+--- linux-3.13.0-135.184.orig/net/ipv4/udp.c
	586	++++ linux-3.13.0-135.184/net/ipv4/udp.c
587	587	@@ -1247,6 +1247,10 @@ try_again:
588	588	&peeked, &off, &err);
589	589	if (!skb)

		@@ -595,8 +595,8 @@
595	595
596	596	ulen = skb->len - sizeof(struct udphdr);
597	597	copied = len;
598		---- linux-3.13.0-129.178.orig/net/ipv6/raw.c
599		-+++ linux-3.13.0-129.178/net/ipv6/raw.c
	598	+--- linux-3.13.0-135.184.orig/net/ipv6/raw.c
	599	++++ linux-3.13.0-135.184/net/ipv6/raw.c
600	600	@@ -474,6 +474,10 @@ static int rawv6_recvmsg(struct kiocb *i
601	601	skb = skb_recv_datagram(sk, flags, noblock, &err);
602	602	if (!skb)

		@@ -608,8 +608,8 @@
608	608
609	609	copied = skb->len;
610	610	if (copied > len) {
611		---- linux-3.13.0-129.178.orig/net/ipv6/udp.c
612		-+++ linux-3.13.0-129.178/net/ipv6/udp.c
	611	+--- linux-3.13.0-135.184.orig/net/ipv6/udp.c
	612	++++ linux-3.13.0-135.184/net/ipv6/udp.c
613	613	@@ -404,6 +404,10 @@ try_again:
614	614	&peeked, &off, &err);
615	615	if (!skb)

		@@ -621,8 +621,8 @@
621	621
622	622	ulen = skb->len - sizeof(struct udphdr);
623	623	copied = len;
624		---- linux-3.13.0-129.178.orig/net/socket.c
625		-+++ linux-3.13.0-129.178/net/socket.c
	624	+--- linux-3.13.0-135.184.orig/net/socket.c
	625	++++ linux-3.13.0-135.184/net/socket.c
626	626	@@ -1616,6 +1616,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
627	627	if (err < 0)
628	628	goto out_fd;

		@@ -634,8 +634,8 @@
634	634	if (upeer_sockaddr) {
635	635	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
636	636	&len, 2) < 0) {
637		---- linux-3.13.0-129.178.orig/net/unix/af_unix.c
638		-+++ linux-3.13.0-129.178/net/unix/af_unix.c
	637	+--- linux-3.13.0-135.184.orig/net/unix/af_unix.c
	638	++++ linux-3.13.0-135.184/net/unix/af_unix.c
639	639	@@ -1973,6 +1973,10 @@ static int unix_dgram_recvmsg(struct kio
640	640	wake_up_interruptible_sync_poll(&u->peer_wait,
641	641	POLLOUT \| POLLWRNORM \| POLLWRBAND);

		@@ -647,8 +647,8 @@
647	647	if (msg->msg_name)
648	648	unix_copy_addr(msg, skb->sk);
649	649
650		---- linux-3.13.0-129.178.orig/security/Kconfig
651		-+++ linux-3.13.0-129.178/security/Kconfig
	650	+--- linux-3.13.0-135.184.orig/security/Kconfig
	651	++++ linux-3.13.0-135.184/security/Kconfig
652	652	@@ -167,5 +167,7 @@ config DEFAULT_SECURITY
653	653	default "yama" if DEFAULT_SECURITY_YAMA
654	654	default "" if DEFAULT_SECURITY_DAC

		@@ -657,8 +657,8 @@
657	657	+
658	658	endmenu
659	659
660		---- linux-3.13.0-129.178.orig/security/Makefile
661		-+++ linux-3.13.0-129.178/security/Makefile
	660	+--- linux-3.13.0-135.184.orig/security/Makefile
	661	++++ linux-3.13.0-135.184/security/Makefile
662	662	@@ -27,3 +27,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
663	663	# Object integrity file lists
664	664	subdir-$(CONFIG_INTEGRITY) += integrity

		@@ -666,8 +666,8 @@
666	666	+
667	667	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
668	668	+obj-$(CONFIG_CCSECURITY) += ccsecurity/built-in.o
669		---- linux-3.13.0-129.178.orig/security/security.c
670		-+++ linux-3.13.0-129.178/security/security.c
	669	+--- linux-3.13.0-135.184.orig/security/security.c
	670	++++ linux-3.13.0-135.184/security/security.c
671	671	@@ -203,7 +203,10 @@ int security_syslog(int type)
672	672
673	673	int security_settime(const struct timespec ts, const struct timezone tz)

--- trunk/caitsith-patch/patches/ccs-patch-3.16.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-3.16.diff (revision 250)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 3.16.48.
	1	+This is TOMOYO Linux patch for kernel 3.16.49.
2	2
3		-Source code for this patch is https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.16.48.tar.xz
	3	+Source code for this patch is https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.16.49.tar.xz
4	4	---
5	5	fs/exec.c \| 2
6	6	fs/open.c \| 2

		@@ -29,8 +29,8 @@
29	29	security/security.c \| 111 +++++++++++++++++++++++++++++++++++++++++-----
30	30	25 files changed, 252 insertions(+), 37 deletions(-)
31	31
32		---- linux-3.16.48.orig/fs/exec.c
33		-+++ linux-3.16.48/fs/exec.c
	32	+--- linux-3.16.49.orig/fs/exec.c
	33	++++ linux-3.16.49/fs/exec.c
34	34	@@ -1467,7 +1467,7 @@ static int exec_binprm(struct linux_binp
35	35	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
36	36	rcu_read_unlock();

		@@ -40,8 +40,8 @@
40	40	if (ret >= 0) {
41	41	audit_bprm(bprm);
42	42	trace_sched_process_exec(current, old_pid, bprm);
43		---- linux-3.16.48.orig/fs/open.c
44		-+++ linux-3.16.48/fs/open.c
	43	+--- linux-3.16.49.orig/fs/open.c
	44	++++ linux-3.16.49/fs/open.c
45	45	@@ -1069,6 +1069,8 @@ EXPORT_SYMBOL(sys_close);
46	46	*/
47	47	SYSCALL_DEFINE0(vhangup)

		@@ -51,8 +51,8 @@
51	51	if (capable(CAP_SYS_TTY_CONFIG)) {
52	52	tty_vhangup_self();
53	53	return 0;
54		---- linux-3.16.48.orig/fs/proc/version.c
55		-+++ linux-3.16.48/fs/proc/version.c
	54	+--- linux-3.16.49.orig/fs/proc/version.c
	55	++++ linux-3.16.49/fs/proc/version.c
56	56	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
57	57	return 0;
58	58	}

		@@ -60,12 +60,12 @@
60	60	+
61	61	+static int __init ccs_show_version(void)
62	62	+{
63		-+ printk(KERN_INFO "Hook version: 3.16.48 2017/09/17\n");
	63	++ printk(KERN_INFO "Hook version: 3.16.49 2017/10/16\n");
64	64	+ return 0;
65	65	+}
66	66	+fs_initcall(ccs_show_version);
67		---- linux-3.16.48.orig/include/linux/init_task.h
68		-+++ linux-3.16.48/include/linux/init_task.h
	67	+--- linux-3.16.49.orig/include/linux/init_task.h
	68	++++ linux-3.16.49/include/linux/init_task.h
69	69	@@ -164,6 +164,14 @@ extern struct task_group root_task_group
70	70	# define INIT_RT_MUTEXES(tsk)
71	71	#endif

		@@ -89,8 +89,8 @@
89	89	}
90	90
91	91
92		---- linux-3.16.48.orig/include/linux/sched.h
93		-+++ linux-3.16.48/include/linux/sched.h
	92	+--- linux-3.16.49.orig/include/linux/sched.h
	93	++++ linux-3.16.49/include/linux/sched.h
94	94	@@ -6,6 +6,8 @@
95	95	#include <linux/sched/prio.h>
96	96

		@@ -100,7 +100,7 @@
100	100	struct sched_param {
101	101	int sched_priority;
102	102	};
103		-@@ -1665,6 +1667,10 @@ struct task_struct {
	103	+@@ -1664,6 +1666,10 @@ struct task_struct {
104	104	unsigned int sequential_io;
105	105	unsigned int sequential_io_avg;
106	106	#endif

		@@ -111,8 +111,8 @@
111	111	};
112	112
113	113	/* Future-safe accessor for struct task_struct's cpus_allowed. */
114		---- linux-3.16.48.orig/include/linux/security.h
115		-+++ linux-3.16.48/include/linux/security.h
	114	+--- linux-3.16.49.orig/include/linux/security.h
	115	++++ linux-3.16.49/include/linux/security.h
116	116	@@ -53,6 +53,7 @@ struct msg_queue;
117	117	struct xattr;
118	118	struct xfrm_sec_ctx;

		@@ -324,8 +324,8 @@
324	324	}
325	325	#endif /* CONFIG_SECURITY_PATH */
326	326
327		---- linux-3.16.48.orig/include/net/ip.h
328		-+++ linux-3.16.48/include/net/ip.h
	327	+--- linux-3.16.49.orig/include/net/ip.h
	328	++++ linux-3.16.49/include/net/ip.h
329	329	@@ -213,6 +213,8 @@ void inet_get_local_port_range(struct ne
330	330	#ifdef CONFIG_SYSCTL
331	331	static inline int inet_is_local_reserved_port(struct net *net, int port)

		@@ -344,8 +344,8 @@
344	344	return 0;
345	345	}
346	346	#endif
347		---- linux-3.16.48.orig/kernel/fork.c
348		-+++ linux-3.16.48/kernel/fork.c
	347	+--- linux-3.16.49.orig/kernel/fork.c
	348	++++ linux-3.16.49/kernel/fork.c
349	349	@@ -246,6 +246,7 @@ void __put_task_struct(struct task_struc
350	350	delayacct_tsk_free(tsk);
351	351	put_signal_struct(tsk->signal);

		@@ -372,8 +372,8 @@
372	372	bad_fork_cleanup_perf:
373	373	perf_event_free_task(p);
374	374	bad_fork_cleanup_policy:
375		---- linux-3.16.48.orig/kernel/kexec.c
376		-+++ linux-3.16.48/kernel/kexec.c
	375	+--- linux-3.16.49.orig/kernel/kexec.c
	376	++++ linux-3.16.49/kernel/kexec.c
377	377	@@ -39,6 +39,7 @@
378	378	#include <asm/uaccess.h>
379	379	#include <asm/io.h>

		@@ -391,8 +391,8 @@
391	391
392	392	/*
393	393	* Verify we have a legal set of flags
394		---- linux-3.16.48.orig/kernel/module.c
395		-+++ linux-3.16.48/kernel/module.c
	394	+--- linux-3.16.49.orig/kernel/module.c
	395	++++ linux-3.16.49/kernel/module.c
396	396	@@ -63,6 +63,7 @@
397	397	#include <linux/fips.h>
398	398	#include <uapi/linux/module.h>

		@@ -419,8 +419,8 @@
419	419
420	420	return 0;
421	421	}
422		---- linux-3.16.48.orig/kernel/ptrace.c
423		-+++ linux-3.16.48/kernel/ptrace.c
	422	+--- linux-3.16.49.orig/kernel/ptrace.c
	423	++++ linux-3.16.49/kernel/ptrace.c
424	424	@@ -1087,6 +1087,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
425	425	{
426	426	struct task_struct *child;

		@@ -445,8 +445,8 @@
445	445
446	446	if (request == PTRACE_TRACEME) {
447	447	ret = ptrace_traceme();
448		---- linux-3.16.48.orig/kernel/reboot.c
449		-+++ linux-3.16.48/kernel/reboot.c
	448	+--- linux-3.16.49.orig/kernel/reboot.c
	449	++++ linux-3.16.49/kernel/reboot.c
450	450	@@ -16,6 +16,7 @@
451	451	#include <linux/syscalls.h>
452	452	#include <linux/syscore_ops.h>

		@@ -464,8 +464,8 @@
464	464
465	465	/*
466	466	* If pid namespaces are enabled and the current task is in a child
467		---- linux-3.16.48.orig/kernel/sched/core.c
468		-+++ linux-3.16.48/kernel/sched/core.c
	467	+--- linux-3.16.49.orig/kernel/sched/core.c
	468	++++ linux-3.16.49/kernel/sched/core.c
469	469	@@ -3164,6 +3164,8 @@ int can_nice(const struct task_struct *p
470	470	SYSCALL_DEFINE1(nice, int, increment)
471	471	{

		@@ -475,8 +475,8 @@
475	475
476	476	/*
477	477	* Setpriority might change our priority at the same moment.
478		---- linux-3.16.48.orig/kernel/signal.c
479		-+++ linux-3.16.48/kernel/signal.c
	478	+--- linux-3.16.49.orig/kernel/signal.c
	479	++++ linux-3.16.49/kernel/signal.c
480	480	@@ -2895,6 +2895,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
481	481	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
482	482	{

		@@ -522,8 +522,8 @@
522	522
523	523	return do_send_specific(tgid, pid, sig, info);
524	524	}
525		---- linux-3.16.48.orig/kernel/sys.c
526		-+++ linux-3.16.48/kernel/sys.c
	525	+--- linux-3.16.49.orig/kernel/sys.c
	526	++++ linux-3.16.49/kernel/sys.c
527	527	@@ -171,6 +171,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
528	528
529	529	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -553,8 +553,8 @@
553	553
554	554	down_write(&uts_sem);
555	555	errno = -EFAULT;
556		---- linux-3.16.48.orig/kernel/time/ntp.c
557		-+++ linux-3.16.48/kernel/time/ntp.c
	556	+--- linux-3.16.49.orig/kernel/time/ntp.c
	557	++++ linux-3.16.49/kernel/time/ntp.c
558	558	@@ -16,6 +16,7 @@
559	559	#include <linux/mm.h>
560	560	#include <linux/module.h>

		@@ -588,8 +588,8 @@
588	588
589	589	/*
590	590	* Check for potential multiplication overflows that can
591		---- linux-3.16.48.orig/net/ipv4/raw.c
592		-+++ linux-3.16.48/net/ipv4/raw.c
	591	+--- linux-3.16.49.orig/net/ipv4/raw.c
	592	++++ linux-3.16.49/net/ipv4/raw.c
593	593	@@ -706,6 +706,10 @@ static int raw_recvmsg(struct kiocb *ioc
594	594	skb = skb_recv_datagram(sk, flags, noblock, &err);
595	595	if (!skb)

		@@ -601,8 +601,8 @@
601	601
602	602	copied = skb->len;
603	603	if (len < copied) {
604		---- linux-3.16.48.orig/net/ipv4/udp.c
605		-+++ linux-3.16.48/net/ipv4/udp.c
	604	+--- linux-3.16.49.orig/net/ipv4/udp.c
	605	++++ linux-3.16.49/net/ipv4/udp.c
606	606	@@ -1285,6 +1285,10 @@ try_again:
607	607	&peeked, &off, &err);
608	608	if (!skb)

		@@ -614,8 +614,8 @@
614	614
615	615	ulen = skb->len - sizeof(struct udphdr);
616	616	copied = len;
617		---- linux-3.16.48.orig/net/ipv6/raw.c
618		-+++ linux-3.16.48/net/ipv6/raw.c
	617	+--- linux-3.16.49.orig/net/ipv6/raw.c
	618	++++ linux-3.16.49/net/ipv6/raw.c
619	619	@@ -478,6 +478,10 @@ static int rawv6_recvmsg(struct kiocb *i
620	620	skb = skb_recv_datagram(sk, flags, noblock, &err);
621	621	if (!skb)

		@@ -627,8 +627,8 @@
627	627
628	628	copied = skb->len;
629	629	if (copied > len) {
630		---- linux-3.16.48.orig/net/ipv6/udp.c
631		-+++ linux-3.16.48/net/ipv6/udp.c
	630	+--- linux-3.16.49.orig/net/ipv6/udp.c
	631	++++ linux-3.16.49/net/ipv6/udp.c
632	632	@@ -404,6 +404,10 @@ try_again:
633	633	&peeked, &off, &err);
634	634	if (!skb)

		@@ -640,8 +640,8 @@
640	640
641	641	ulen = skb->len - sizeof(struct udphdr);
642	642	copied = len;
643		---- linux-3.16.48.orig/net/socket.c
644		-+++ linux-3.16.48/net/socket.c
	643	+--- linux-3.16.49.orig/net/socket.c
	644	++++ linux-3.16.49/net/socket.c
645	645	@@ -1631,6 +1631,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
646	646	if (err < 0)
647	647	goto out_fd;

		@@ -653,8 +653,8 @@
653	653	if (upeer_sockaddr) {
654	654	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
655	655	&len, 2) < 0) {
656		---- linux-3.16.48.orig/net/unix/af_unix.c
657		-+++ linux-3.16.48/net/unix/af_unix.c
	656	+--- linux-3.16.49.orig/net/unix/af_unix.c
	657	++++ linux-3.16.49/net/unix/af_unix.c
658	658	@@ -1981,6 +1981,10 @@ static int unix_dgram_recvmsg(struct kio
659	659	wake_up_interruptible_sync_poll(&u->peer_wait,
660	660	POLLOUT \| POLLWRNORM \| POLLWRBAND);

		@@ -666,8 +666,8 @@
666	666	if (msg->msg_name)
667	667	unix_copy_addr(msg, skb->sk);
668	668
669		---- linux-3.16.48.orig/security/Kconfig
670		-+++ linux-3.16.48/security/Kconfig
	669	+--- linux-3.16.49.orig/security/Kconfig
	670	++++ linux-3.16.49/security/Kconfig
671	671	@@ -167,5 +167,7 @@ config DEFAULT_SECURITY
672	672	default "yama" if DEFAULT_SECURITY_YAMA
673	673	default "" if DEFAULT_SECURITY_DAC

		@@ -676,8 +676,8 @@
676	676	+
677	677	endmenu
678	678
679		---- linux-3.16.48.orig/security/Makefile
680		-+++ linux-3.16.48/security/Makefile
	679	+--- linux-3.16.49.orig/security/Makefile
	680	++++ linux-3.16.49/security/Makefile
681	681	@@ -27,3 +27,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
682	682	# Object integrity file lists
683	683	subdir-$(CONFIG_INTEGRITY) += integrity

		@@ -685,8 +685,8 @@
685	685	+
686	686	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
687	687	+obj-$(CONFIG_CCSECURITY) += ccsecurity/
688		---- linux-3.16.48.orig/security/security.c
689		-+++ linux-3.16.48/security/security.c
	688	+--- linux-3.16.49.orig/security/security.c
	689	++++ linux-3.16.49/security/security.c
690	690	@@ -203,7 +203,10 @@ int security_syslog(int type)
691	691
692	692	int security_settime(const struct timespec ts, const struct timezone tz)

--- trunk/caitsith-patch/patches/ccs-patch-3.18.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-3.18.diff (revision 250)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 3.18.71.
	1	+This is TOMOYO Linux patch for kernel 3.18.79.
2	2
3		-Source code for this patch is https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.18.71.tar.xz
	3	+Source code for this patch is https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.18.79.tar.xz
4	4	---
5	5	fs/exec.c \| 2
6	6	fs/open.c \| 2

		@@ -29,8 +29,8 @@
29	29	security/security.c \| 111 +++++++++++++++++++++++++++++++++++++++++-----
30	30	25 files changed, 252 insertions(+), 37 deletions(-)
31	31
32		---- linux-3.18.71.orig/fs/exec.c
33		-+++ linux-3.18.71/fs/exec.c
	32	+--- linux-3.18.79.orig/fs/exec.c
	33	++++ linux-3.18.79/fs/exec.c
34	34	@@ -1463,7 +1463,7 @@ static int exec_binprm(struct linux_binp
35	35	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
36	36	rcu_read_unlock();

		@@ -40,8 +40,8 @@
40	40	if (ret >= 0) {
41	41	audit_bprm(bprm);
42	42	trace_sched_process_exec(current, old_pid, bprm);
43		---- linux-3.18.71.orig/fs/open.c
44		-+++ linux-3.18.71/fs/open.c
	43	+--- linux-3.18.79.orig/fs/open.c
	44	++++ linux-3.18.79/fs/open.c
45	45	@@ -1091,6 +1091,8 @@ EXPORT_SYMBOL(sys_close);
46	46	*/
47	47	SYSCALL_DEFINE0(vhangup)

		@@ -51,8 +51,8 @@
51	51	if (capable(CAP_SYS_TTY_CONFIG)) {
52	52	tty_vhangup_self();
53	53	return 0;
54		---- linux-3.18.71.orig/fs/proc/version.c
55		-+++ linux-3.18.71/fs/proc/version.c
	54	+--- linux-3.18.79.orig/fs/proc/version.c
	55	++++ linux-3.18.79/fs/proc/version.c
56	56	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
57	57	return 0;
58	58	}

		@@ -60,12 +60,12 @@
60	60	+
61	61	+static int __init ccs_show_version(void)
62	62	+{
63		-+ printk(KERN_INFO "Hook version: 3.18.71 2017/09/14\n");
	63	++ printk(KERN_INFO "Hook version: 3.18.79 2017/11/04\n");
64	64	+ return 0;
65	65	+}
66	66	+fs_initcall(ccs_show_version);
67		---- linux-3.18.71.orig/include/linux/init_task.h
68		-+++ linux-3.18.71/include/linux/init_task.h
	67	+--- linux-3.18.79.orig/include/linux/init_task.h
	68	++++ linux-3.18.79/include/linux/init_task.h
69	69	@@ -166,6 +166,14 @@ extern struct task_group root_task_group
70	70	# define INIT_RT_MUTEXES(tsk)
71	71	#endif

		@@ -89,8 +89,8 @@
89	89	}
90	90
91	91
92		---- linux-3.18.71.orig/include/linux/sched.h
93		-+++ linux-3.18.71/include/linux/sched.h
	92	+--- linux-3.18.79.orig/include/linux/sched.h
	93	++++ linux-3.18.79/include/linux/sched.h
94	94	@@ -6,6 +6,8 @@
95	95	#include <linux/sched/prio.h>
96	96

		@@ -111,8 +111,8 @@
111	111	};
112	112
113	113	/* Future-safe accessor for struct task_struct's cpus_allowed. */
114		---- linux-3.18.71.orig/include/linux/security.h
115		-+++ linux-3.18.71/include/linux/security.h
	114	+--- linux-3.18.79.orig/include/linux/security.h
	115	++++ linux-3.18.79/include/linux/security.h
116	116	@@ -53,6 +53,7 @@ struct msg_queue;
117	117	struct xattr;
118	118	struct xfrm_sec_ctx;

		@@ -324,8 +324,8 @@
324	324	}
325	325	#endif /* CONFIG_SECURITY_PATH */
326	326
327		---- linux-3.18.71.orig/include/net/ip.h
328		-+++ linux-3.18.71/include/net/ip.h
	327	+--- linux-3.18.79.orig/include/net/ip.h
	328	++++ linux-3.18.79/include/net/ip.h
329	329	@@ -216,6 +216,8 @@ void inet_get_local_port_range(struct ne
330	330	#ifdef CONFIG_SYSCTL
331	331	static inline int inet_is_local_reserved_port(struct net *net, int port)

		@@ -344,8 +344,8 @@
344	344	return 0;
345	345	}
346	346	#endif
347		---- linux-3.18.71.orig/kernel/fork.c
348		-+++ linux-3.18.71/kernel/fork.c
	347	+--- linux-3.18.79.orig/kernel/fork.c
	348	++++ linux-3.18.79/kernel/fork.c
349	349	@@ -246,6 +246,7 @@ void __put_task_struct(struct task_struc
350	350	delayacct_tsk_free(tsk);
351	351	put_signal_struct(tsk->signal);

		@@ -372,8 +372,8 @@
372	372	bad_fork_cleanup_perf:
373	373	perf_event_free_task(p);
374	374	bad_fork_cleanup_policy:
375		---- linux-3.18.71.orig/kernel/kexec.c
376		-+++ linux-3.18.71/kernel/kexec.c
	375	+--- linux-3.18.79.orig/kernel/kexec.c
	376	++++ linux-3.18.79/kernel/kexec.c
377	377	@@ -41,6 +41,7 @@
378	378	#include <asm/uaccess.h>
379	379	#include <asm/io.h>

		@@ -391,8 +391,8 @@
391	391
392	392	/*
393	393	* Verify we have a legal set of flags
394		---- linux-3.18.71.orig/kernel/module.c
395		-+++ linux-3.18.71/kernel/module.c
	394	+--- linux-3.18.79.orig/kernel/module.c
	395	++++ linux-3.18.79/kernel/module.c
396	396	@@ -62,6 +62,7 @@
397	397	#include <linux/bsearch.h>
398	398	#include <uapi/linux/module.h>

		@@ -419,8 +419,8 @@
419	419
420	420	return 0;
421	421	}
422		---- linux-3.18.71.orig/kernel/ptrace.c
423		-+++ linux-3.18.71/kernel/ptrace.c
	422	+--- linux-3.18.79.orig/kernel/ptrace.c
	423	++++ linux-3.18.79/kernel/ptrace.c
424	424	@@ -1081,6 +1081,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
425	425	{
426	426	struct task_struct *child;

		@@ -445,8 +445,8 @@
445	445
446	446	if (request == PTRACE_TRACEME) {
447	447	ret = ptrace_traceme();
448		---- linux-3.18.71.orig/kernel/reboot.c
449		-+++ linux-3.18.71/kernel/reboot.c
	448	+--- linux-3.18.79.orig/kernel/reboot.c
	449	++++ linux-3.18.79/kernel/reboot.c
450	450	@@ -16,6 +16,7 @@
451	451	#include <linux/syscalls.h>
452	452	#include <linux/syscore_ops.h>

		@@ -464,8 +464,8 @@
464	464
465	465	/*
466	466	* If pid namespaces are enabled and the current task is in a child
467		---- linux-3.18.71.orig/kernel/sched/core.c
468		-+++ linux-3.18.71/kernel/sched/core.c
	467	+--- linux-3.18.79.orig/kernel/sched/core.c
	468	++++ linux-3.18.79/kernel/sched/core.c
469	469	@@ -3218,6 +3218,8 @@ int can_nice(const struct task_struct *p
470	470	SYSCALL_DEFINE1(nice, int, increment)
471	471	{

		@@ -475,8 +475,8 @@
475	475
476	476	/*
477	477	* Setpriority might change our priority at the same moment.
478		---- linux-3.18.71.orig/kernel/signal.c
479		-+++ linux-3.18.71/kernel/signal.c
	478	+--- linux-3.18.79.orig/kernel/signal.c
	479	++++ linux-3.18.79/kernel/signal.c
480	480	@@ -2895,6 +2895,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
481	481	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
482	482	{

		@@ -522,8 +522,8 @@
522	522
523	523	return do_send_specific(tgid, pid, sig, info);
524	524	}
525		---- linux-3.18.71.orig/kernel/sys.c
526		-+++ linux-3.18.71/kernel/sys.c
	525	+--- linux-3.18.79.orig/kernel/sys.c
	526	++++ linux-3.18.79/kernel/sys.c
527	527	@@ -171,6 +171,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
528	528
529	529	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -553,8 +553,8 @@
553	553
554	554	down_write(&uts_sem);
555	555	errno = -EFAULT;
556		---- linux-3.18.71.orig/kernel/time/ntp.c
557		-+++ linux-3.18.71/kernel/time/ntp.c
	556	+--- linux-3.18.79.orig/kernel/time/ntp.c
	557	++++ linux-3.18.79/kernel/time/ntp.c
558	558	@@ -16,6 +16,7 @@
559	559	#include <linux/mm.h>
560	560	#include <linux/module.h>

		@@ -588,8 +588,8 @@
588	588
589	589	/*
590	590	* Check for potential multiplication overflows that can
591		---- linux-3.18.71.orig/net/ipv4/raw.c
592		-+++ linux-3.18.71/net/ipv4/raw.c
	591	+--- linux-3.18.79.orig/net/ipv4/raw.c
	592	++++ linux-3.18.79/net/ipv4/raw.c
593	593	@@ -714,6 +714,10 @@ static int raw_recvmsg(struct kiocb *ioc
594	594	skb = skb_recv_datagram(sk, flags, noblock, &err);
595	595	if (!skb)

		@@ -601,8 +601,8 @@
601	601
602	602	copied = skb->len;
603	603	if (len < copied) {
604		---- linux-3.18.71.orig/net/ipv4/udp.c
605		-+++ linux-3.18.71/net/ipv4/udp.c
	604	+--- linux-3.18.79.orig/net/ipv4/udp.c
	605	++++ linux-3.18.79/net/ipv4/udp.c
606	606	@@ -1263,6 +1263,10 @@ try_again:
607	607	&peeked, &off, &err);
608	608	if (!skb)

		@@ -614,8 +614,8 @@
614	614
615	615	ulen = skb->len - sizeof(struct udphdr);
616	616	copied = len;
617		---- linux-3.18.71.orig/net/ipv6/raw.c
618		-+++ linux-3.18.71/net/ipv6/raw.c
	617	+--- linux-3.18.79.orig/net/ipv6/raw.c
	618	++++ linux-3.18.79/net/ipv6/raw.c
619	619	@@ -478,6 +478,10 @@ static int rawv6_recvmsg(struct kiocb *i
620	620	skb = skb_recv_datagram(sk, flags, noblock, &err);
621	621	if (!skb)

		@@ -627,8 +627,8 @@
627	627
628	628	copied = skb->len;
629	629	if (copied > len) {
630		---- linux-3.18.71.orig/net/ipv6/udp.c
631		-+++ linux-3.18.71/net/ipv6/udp.c
	630	+--- linux-3.18.79.orig/net/ipv6/udp.c
	631	++++ linux-3.18.79/net/ipv6/udp.c
632	632	@@ -403,6 +403,10 @@ try_again:
633	633	&peeked, &off, &err);
634	634	if (!skb)

		@@ -640,8 +640,8 @@
640	640
641	641	ulen = skb->len - sizeof(struct udphdr);
642	642	copied = len;
643		---- linux-3.18.71.orig/net/socket.c
644		-+++ linux-3.18.71/net/socket.c
	643	+--- linux-3.18.79.orig/net/socket.c
	644	++++ linux-3.18.79/net/socket.c
645	645	@@ -1637,6 +1637,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
646	646	if (err < 0)
647	647	goto out_fd;

		@@ -653,8 +653,8 @@
653	653	if (upeer_sockaddr) {
654	654	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
655	655	&len, 2) < 0) {
656		---- linux-3.18.71.orig/net/unix/af_unix.c
657		-+++ linux-3.18.71/net/unix/af_unix.c
	656	+--- linux-3.18.79.orig/net/unix/af_unix.c
	657	++++ linux-3.18.79/net/unix/af_unix.c
658	658	@@ -1981,6 +1981,10 @@ static int unix_dgram_recvmsg(struct kio
659	659	wake_up_interruptible_sync_poll(&u->peer_wait,
660	660	POLLOUT \| POLLWRNORM \| POLLWRBAND);

		@@ -666,8 +666,8 @@
666	666	if (msg->msg_name)
667	667	unix_copy_addr(msg, skb->sk);
668	668
669		---- linux-3.18.71.orig/security/Kconfig
670		-+++ linux-3.18.71/security/Kconfig
	669	+--- linux-3.18.79.orig/security/Kconfig
	670	++++ linux-3.18.79/security/Kconfig
671	671	@@ -167,5 +167,7 @@ config DEFAULT_SECURITY
672	672	default "yama" if DEFAULT_SECURITY_YAMA
673	673	default "" if DEFAULT_SECURITY_DAC

		@@ -676,8 +676,8 @@
676	676	+
677	677	endmenu
678	678
679		---- linux-3.18.71.orig/security/Makefile
680		-+++ linux-3.18.71/security/Makefile
	679	+--- linux-3.18.79.orig/security/Makefile
	680	++++ linux-3.18.79/security/Makefile
681	681	@@ -27,3 +27,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
682	682	# Object integrity file lists
683	683	subdir-$(CONFIG_INTEGRITY) += integrity

		@@ -685,8 +685,8 @@
685	685	+
686	686	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
687	687	+obj-$(CONFIG_CCSECURITY) += ccsecurity/
688		---- linux-3.18.71.orig/security/security.c
689		-+++ linux-3.18.71/security/security.c
	688	+--- linux-3.18.79.orig/security/security.c
	689	++++ linux-3.18.79/security/security.c
690	690	@@ -203,7 +203,10 @@ int security_syslog(int type)
691	691
692	692	int security_settime(const struct timespec ts, const struct timezone tz)

--- trunk/caitsith-patch/patches/ccs-patch-3.2-debian-wheezy.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-3.2-debian-wheezy.diff (revision 250)

		@@ -28,9 +28,9 @@
28	28	security/security.c \| 134 +++++++++++++++++++++++++++++++++++++---------
29	29	24 files changed, 247 insertions(+), 49 deletions(-)
30	30
31		---- linux-3.2.89-2.orig/fs/exec.c
32		-+++ linux-3.2.89-2/fs/exec.c
33		-@@ -1572,7 +1572,7 @@ static int do_execve_common(const char *
	31	+--- linux-3.2.93-1.orig/fs/exec.c
	32	++++ linux-3.2.93-1/fs/exec.c
	33	+@@ -1592,7 +1592,7 @@ static int do_execve_common(const char *
34	34	if (retval < 0)
35	35	goto out;
36	36

		@@ -39,8 +39,8 @@
39	39	if (retval < 0)
40	40	goto out;
41	41
42		---- linux-3.2.89-2.orig/fs/open.c
43		-+++ linux-3.2.89-2/fs/open.c
	42	+--- linux-3.2.93-1.orig/fs/open.c
	43	++++ linux-3.2.93-1/fs/open.c
44	44	@@ -1106,6 +1106,8 @@ EXPORT_SYMBOL(sys_close);
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-3.2.89-2.orig/fs/proc/version.c
54		-+++ linux-3.2.89-2/fs/proc/version.c
	53	+--- linux-3.2.93-1.orig/fs/proc/version.c
	54	++++ linux-3.2.93-1/fs/proc/version.c
55	55	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 3.2.89-2 2017/08/05\n");
	62	++ printk(KERN_INFO "Hook version: 3.2.93-1 2017/09/25\n");
63	63	+ return 0;
64	64	+}
65	65	+module_init(ccs_show_version);
66		---- linux-3.2.89-2.orig/include/linux/init_task.h
67		-+++ linux-3.2.89-2/include/linux/init_task.h
	66	+--- linux-3.2.93-1.orig/include/linux/init_task.h
	67	++++ linux-3.2.93-1/include/linux/init_task.h
68	68	@@ -144,6 +144,14 @@ extern struct task_group root_task_group
69	69
70	70	#define INIT_TASK_COMM "swapper"

		@@ -88,8 +88,8 @@
88	88	}
89	89
90	90
91		---- linux-3.2.89-2.orig/include/linux/sched.h
92		-+++ linux-3.2.89-2/include/linux/sched.h
	91	+--- linux-3.2.93-1.orig/include/linux/sched.h
	92	++++ linux-3.2.93-1/include/linux/sched.h
93	93	@@ -44,6 +44,8 @@
94	94
95	95	#ifdef __KERNEL__

		@@ -110,8 +110,8 @@
110	110	};
111	111
112	112	/* Future-safe accessor for struct task_struct's cpus_allowed. */
113		---- linux-3.2.89-2.orig/include/linux/security.h
114		-+++ linux-3.2.89-2/include/linux/security.h
	113	+--- linux-3.2.93-1.orig/include/linux/security.h
	114	++++ linux-3.2.93-1/include/linux/security.h
115	115	@@ -38,6 +38,7 @@
116	116	#include <linux/slab.h>
117	117	#include <linux/xattr.h>

		@@ -310,8 +310,8 @@
310	310	}
311	311	#endif /* CONFIG_SECURITY_PATH */
312	312
313		---- linux-3.2.89-2.orig/include/net/ip.h
314		-+++ linux-3.2.89-2/include/net/ip.h
	313	+--- linux-3.2.93-1.orig/include/net/ip.h
	314	++++ linux-3.2.93-1/include/net/ip.h
315	315	@@ -218,6 +218,8 @@ extern void inet_get_local_port_range(in
316	316	extern unsigned long *sysctl_local_reserved_ports;
317	317	static inline int inet_is_reserved_local_port(int port)

		@@ -321,8 +321,8 @@
321	321	return test_bit(port, sysctl_local_reserved_ports);
322	322	}
323	323
324		---- linux-3.2.89-2.orig/kernel/fork.c
325		-+++ linux-3.2.89-2/kernel/fork.c
	324	+--- linux-3.2.93-1.orig/kernel/fork.c
	325	++++ linux-3.2.93-1/kernel/fork.c
326	326	@@ -195,6 +195,7 @@ void __put_task_struct(struct task_struc
327	327	delayacct_tsk_free(tsk);
328	328	put_signal_struct(tsk->signal);

		@@ -349,8 +349,8 @@
349	349	bad_fork_cleanup_perf:
350	350	perf_event_free_task(p);
351	351	bad_fork_cleanup_policy:
352		---- linux-3.2.89-2.orig/kernel/kexec.c
353		-+++ linux-3.2.89-2/kernel/kexec.c
	352	+--- linux-3.2.93-1.orig/kernel/kexec.c
	353	++++ linux-3.2.93-1/kernel/kexec.c
354	354	@@ -39,6 +39,7 @@
355	355	#include <asm/io.h>
356	356	#include <asm/system.h>

		@@ -368,8 +368,8 @@
368	368
369	369	/*
370	370	* Verify we have a legal set of flags
371		---- linux-3.2.89-2.orig/kernel/module.c
372		-+++ linux-3.2.89-2/kernel/module.c
	371	+--- linux-3.2.93-1.orig/kernel/module.c
	372	++++ linux-3.2.93-1/kernel/module.c
373	373	@@ -58,6 +58,7 @@
374	374	#include <linux/jump_label.h>
375	375	#include <linux/pfn.h>

		@@ -396,9 +396,9 @@
396	396
397	397	/* Do all the hard work */
398	398	mod = load_module(umod, len, uargs);
399		---- linux-3.2.89-2.orig/kernel/ptrace.c
400		-+++ linux-3.2.89-2/kernel/ptrace.c
401		-@@ -928,6 +928,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
	399	+--- linux-3.2.93-1.orig/kernel/ptrace.c
	400	++++ linux-3.2.93-1/kernel/ptrace.c
	401	+@@ -961,6 +961,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
402	402	{
403	403	struct task_struct *child;
404	404	long ret;

		@@ -410,7 +410,7 @@
410	410
411	411	if (request == PTRACE_TRACEME) {
412	412	ret = ptrace_traceme();
413		-@@ -1075,6 +1080,11 @@ asmlinkage long compat_sys_ptrace(compat
	413	+@@ -1108,6 +1113,11 @@ asmlinkage long compat_sys_ptrace(compat
414	414	{
415	415	struct task_struct *child;
416	416	long ret;

		@@ -422,8 +422,8 @@
422	422
423	423	if (request == PTRACE_TRACEME) {
424	424	ret = ptrace_traceme();
425		---- linux-3.2.89-2.orig/kernel/sched.c
426		-+++ linux-3.2.89-2/kernel/sched.c
	425	+--- linux-3.2.93-1.orig/kernel/sched.c
	426	++++ linux-3.2.93-1/kernel/sched.c
427	427	@@ -5342,6 +5342,8 @@ int can_nice(const struct task_struct *p
428	428	SYSCALL_DEFINE1(nice, int, increment)
429	429	{

		@@ -433,9 +433,9 @@
433	433
434	434	/*
435	435	* Setpriority might change our priority at the same moment.
436		---- linux-3.2.89-2.orig/kernel/signal.c
437		-+++ linux-3.2.89-2/kernel/signal.c
438		-@@ -2748,6 +2748,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
	436	+--- linux-3.2.93-1.orig/kernel/signal.c
	437	++++ linux-3.2.93-1/kernel/signal.c
	438	+@@ -2756,6 +2756,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
439	439	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
440	440	{
441	441	struct siginfo info;

		@@ -444,7 +444,7 @@
444	444
445	445	info.si_signo = sig;
446	446	info.si_errno = 0;
447		-@@ -2816,6 +2818,8 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
	447	+@@ -2824,6 +2826,8 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
448	448	/* This is only valid for single tasks */
449	449	if (pid <= 0 \|\| tgid <= 0)
450	450	return -EINVAL;

		@@ -453,7 +453,7 @@
453	453
454	454	return do_tkill(tgid, pid, sig);
455	455	}
456		-@@ -2832,6 +2836,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int,
	456	+@@ -2840,6 +2844,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int,
457	457	/* This is only valid for single tasks */
458	458	if (pid <= 0)
459	459	return -EINVAL;

		@@ -462,7 +462,7 @@
462	462
463	463	return do_tkill(0, pid, sig);
464	464	}
465		-@@ -2859,6 +2865,8 @@ SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t,
	465	+@@ -2867,6 +2873,8 @@ SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t,
466	466	return -EPERM;
467	467	}
468	468	info.si_signo = sig;

		@@ -471,7 +471,7 @@
471	471
472	472	/* POSIX.1b doesn't mention process groups. */
473	473	return kill_proc_info(sig, &info, pid);
474		-@@ -2879,6 +2887,8 @@ long do_rt_tgsigqueueinfo(pid_t tgid, pi
	474	+@@ -2887,6 +2895,8 @@ long do_rt_tgsigqueueinfo(pid_t tgid, pi
475	475	return -EPERM;
476	476	}
477	477	info->si_signo = sig;

		@@ -480,8 +480,8 @@
480	480
481	481	return do_send_specific(tgid, pid, sig, info);
482	482	}
483		---- linux-3.2.89-2.orig/kernel/sys.c
484		-+++ linux-3.2.89-2/kernel/sys.c
	483	+--- linux-3.2.93-1.orig/kernel/sys.c
	484	++++ linux-3.2.93-1/kernel/sys.c
485	485	@@ -180,6 +180,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
486	486
487	487	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -520,8 +520,8 @@
520	520
521	521	down_write(&uts_sem);
522	522	errno = -EFAULT;
523		---- linux-3.2.89-2.orig/kernel/time/ntp.c
524		-+++ linux-3.2.89-2/kernel/time/ntp.c
	523	+--- linux-3.2.93-1.orig/kernel/time/ntp.c
	524	++++ linux-3.2.93-1/kernel/time/ntp.c
525	525	@@ -15,6 +15,7 @@
526	526	#include <linux/time.h>
527	527	#include <linux/mm.h>

		@@ -555,8 +555,8 @@
555	555	if (!(txc->modes & ADJ_NANO))
556	556	delta.tv_nsec *= 1000;
557	557	result = timekeeping_inject_offset(&delta);
558		---- linux-3.2.89-2.orig/net/ipv4/raw.c
559		-+++ linux-3.2.89-2/net/ipv4/raw.c
	558	+--- linux-3.2.93-1.orig/net/ipv4/raw.c
	559	++++ linux-3.2.93-1/net/ipv4/raw.c
560	560	@@ -699,6 +699,10 @@ static int raw_recvmsg(struct kiocb *ioc
561	561	skb = skb_recv_datagram(sk, flags, noblock, &err);
562	562	if (!skb)

		@@ -568,8 +568,8 @@
568	568
569	569	copied = skb->len;
570	570	if (len < copied) {
571		---- linux-3.2.89-2.orig/net/ipv4/udp.c
572		-+++ linux-3.2.89-2/net/ipv4/udp.c
	571	+--- linux-3.2.93-1.orig/net/ipv4/udp.c
	572	++++ linux-3.2.93-1/net/ipv4/udp.c
573	573	@@ -1185,6 +1185,10 @@ try_again:
574	574	&peeked, &err);
575	575	if (!skb)

		@@ -581,8 +581,8 @@
581	581
582	582	ulen = skb->len - sizeof(struct udphdr);
583	583	copied = len;
584		---- linux-3.2.89-2.orig/net/ipv6/raw.c
585		-+++ linux-3.2.89-2/net/ipv6/raw.c
	584	+--- linux-3.2.93-1.orig/net/ipv6/raw.c
	585	++++ linux-3.2.93-1/net/ipv6/raw.c
586	586	@@ -465,6 +465,10 @@ static int rawv6_recvmsg(struct kiocb *i
587	587	skb = skb_recv_datagram(sk, flags, noblock, &err);
588	588	if (!skb)

		@@ -594,8 +594,8 @@
594	594
595	595	copied = skb->len;
596	596	if (copied > len) {
597		---- linux-3.2.89-2.orig/net/ipv6/udp.c
598		-+++ linux-3.2.89-2/net/ipv6/udp.c
	597	+--- linux-3.2.93-1.orig/net/ipv6/udp.c
	598	++++ linux-3.2.93-1/net/ipv6/udp.c
599	599	@@ -359,6 +359,10 @@ try_again:
600	600	&peeked, &err);
601	601	if (!skb)

		@@ -607,8 +607,8 @@
607	607
608	608	ulen = skb->len - sizeof(struct udphdr);
609	609	copied = len;
610		---- linux-3.2.89-2.orig/net/socket.c
611		-+++ linux-3.2.89-2/net/socket.c
	610	+--- linux-3.2.93-1.orig/net/socket.c
	611	++++ linux-3.2.93-1/net/socket.c
612	612	@@ -1531,6 +1531,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
613	613	if (err < 0)
614	614	goto out_fd;

		@@ -620,8 +620,8 @@
620	620	if (upeer_sockaddr) {
621	621	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
622	622	&len, 2) < 0) {
623		---- linux-3.2.89-2.orig/net/unix/af_unix.c
624		-+++ linux-3.2.89-2/net/unix/af_unix.c
	623	+--- linux-3.2.93-1.orig/net/unix/af_unix.c
	624	++++ linux-3.2.93-1/net/unix/af_unix.c
625	625	@@ -1957,6 +1957,10 @@ static int unix_dgram_recvmsg(struct kio
626	626	wake_up_interruptible_sync_poll(&u->peer_wait,
627	627	POLLOUT \| POLLWRNORM \| POLLWRBAND);

		@@ -633,8 +633,8 @@
633	633	if (msg->msg_name)
634	634	unix_copy_addr(msg, skb->sk);
635	635
636		---- linux-3.2.89-2.orig/security/Kconfig
637		-+++ linux-3.2.89-2/security/Kconfig
	636	+--- linux-3.2.93-1.orig/security/Kconfig
	637	++++ linux-3.2.93-1/security/Kconfig
638	638	@@ -236,5 +236,7 @@ config DEFAULT_SECURITY
639	639	default "apparmor" if DEFAULT_SECURITY_APPARMOR
640	640	default "" if DEFAULT_SECURITY_DAC

		@@ -643,8 +643,8 @@
643	643	+
644	644	endmenu
645	645
646		---- linux-3.2.89-2.orig/security/Makefile
647		-+++ linux-3.2.89-2/security/Makefile
	646	+--- linux-3.2.93-1.orig/security/Makefile
	647	++++ linux-3.2.93-1/security/Makefile
648	648	@@ -26,3 +26,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
649	649	# Object integrity file lists
650	650	subdir-$(CONFIG_INTEGRITY) += integrity

		@@ -652,8 +652,8 @@
652	652	+
653	653	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
654	654	+obj-$(CONFIG_CCSECURITY) += ccsecurity/built-in.o
655		---- linux-3.2.89-2.orig/security/security.c
656		-+++ linux-3.2.89-2/security/security.c
	655	+--- linux-3.2.93-1.orig/security/security.c
	656	++++ linux-3.2.93-1/security/security.c
657	657	@@ -203,7 +203,10 @@ int security_syslog(int type)
658	658
659	659	int security_settime(const struct timespec ts, const struct timezone tz)

--- trunk/caitsith-patch/patches/ccs-patch-3.2.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-3.2.diff (revision 250)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 3.2.93.
	1	+This is TOMOYO Linux patch for kernel 3.2.94.
2	2
3		-Source code for this patch is https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.2.93.tar.xz
	3	+Source code for this patch is https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.2.94.tar.xz
4	4	---
5	5	fs/exec.c \| 2
6	6	fs/open.c \| 2

		@@ -28,8 +28,8 @@
28	28	security/security.c \| 134 +++++++++++++++++++++++++++++++++++++---------
29	29	24 files changed, 247 insertions(+), 49 deletions(-)
30	30
31		---- linux-3.2.93.orig/fs/exec.c
32		-+++ linux-3.2.93/fs/exec.c
	31	+--- linux-3.2.94.orig/fs/exec.c
	32	++++ linux-3.2.94/fs/exec.c
33	33	@@ -1592,7 +1592,7 @@ static int do_execve_common(const char *
34	34	if (retval < 0)
35	35	goto out;

		@@ -39,8 +39,8 @@
39	39	if (retval < 0)
40	40	goto out;
41	41
42		---- linux-3.2.93.orig/fs/open.c
43		-+++ linux-3.2.93/fs/open.c
	42	+--- linux-3.2.94.orig/fs/open.c
	43	++++ linux-3.2.94/fs/open.c
44	44	@@ -1105,6 +1105,8 @@ EXPORT_SYMBOL(sys_close);
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-3.2.93.orig/fs/proc/version.c
54		-+++ linux-3.2.93/fs/proc/version.c
	53	+--- linux-3.2.94.orig/fs/proc/version.c
	54	++++ linux-3.2.94/fs/proc/version.c
55	55	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 3.2.93 2017/09/17\n");
	62	++ printk(KERN_INFO "Hook version: 3.2.94 2017/10/16\n");
63	63	+ return 0;
64	64	+}
65	65	+module_init(ccs_show_version);
66		---- linux-3.2.93.orig/include/linux/init_task.h
67		-+++ linux-3.2.93/include/linux/init_task.h
	66	+--- linux-3.2.94.orig/include/linux/init_task.h
	67	++++ linux-3.2.94/include/linux/init_task.h
68	68	@@ -144,6 +144,14 @@ extern struct task_group root_task_group
69	69
70	70	#define INIT_TASK_COMM "swapper"

		@@ -88,8 +88,8 @@
88	88	}
89	89
90	90
91		---- linux-3.2.93.orig/include/linux/sched.h
92		-+++ linux-3.2.93/include/linux/sched.h
	91	+--- linux-3.2.94.orig/include/linux/sched.h
	92	++++ linux-3.2.94/include/linux/sched.h
93	93	@@ -44,6 +44,8 @@
94	94
95	95	#ifdef __KERNEL__

		@@ -99,7 +99,7 @@
99	99	struct sched_param {
100	100	int sched_priority;
101	101	};
102		-@@ -1583,6 +1585,10 @@ struct task_struct {
	102	+@@ -1585,6 +1587,10 @@ struct task_struct {
103	103	#ifdef CONFIG_HAVE_HW_BREAKPOINT
104	104	atomic_t ptrace_bp_refcnt;
105	105	#endif

		@@ -110,8 +110,8 @@
110	110	};
111	111
112	112	/* Future-safe accessor for struct task_struct's cpus_allowed. */
113		---- linux-3.2.93.orig/include/linux/security.h
114		-+++ linux-3.2.93/include/linux/security.h
	113	+--- linux-3.2.94.orig/include/linux/security.h
	114	++++ linux-3.2.94/include/linux/security.h
115	115	@@ -38,6 +38,7 @@
116	116	#include <linux/slab.h>
117	117	#include <linux/xattr.h>

		@@ -310,8 +310,8 @@
310	310	}
311	311	#endif /* CONFIG_SECURITY_PATH */
312	312
313		---- linux-3.2.93.orig/include/net/ip.h
314		-+++ linux-3.2.93/include/net/ip.h
	313	+--- linux-3.2.94.orig/include/net/ip.h
	314	++++ linux-3.2.94/include/net/ip.h
315	315	@@ -218,6 +218,8 @@ extern void inet_get_local_port_range(in
316	316	extern unsigned long *sysctl_local_reserved_ports;
317	317	static inline int inet_is_reserved_local_port(int port)

		@@ -321,8 +321,8 @@
321	321	return test_bit(port, sysctl_local_reserved_ports);
322	322	}
323	323
324		---- linux-3.2.93.orig/kernel/fork.c
325		-+++ linux-3.2.93/kernel/fork.c
	324	+--- linux-3.2.94.orig/kernel/fork.c
	325	++++ linux-3.2.94/kernel/fork.c
326	326	@@ -195,6 +195,7 @@ void __put_task_struct(struct task_struc
327	327	delayacct_tsk_free(tsk);
328	328	put_signal_struct(tsk->signal);

		@@ -349,8 +349,8 @@
349	349	bad_fork_cleanup_perf:
350	350	perf_event_free_task(p);
351	351	bad_fork_cleanup_policy:
352		---- linux-3.2.93.orig/kernel/kexec.c
353		-+++ linux-3.2.93/kernel/kexec.c
	352	+--- linux-3.2.94.orig/kernel/kexec.c
	353	++++ linux-3.2.94/kernel/kexec.c
354	354	@@ -40,6 +40,7 @@
355	355	#include <asm/io.h>
356	356	#include <asm/system.h>

		@@ -368,8 +368,8 @@
368	368
369	369	/*
370	370	* Verify we have a legal set of flags
371		---- linux-3.2.93.orig/kernel/module.c
372		-+++ linux-3.2.93/kernel/module.c
	371	+--- linux-3.2.94.orig/kernel/module.c
	372	++++ linux-3.2.94/kernel/module.c
373	373	@@ -58,6 +58,7 @@
374	374	#include <linux/jump_label.h>
375	375	#include <linux/pfn.h>

		@@ -396,8 +396,8 @@
396	396
397	397	/* Do all the hard work */
398	398	mod = load_module(umod, len, uargs);
399		---- linux-3.2.93.orig/kernel/ptrace.c
400		-+++ linux-3.2.93/kernel/ptrace.c
	399	+--- linux-3.2.94.orig/kernel/ptrace.c
	400	++++ linux-3.2.94/kernel/ptrace.c
401	401	@@ -957,6 +957,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
402	402	{
403	403	struct task_struct *child;

		@@ -422,8 +422,8 @@
422	422
423	423	if (request == PTRACE_TRACEME) {
424	424	ret = ptrace_traceme();
425		---- linux-3.2.93.orig/kernel/sched.c
426		-+++ linux-3.2.93/kernel/sched.c
	425	+--- linux-3.2.94.orig/kernel/sched.c
	426	++++ linux-3.2.94/kernel/sched.c
427	427	@@ -5342,6 +5342,8 @@ int can_nice(const struct task_struct *p
428	428	SYSCALL_DEFINE1(nice, int, increment)
429	429	{

		@@ -433,8 +433,8 @@
433	433
434	434	/*
435	435	* Setpriority might change our priority at the same moment.
436		---- linux-3.2.93.orig/kernel/signal.c
437		-+++ linux-3.2.93/kernel/signal.c
	436	+--- linux-3.2.94.orig/kernel/signal.c
	437	++++ linux-3.2.94/kernel/signal.c
438	438	@@ -2756,6 +2756,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
439	439	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
440	440	{

		@@ -480,8 +480,8 @@
480	480
481	481	return do_send_specific(tgid, pid, sig, info);
482	482	}
483		---- linux-3.2.93.orig/kernel/sys.c
484		-+++ linux-3.2.93/kernel/sys.c
	483	+--- linux-3.2.94.orig/kernel/sys.c
	484	++++ linux-3.2.94/kernel/sys.c
485	485	@@ -180,6 +180,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
486	486
487	487	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -520,8 +520,8 @@
520	520
521	521	down_write(&uts_sem);
522	522	errno = -EFAULT;
523		---- linux-3.2.93.orig/kernel/time/ntp.c
524		-+++ linux-3.2.93/kernel/time/ntp.c
	523	+--- linux-3.2.94.orig/kernel/time/ntp.c
	524	++++ linux-3.2.94/kernel/time/ntp.c
525	525	@@ -15,6 +15,7 @@
526	526	#include <linux/time.h>
527	527	#include <linux/mm.h>

		@@ -555,8 +555,8 @@
555	555	if (!(txc->modes & ADJ_NANO))
556	556	delta.tv_nsec *= 1000;
557	557	result = timekeeping_inject_offset(&delta);
558		---- linux-3.2.93.orig/net/ipv4/raw.c
559		-+++ linux-3.2.93/net/ipv4/raw.c
	558	+--- linux-3.2.94.orig/net/ipv4/raw.c
	559	++++ linux-3.2.94/net/ipv4/raw.c
560	560	@@ -699,6 +699,10 @@ static int raw_recvmsg(struct kiocb *ioc
561	561	skb = skb_recv_datagram(sk, flags, noblock, &err);
562	562	if (!skb)

		@@ -568,8 +568,8 @@
568	568
569	569	copied = skb->len;
570	570	if (len < copied) {
571		---- linux-3.2.93.orig/net/ipv4/udp.c
572		-+++ linux-3.2.93/net/ipv4/udp.c
	571	+--- linux-3.2.94.orig/net/ipv4/udp.c
	572	++++ linux-3.2.94/net/ipv4/udp.c
573	573	@@ -1185,6 +1185,10 @@ try_again:
574	574	&peeked, &err);
575	575	if (!skb)

		@@ -581,8 +581,8 @@
581	581
582	582	ulen = skb->len - sizeof(struct udphdr);
583	583	copied = len;
584		---- linux-3.2.93.orig/net/ipv6/raw.c
585		-+++ linux-3.2.93/net/ipv6/raw.c
	584	+--- linux-3.2.94.orig/net/ipv6/raw.c
	585	++++ linux-3.2.94/net/ipv6/raw.c
586	586	@@ -465,6 +465,10 @@ static int rawv6_recvmsg(struct kiocb *i
587	587	skb = skb_recv_datagram(sk, flags, noblock, &err);
588	588	if (!skb)

		@@ -594,8 +594,8 @@
594	594
595	595	copied = skb->len;
596	596	if (copied > len) {
597		---- linux-3.2.93.orig/net/ipv6/udp.c
598		-+++ linux-3.2.93/net/ipv6/udp.c
	597	+--- linux-3.2.94.orig/net/ipv6/udp.c
	598	++++ linux-3.2.94/net/ipv6/udp.c
599	599	@@ -359,6 +359,10 @@ try_again:
600	600	&peeked, &err);
601	601	if (!skb)

		@@ -607,8 +607,8 @@
607	607
608	608	ulen = skb->len - sizeof(struct udphdr);
609	609	copied = len;
610		---- linux-3.2.93.orig/net/socket.c
611		-+++ linux-3.2.93/net/socket.c
	610	+--- linux-3.2.94.orig/net/socket.c
	611	++++ linux-3.2.94/net/socket.c
612	612	@@ -1531,6 +1531,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
613	613	if (err < 0)
614	614	goto out_fd;

		@@ -620,8 +620,8 @@
620	620	if (upeer_sockaddr) {
621	621	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
622	622	&len, 2) < 0) {
623		---- linux-3.2.93.orig/net/unix/af_unix.c
624		-+++ linux-3.2.93/net/unix/af_unix.c
	623	+--- linux-3.2.94.orig/net/unix/af_unix.c
	624	++++ linux-3.2.94/net/unix/af_unix.c
625	625	@@ -1957,6 +1957,10 @@ static int unix_dgram_recvmsg(struct kio
626	626	wake_up_interruptible_sync_poll(&u->peer_wait,
627	627	POLLOUT \| POLLWRNORM \| POLLWRBAND);

		@@ -633,8 +633,8 @@
633	633	if (msg->msg_name)
634	634	unix_copy_addr(msg, skb->sk);
635	635
636		---- linux-3.2.93.orig/security/Kconfig
637		-+++ linux-3.2.93/security/Kconfig
	636	+--- linux-3.2.94.orig/security/Kconfig
	637	++++ linux-3.2.94/security/Kconfig
638	638	@@ -227,5 +227,7 @@ config DEFAULT_SECURITY
639	639	default "apparmor" if DEFAULT_SECURITY_APPARMOR
640	640	default "" if DEFAULT_SECURITY_DAC

		@@ -643,8 +643,8 @@
643	643	+
644	644	endmenu
645	645
646		---- linux-3.2.93.orig/security/Makefile
647		-+++ linux-3.2.93/security/Makefile
	646	+--- linux-3.2.94.orig/security/Makefile
	647	++++ linux-3.2.94/security/Makefile
648	648	@@ -26,3 +26,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
649	649	# Object integrity file lists
650	650	subdir-$(CONFIG_INTEGRITY) += integrity

		@@ -652,8 +652,8 @@
652	652	+
653	653	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
654	654	+obj-$(CONFIG_CCSECURITY) += ccsecurity/built-in.o
655		---- linux-3.2.93.orig/security/security.c
656		-+++ linux-3.2.93/security/security.c
	655	+--- linux-3.2.94.orig/security/security.c
	656	++++ linux-3.2.94/security/security.c
657	657	@@ -203,7 +203,10 @@ int security_syslog(int type)
658	658
659	659	int security_settime(const struct timespec ts, const struct timezone tz)

--- trunk/caitsith-patch/patches/ccs-patch-4.1.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-4.1.diff (revision 250)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 4.1.43.
	1	+This is TOMOYO Linux patch for kernel 4.1.45.
2	2
3		-Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.1.43.tar.xz
	3	+Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.1.45.tar.xz
4	4	---
5	5	fs/exec.c \| 2
6	6	fs/open.c \| 2

		@@ -29,8 +29,8 @@
29	29	security/security.c \| 110 ++++++++++++++++++++++++++++++++++++++++------
30	30	25 files changed, 248 insertions(+), 37 deletions(-)
31	31
32		---- linux-4.1.43.orig/fs/exec.c
33		-+++ linux-4.1.43/fs/exec.c
	32	+--- linux-4.1.45.orig/fs/exec.c
	33	++++ linux-4.1.45/fs/exec.c
34	34	@@ -1488,7 +1488,7 @@ static int exec_binprm(struct linux_binp
35	35	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
36	36	rcu_read_unlock();

		@@ -40,8 +40,8 @@
40	40	if (ret >= 0) {
41	41	audit_bprm(bprm);
42	42	trace_sched_process_exec(current, old_pid, bprm);
43		---- linux-4.1.43.orig/fs/open.c
44		-+++ linux-4.1.43/fs/open.c
	43	+--- linux-4.1.45.orig/fs/open.c
	44	++++ linux-4.1.45/fs/open.c
45	45	@@ -1113,6 +1113,8 @@ EXPORT_SYMBOL(sys_close);
46	46	*/
47	47	SYSCALL_DEFINE0(vhangup)

		@@ -51,8 +51,8 @@
51	51	if (capable(CAP_SYS_TTY_CONFIG)) {
52	52	tty_vhangup_self();
53	53	return 0;
54		---- linux-4.1.43.orig/fs/proc/version.c
55		-+++ linux-4.1.43/fs/proc/version.c
	54	+--- linux-4.1.45.orig/fs/proc/version.c
	55	++++ linux-4.1.45/fs/proc/version.c
56	56	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
57	57	return 0;
58	58	}

		@@ -60,12 +60,12 @@
60	60	+
61	61	+static int __init ccs_show_version(void)
62	62	+{
63		-+ printk(KERN_INFO "Hook version: 4.1.43 2017/08/07\n");
	63	++ printk(KERN_INFO "Hook version: 4.1.45 2017/10/23\n");
64	64	+ return 0;
65	65	+}
66	66	+fs_initcall(ccs_show_version);
67		---- linux-4.1.43.orig/include/linux/init_task.h
68		-+++ linux-4.1.43/include/linux/init_task.h
	67	+--- linux-4.1.45.orig/include/linux/init_task.h
	68	++++ linux-4.1.45/include/linux/init_task.h
69	69	@@ -182,6 +182,14 @@ extern struct task_group root_task_group
70	70	# define INIT_KASAN(tsk)
71	71	#endif

		@@ -89,8 +89,8 @@
89	89	}
90	90
91	91
92		---- linux-4.1.43.orig/include/linux/sched.h
93		-+++ linux-4.1.43/include/linux/sched.h
	92	+--- linux-4.1.45.orig/include/linux/sched.h
	93	++++ linux-4.1.45/include/linux/sched.h
94	94	@@ -6,6 +6,8 @@
95	95	#include <linux/sched/prio.h>
96	96

		@@ -100,7 +100,7 @@
100	100	struct sched_param {
101	101	int sched_priority;
102	102	};
103		-@@ -1728,6 +1730,10 @@ struct task_struct {
	103	+@@ -1738,6 +1740,10 @@ struct task_struct {
104	104	#ifdef CONFIG_DEBUG_ATOMIC_SLEEP
105	105	unsigned long task_state_change;
106	106	#endif

		@@ -111,8 +111,8 @@
111	111	};
112	112
113	113	/* Future-safe accessor for struct task_struct's cpus_allowed. */
114		---- linux-4.1.43.orig/include/linux/security.h
115		-+++ linux-4.1.43/include/linux/security.h
	114	+--- linux-4.1.45.orig/include/linux/security.h
	115	++++ linux-4.1.45/include/linux/security.h
116	116	@@ -53,6 +53,7 @@ struct msg_queue;
117	117	struct xattr;
118	118	struct xfrm_sec_ctx;

		@@ -319,8 +319,8 @@
319	319	}
320	320	#endif /* CONFIG_SECURITY_PATH */
321	321
322		---- linux-4.1.43.orig/include/net/ip.h
323		-+++ linux-4.1.43/include/net/ip.h
	322	+--- linux-4.1.45.orig/include/net/ip.h
	323	++++ linux-4.1.45/include/net/ip.h
324	324	@@ -217,6 +217,8 @@ void inet_get_local_port_range(struct ne
325	325	#ifdef CONFIG_SYSCTL
326	326	static inline int inet_is_local_reserved_port(struct net *net, int port)

		@@ -339,8 +339,8 @@
339	339	return 0;
340	340	}
341	341	#endif
342		---- linux-4.1.43.orig/kernel/fork.c
343		-+++ linux-4.1.43/kernel/fork.c
	342	+--- linux-4.1.45.orig/kernel/fork.c
	343	++++ linux-4.1.45/kernel/fork.c
344	344	@@ -257,6 +257,7 @@ void __put_task_struct(struct task_struc
345	345	delayacct_tsk_free(tsk);
346	346	put_signal_struct(tsk->signal);

		@@ -367,8 +367,8 @@
367	367	bad_fork_cleanup_perf:
368	368	perf_event_free_task(p);
369	369	bad_fork_cleanup_policy:
370		---- linux-4.1.43.orig/kernel/kexec.c
371		-+++ linux-4.1.43/kernel/kexec.c
	370	+--- linux-4.1.45.orig/kernel/kexec.c
	371	++++ linux-4.1.45/kernel/kexec.c
372	372	@@ -41,6 +41,7 @@
373	373	#include <asm/uaccess.h>
374	374	#include <asm/io.h>

		@@ -386,8 +386,8 @@
386	386
387	387	/*
388	388	* Verify we have a legal set of flags
389		---- linux-4.1.43.orig/kernel/module.c
390		-+++ linux-4.1.43/kernel/module.c
	389	+--- linux-4.1.45.orig/kernel/module.c
	390	++++ linux-4.1.45/kernel/module.c
391	391	@@ -61,6 +61,7 @@
392	392	#include <linux/bsearch.h>
393	393	#include <uapi/linux/module.h>

		@@ -414,8 +414,8 @@
414	414
415	415	return 0;
416	416	}
417		---- linux-4.1.43.orig/kernel/ptrace.c
418		-+++ linux-4.1.43/kernel/ptrace.c
	417	+--- linux-4.1.45.orig/kernel/ptrace.c
	418	++++ linux-4.1.45/kernel/ptrace.c
419	419	@@ -1095,6 +1095,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
420	420	{
421	421	struct task_struct *child;

		@@ -440,8 +440,8 @@
440	440
441	441	if (request == PTRACE_TRACEME) {
442	442	ret = ptrace_traceme();
443		---- linux-4.1.43.orig/kernel/reboot.c
444		-+++ linux-4.1.43/kernel/reboot.c
	443	+--- linux-4.1.45.orig/kernel/reboot.c
	444	++++ linux-4.1.45/kernel/reboot.c
445	445	@@ -16,6 +16,7 @@
446	446	#include <linux/syscalls.h>
447	447	#include <linux/syscore_ops.h>

		@@ -459,8 +459,8 @@
459	459
460	460	/*
461	461	* If pid namespaces are enabled and the current task is in a child
462		---- linux-4.1.43.orig/kernel/sched/core.c
463		-+++ linux-4.1.43/kernel/sched/core.c
	462	+--- linux-4.1.45.orig/kernel/sched/core.c
	463	++++ linux-4.1.45/kernel/sched/core.c
464	464	@@ -3174,6 +3174,8 @@ int can_nice(const struct task_struct *p
465	465	SYSCALL_DEFINE1(nice, int, increment)
466	466	{

		@@ -470,8 +470,8 @@
470	470
471	471	/*
472	472	* Setpriority might change our priority at the same moment.
473		---- linux-4.1.43.orig/kernel/signal.c
474		-+++ linux-4.1.43/kernel/signal.c
	473	+--- linux-4.1.45.orig/kernel/signal.c
	474	++++ linux-4.1.45/kernel/signal.c
475	475	@@ -2901,6 +2901,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
476	476	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
477	477	{

		@@ -517,8 +517,8 @@
517	517
518	518	return do_send_specific(tgid, pid, sig, info);
519	519	}
520		---- linux-4.1.43.orig/kernel/sys.c
521		-+++ linux-4.1.43/kernel/sys.c
	520	+--- linux-4.1.45.orig/kernel/sys.c
	521	++++ linux-4.1.45/kernel/sys.c
522	522	@@ -183,6 +183,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
523	523
524	524	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -548,8 +548,8 @@
548	548
549	549	down_write(&uts_sem);
550	550	errno = -EFAULT;
551		---- linux-4.1.43.orig/kernel/time/ntp.c
552		-+++ linux-4.1.43/kernel/time/ntp.c
	551	+--- linux-4.1.45.orig/kernel/time/ntp.c
	552	++++ linux-4.1.45/kernel/time/ntp.c
553	553	@@ -16,6 +16,7 @@
554	554	#include <linux/mm.h>
555	555	#include <linux/module.h>

		@@ -583,8 +583,8 @@
583	583
584	584	/*
585	585	* Check for potential multiplication overflows that can
586		---- linux-4.1.43.orig/net/ipv4/raw.c
587		-+++ linux-4.1.43/net/ipv4/raw.c
	586	+--- linux-4.1.45.orig/net/ipv4/raw.c
	587	++++ linux-4.1.45/net/ipv4/raw.c
588	588	@@ -732,6 +732,10 @@ static int raw_recvmsg(struct sock *sk,
589	589	skb = skb_recv_datagram(sk, flags, noblock, &err);
590	590	if (!skb)

		@@ -596,8 +596,8 @@
596	596
597	597	copied = skb->len;
598	598	if (len < copied) {
599		---- linux-4.1.43.orig/net/ipv4/udp.c
600		-+++ linux-4.1.43/net/ipv4/udp.c
	599	+--- linux-4.1.45.orig/net/ipv4/udp.c
	600	++++ linux-4.1.45/net/ipv4/udp.c
601	601	@@ -1275,6 +1275,10 @@ try_again:
602	602	&peeked, &off, &err);
603	603	if (!skb)

		@@ -609,8 +609,8 @@
609	609
610	610	ulen = skb->len - sizeof(struct udphdr);
611	611	copied = len;
612		---- linux-4.1.43.orig/net/ipv6/raw.c
613		-+++ linux-4.1.43/net/ipv6/raw.c
	612	+--- linux-4.1.45.orig/net/ipv6/raw.c
	613	++++ linux-4.1.45/net/ipv6/raw.c
614	614	@@ -477,6 +477,10 @@ static int rawv6_recvmsg(struct sock *sk
615	615	skb = skb_recv_datagram(sk, flags, noblock, &err);
616	616	if (!skb)

		@@ -622,8 +622,8 @@
622	622
623	623	copied = skb->len;
624	624	if (copied > len) {
625		---- linux-4.1.43.orig/net/ipv6/udp.c
626		-+++ linux-4.1.43/net/ipv6/udp.c
	625	+--- linux-4.1.45.orig/net/ipv6/udp.c
	626	++++ linux-4.1.45/net/ipv6/udp.c
627	627	@@ -414,6 +414,10 @@ try_again:
628	628	&peeked, &off, &err);
629	629	if (!skb)

		@@ -635,8 +635,8 @@
635	635
636	636	ulen = skb->len - sizeof(struct udphdr);
637	637	copied = len;
638		---- linux-4.1.43.orig/net/socket.c
639		-+++ linux-4.1.43/net/socket.c
	638	+--- linux-4.1.45.orig/net/socket.c
	639	++++ linux-4.1.45/net/socket.c
640	640	@@ -1485,6 +1485,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
641	641	if (err < 0)
642	642	goto out_fd;

		@@ -648,8 +648,8 @@
648	648	if (upeer_sockaddr) {
649	649	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
650	650	&len, 2) < 0) {
651		---- linux-4.1.43.orig/net/unix/af_unix.c
652		-+++ linux-4.1.43/net/unix/af_unix.c
	651	+--- linux-4.1.45.orig/net/unix/af_unix.c
	652	++++ linux-4.1.45/net/unix/af_unix.c
653	653	@@ -1983,6 +1983,10 @@ static int unix_dgram_recvmsg(struct soc
654	654	wake_up_interruptible_sync_poll(&u->peer_wait,
655	655	POLLOUT \| POLLWRNORM \| POLLWRBAND);

		@@ -661,8 +661,8 @@
661	661	if (msg->msg_name)
662	662	unix_copy_addr(msg, skb->sk);
663	663
664		---- linux-4.1.43.orig/security/Kconfig
665		-+++ linux-4.1.43/security/Kconfig
	664	+--- linux-4.1.45.orig/security/Kconfig
	665	++++ linux-4.1.45/security/Kconfig
666	666	@@ -168,5 +168,7 @@ config DEFAULT_SECURITY
667	667	default "yama" if DEFAULT_SECURITY_YAMA
668	668	default "" if DEFAULT_SECURITY_DAC

		@@ -671,8 +671,8 @@
671	671	+
672	672	endmenu
673	673
674		---- linux-4.1.43.orig/security/Makefile
675		-+++ linux-4.1.43/security/Makefile
	674	+--- linux-4.1.45.orig/security/Makefile
	675	++++ linux-4.1.45/security/Makefile
676	676	@@ -27,3 +27,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
677	677	# Object integrity file lists
678	678	subdir-$(CONFIG_INTEGRITY) += integrity

		@@ -680,8 +680,8 @@
680	680	+
681	681	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
682	682	+obj-$(CONFIG_CCSECURITY) += ccsecurity/
683		---- linux-4.1.43.orig/security/security.c
684		-+++ linux-4.1.43/security/security.c
	683	+--- linux-4.1.45.orig/security/security.c
	684	++++ linux-4.1.45/security/security.c
685	685	@@ -226,7 +226,10 @@ int security_syslog(int type)
686	686
687	687	int security_settime(const struct timespec ts, const struct timezone tz)

--- trunk/caitsith-patch/patches/ccs-patch-4.12.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-4.12.diff (revision 250)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 4.12.13.
	1	+This is TOMOYO Linux patch for kernel 4.12.14.
2	2
3		-Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.12.13.tar.xz
	3	+Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.12.14.tar.xz
4	4	---
5	5	fs/exec.c \| 2 -
6	6	fs/open.c \| 2 +

		@@ -28,8 +28,8 @@
28	28	security/security.c \| 9 +++++-
29	29	24 files changed, 153 insertions(+), 29 deletions(-)
30	30
31		---- linux-4.12.13.orig/fs/exec.c
32		-+++ linux-4.12.13/fs/exec.c
	31	+--- linux-4.12.14.orig/fs/exec.c
	32	++++ linux-4.12.14/fs/exec.c
33	33	@@ -1665,7 +1665,7 @@ static int exec_binprm(struct linux_binp
34	34	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
35	35	rcu_read_unlock();

		@@ -39,8 +39,8 @@
39	39	if (ret >= 0) {
40	40	audit_bprm(bprm);
41	41	trace_sched_process_exec(current, old_pid, bprm);
42		---- linux-4.12.13.orig/fs/open.c
43		-+++ linux-4.12.13/fs/open.c
	42	+--- linux-4.12.14.orig/fs/open.c
	43	++++ linux-4.12.14/fs/open.c
44	44	@@ -1167,6 +1167,8 @@ EXPORT_SYMBOL(sys_close);
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-4.12.13.orig/fs/proc/version.c
54		-+++ linux-4.12.13/fs/proc/version.c
	53	+--- linux-4.12.14.orig/fs/proc/version.c
	54	++++ linux-4.12.14/fs/proc/version.c
55	55	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 4.12.13 2017/09/14\n");
	62	++ printk(KERN_INFO "Hook version: 4.12.14 2017/09/25\n");
63	63	+ return 0;
64	64	+}
65	65	+fs_initcall(ccs_show_version);
66		---- linux-4.12.13.orig/include/linux/init_task.h
67		-+++ linux-4.12.13/include/linux/init_task.h
	66	+--- linux-4.12.14.orig/include/linux/init_task.h
	67	++++ linux-4.12.14/include/linux/init_task.h
68	68	@@ -225,6 +225,14 @@ extern struct cred init_cred;
69	69	#define INIT_TASK_SECURITY
70	70	#endif

		@@ -88,8 +88,8 @@
88	88	}
89	89
90	90
91		---- linux-4.12.13.orig/include/linux/sched.h
92		-+++ linux-4.12.13/include/linux/sched.h
	91	+--- linux-4.12.14.orig/include/linux/sched.h
	92	++++ linux-4.12.14/include/linux/sched.h
93	93	@@ -32,6 +32,7 @@ struct audit_context;
94	94	struct backing_dev_info;
95	95	struct bio_list;

		@@ -109,8 +109,8 @@
109	109	/* CPU-specific state of this task: */
110	110	struct thread_struct thread;
111	111
112		---- linux-4.12.13.orig/include/linux/security.h
113		-+++ linux-4.12.13/include/linux/security.h
	112	+--- linux-4.12.14.orig/include/linux/security.h
	113	++++ linux-4.12.14/include/linux/security.h
114	114	@@ -55,6 +55,7 @@ struct msg_queue;
115	115	struct xattr;
116	116	struct xfrm_sec_ctx;

		@@ -333,8 +333,8 @@
333	333	}
334	334	#endif /* CONFIG_SECURITY_PATH */
335	335
336		---- linux-4.12.13.orig/include/net/ip.h
337		-+++ linux-4.12.13/include/net/ip.h
	336	+--- linux-4.12.14.orig/include/net/ip.h
	337	++++ linux-4.12.14/include/net/ip.h
338	338	@@ -255,6 +255,8 @@ void inet_get_local_port_range(struct ne
339	339	#ifdef CONFIG_SYSCTL
340	340	static inline int inet_is_local_reserved_port(struct net *net, int port)

		@@ -353,8 +353,8 @@
353	353	return 0;
354	354	}
355	355
356		---- linux-4.12.13.orig/kernel/kexec.c
357		-+++ linux-4.12.13/kernel/kexec.c
	356	+--- linux-4.12.14.orig/kernel/kexec.c
	357	++++ linux-4.12.14/kernel/kexec.c
358	358	@@ -17,7 +17,7 @@
359	359	#include <linux/syscalls.h>
360	360	#include <linux/vmalloc.h>

		@@ -373,8 +373,8 @@
373	373
374	374	/*
375	375	* Verify we have a legal set of flags
376		---- linux-4.12.13.orig/kernel/module.c
377		-+++ linux-4.12.13/kernel/module.c
	376	+--- linux-4.12.14.orig/kernel/module.c
	377	++++ linux-4.12.14/kernel/module.c
378	378	@@ -68,6 +68,7 @@
379	379	#include <linux/audit.h>
380	380	#include <uapi/linux/module.h>

		@@ -401,8 +401,8 @@
401	401
402	402	return 0;
403	403	}
404		---- linux-4.12.13.orig/kernel/ptrace.c
405		-+++ linux-4.12.13/kernel/ptrace.c
	404	+--- linux-4.12.14.orig/kernel/ptrace.c
	405	++++ linux-4.12.14/kernel/ptrace.c
406	406	@@ -1125,6 +1125,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
407	407	{
408	408	struct task_struct *child;

		@@ -427,8 +427,8 @@
427	427
428	428	if (request == PTRACE_TRACEME) {
429	429	ret = ptrace_traceme();
430		---- linux-4.12.13.orig/kernel/reboot.c
431		-+++ linux-4.12.13/kernel/reboot.c
	430	+--- linux-4.12.14.orig/kernel/reboot.c
	431	++++ linux-4.12.14/kernel/reboot.c
432	432	@@ -16,6 +16,7 @@
433	433	#include <linux/syscalls.h>
434	434	#include <linux/syscore_ops.h>

		@@ -446,8 +446,8 @@
446	446
447	447	/*
448	448	* If pid namespaces are enabled and the current task is in a child
449		---- linux-4.12.13.orig/kernel/sched/core.c
450		-+++ linux-4.12.13/kernel/sched/core.c
	449	+--- linux-4.12.14.orig/kernel/sched/core.c
	450	++++ linux-4.12.14/kernel/sched/core.c
451	451	@@ -3926,6 +3926,8 @@ int can_nice(const struct task_struct *p
452	452	SYSCALL_DEFINE1(nice, int, increment)
453	453	{

		@@ -457,8 +457,8 @@
457	457
458	458	/*
459	459	* Setpriority might change our priority at the same moment.
460		---- linux-4.12.13.orig/kernel/signal.c
461		-+++ linux-4.12.13/kernel/signal.c
	460	+--- linux-4.12.14.orig/kernel/signal.c
	461	++++ linux-4.12.14/kernel/signal.c
462	462	@@ -2873,6 +2873,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
463	463	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
464	464	{

		@@ -504,8 +504,8 @@
504	504
505	505	return do_send_specific(tgid, pid, sig, info);
506	506	}
507		---- linux-4.12.13.orig/kernel/sys.c
508		-+++ linux-4.12.13/kernel/sys.c
	507	+--- linux-4.12.14.orig/kernel/sys.c
	508	++++ linux-4.12.14/kernel/sys.c
509	509	@@ -190,6 +190,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
510	510
511	511	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -535,8 +535,8 @@
535	535
536	536	down_write(&uts_sem);
537	537	errno = -EFAULT;
538		---- linux-4.12.13.orig/kernel/time/ntp.c
539		-+++ linux-4.12.13/kernel/time/ntp.c
	538	+--- linux-4.12.14.orig/kernel/time/ntp.c
	539	++++ linux-4.12.14/kernel/time/ntp.c
540	540	@@ -17,6 +17,7 @@
541	541	#include <linux/module.h>
542	542	#include <linux/rtc.h>

		@@ -570,8 +570,8 @@
570	570
571	571	if (txc->modes & ADJ_NANO) {
572	572	struct timespec ts;
573		---- linux-4.12.13.orig/net/ipv4/raw.c
574		-+++ linux-4.12.13/net/ipv4/raw.c
	573	+--- linux-4.12.14.orig/net/ipv4/raw.c
	574	++++ linux-4.12.14/net/ipv4/raw.c
575	575	@@ -755,6 +755,10 @@ static int raw_recvmsg(struct sock *sk,
576	576	skb = skb_recv_datagram(sk, flags, noblock, &err);
577	577	if (!skb)

		@@ -583,8 +583,8 @@
583	583
584	584	copied = skb->len;
585	585	if (len < copied) {
586		---- linux-4.12.13.orig/net/ipv4/udp.c
587		-+++ linux-4.12.13/net/ipv4/udp.c
	586	+--- linux-4.12.14.orig/net/ipv4/udp.c
	587	++++ linux-4.12.14/net/ipv4/udp.c
588	588	@@ -1425,6 +1425,8 @@ try_again:
589	589	skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
590	590	if (!skb)

		@@ -594,8 +594,8 @@
594	594
595	595	ulen = skb->len;
596	596	copied = len;
597		---- linux-4.12.13.orig/net/ipv6/raw.c
598		-+++ linux-4.12.13/net/ipv6/raw.c
	597	+--- linux-4.12.14.orig/net/ipv6/raw.c
	598	++++ linux-4.12.14/net/ipv6/raw.c
599	599	@@ -480,6 +480,10 @@ static int rawv6_recvmsg(struct sock *sk
600	600	skb = skb_recv_datagram(sk, flags, noblock, &err);
601	601	if (!skb)

		@@ -607,8 +607,8 @@
607	607
608	608	copied = skb->len;
609	609	if (copied > len) {
610		---- linux-4.12.13.orig/net/ipv6/udp.c
611		-+++ linux-4.12.13/net/ipv6/udp.c
	610	+--- linux-4.12.14.orig/net/ipv6/udp.c
	611	++++ linux-4.12.14/net/ipv6/udp.c
612	612	@@ -357,6 +357,8 @@ try_again:
613	613	skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
614	614	if (!skb)

		@@ -618,8 +618,8 @@
618	618
619	619	ulen = skb->len;
620	620	copied = len;
621		---- linux-4.12.13.orig/net/socket.c
622		-+++ linux-4.12.13/net/socket.c
	621	+--- linux-4.12.14.orig/net/socket.c
	622	++++ linux-4.12.14/net/socket.c
623	623	@@ -1521,6 +1521,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
624	624	if (err < 0)
625	625	goto out_fd;

		@@ -631,8 +631,8 @@
631	631	if (upeer_sockaddr) {
632	632	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
633	633	&len, 2) < 0) {
634		---- linux-4.12.13.orig/net/unix/af_unix.c
635		-+++ linux-4.12.13/net/unix/af_unix.c
	634	+--- linux-4.12.14.orig/net/unix/af_unix.c
	635	++++ linux-4.12.14/net/unix/af_unix.c
636	636	@@ -2152,6 +2152,10 @@ static int unix_dgram_recvmsg(struct soc
637	637	POLLOUT \| POLLWRNORM \|
638	638	POLLWRBAND);

		@@ -652,8 +652,8 @@
652	652	mutex_unlock(&u->iolock);
653	653	out:
654	654	return err;
655		---- linux-4.12.13.orig/security/Kconfig
656		-+++ linux-4.12.13/security/Kconfig
	655	+--- linux-4.12.14.orig/security/Kconfig
	656	++++ linux-4.12.14/security/Kconfig
657	657	@@ -235,5 +235,7 @@ config DEFAULT_SECURITY
658	658	default "apparmor" if DEFAULT_SECURITY_APPARMOR
659	659	default "" if DEFAULT_SECURITY_DAC

		@@ -662,8 +662,8 @@
662	662	+
663	663	endmenu
664	664
665		---- linux-4.12.13.orig/security/Makefile
666		-+++ linux-4.12.13/security/Makefile
	665	+--- linux-4.12.14.orig/security/Makefile
	666	++++ linux-4.12.14/security/Makefile
667	667	@@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
668	668	# Object integrity file lists
669	669	subdir-$(CONFIG_INTEGRITY) += integrity

		@@ -671,8 +671,8 @@
671	671	+
672	672	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
673	673	+obj-$(CONFIG_CCSECURITY) += ccsecurity/
674		---- linux-4.12.13.orig/security/security.c
675		-+++ linux-4.12.13/security/security.c
	674	+--- linux-4.12.14.orig/security/security.c
	675	++++ linux-4.12.14/security/security.c
676	676	@@ -943,12 +943,19 @@ int security_task_create(unsigned long c
677	677
678	678	int security_task_alloc(struct task_struct *task, unsigned long clone_flags)

--- trunk/caitsith-patch/patches/ccs-patch-4.13.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-4.13.diff (revision 250)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 4.13.2.
	1	+This is TOMOYO Linux patch for kernel 4.13.11.
2	2
3		-Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.13.2.tar.xz
	3	+Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.13.11.tar.xz
4	4	---
5	5	fs/exec.c \| 2 -
6	6	fs/open.c \| 2 +

		@@ -28,8 +28,8 @@
28	28	security/security.c \| 9 +++++-
29	29	24 files changed, 153 insertions(+), 29 deletions(-)
30	30
31		---- linux-4.13.2.orig/fs/exec.c
32		-+++ linux-4.13.2/fs/exec.c
	31	+--- linux-4.13.11.orig/fs/exec.c
	32	++++ linux-4.13.11/fs/exec.c
33	33	@@ -1665,7 +1665,7 @@ static int exec_binprm(struct linux_binp
34	34	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
35	35	rcu_read_unlock();

		@@ -39,8 +39,8 @@
39	39	if (ret >= 0) {
40	40	audit_bprm(bprm);
41	41	trace_sched_process_exec(current, old_pid, bprm);
42		---- linux-4.13.2.orig/fs/open.c
43		-+++ linux-4.13.2/fs/open.c
	42	+--- linux-4.13.11.orig/fs/open.c
	43	++++ linux-4.13.11/fs/open.c
44	44	@@ -1171,6 +1171,8 @@ EXPORT_SYMBOL(sys_close);
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-4.13.2.orig/fs/proc/version.c
54		-+++ linux-4.13.2/fs/proc/version.c
	53	+--- linux-4.13.11.orig/fs/proc/version.c
	54	++++ linux-4.13.11/fs/proc/version.c
55	55	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 4.13.2 2017/09/14\n");
	62	++ printk(KERN_INFO "Hook version: 4.13.11 2017/11/04\n");
63	63	+ return 0;
64	64	+}
65	65	+fs_initcall(ccs_show_version);
66		---- linux-4.13.2.orig/include/linux/init_task.h
67		-+++ linux-4.13.2/include/linux/init_task.h
	66	+--- linux-4.13.11.orig/include/linux/init_task.h
	67	++++ linux-4.13.11/include/linux/init_task.h
68	68	@@ -225,6 +225,14 @@ extern struct cred init_cred;
69	69	#define INIT_TASK_SECURITY
70	70	#endif

		@@ -88,8 +88,8 @@
88	88	}
89	89
90	90
91		---- linux-4.13.2.orig/include/linux/sched.h
92		-+++ linux-4.13.2/include/linux/sched.h
	91	+--- linux-4.13.11.orig/include/linux/sched.h
	92	++++ linux-4.13.11/include/linux/sched.h
93	93	@@ -32,6 +32,7 @@ struct audit_context;
94	94	struct backing_dev_info;
95	95	struct bio_list;

		@@ -109,8 +109,8 @@
109	109
110	110	/*
111	111	* New fields for task_struct should be added above here, so that
112		---- linux-4.13.2.orig/include/linux/security.h
113		-+++ linux-4.13.2/include/linux/security.h
	112	+--- linux-4.13.11.orig/include/linux/security.h
	113	++++ linux-4.13.11/include/linux/security.h
114	114	@@ -56,6 +56,7 @@ struct msg_queue;
115	115	struct xattr;
116	116	struct xfrm_sec_ctx;

		@@ -333,8 +333,8 @@
333	333	}
334	334	#endif /* CONFIG_SECURITY_PATH */
335	335
336		---- linux-4.13.2.orig/include/net/ip.h
337		-+++ linux-4.13.2/include/net/ip.h
	336	+--- linux-4.13.11.orig/include/net/ip.h
	337	++++ linux-4.13.11/include/net/ip.h
338	338	@@ -255,6 +255,8 @@ void inet_get_local_port_range(struct ne
339	339	#ifdef CONFIG_SYSCTL
340	340	static inline int inet_is_local_reserved_port(struct net *net, int port)

		@@ -353,8 +353,8 @@
353	353	return 0;
354	354	}
355	355
356		---- linux-4.13.2.orig/kernel/kexec.c
357		-+++ linux-4.13.2/kernel/kexec.c
	356	+--- linux-4.13.11.orig/kernel/kexec.c
	357	++++ linux-4.13.11/kernel/kexec.c
358	358	@@ -17,7 +17,7 @@
359	359	#include <linux/syscalls.h>
360	360	#include <linux/vmalloc.h>

		@@ -373,8 +373,8 @@
373	373
374	374	/*
375	375	* Verify we have a legal set of flags
376		---- linux-4.13.2.orig/kernel/module.c
377		-+++ linux-4.13.2/kernel/module.c
	376	+--- linux-4.13.11.orig/kernel/module.c
	377	++++ linux-4.13.11/kernel/module.c
378	378	@@ -66,6 +66,7 @@
379	379	#include <linux/audit.h>
380	380	#include <uapi/linux/module.h>

		@@ -401,8 +401,8 @@
401	401
402	402	return 0;
403	403	}
404		---- linux-4.13.2.orig/kernel/ptrace.c
405		-+++ linux-4.13.2/kernel/ptrace.c
	404	+--- linux-4.13.11.orig/kernel/ptrace.c
	405	++++ linux-4.13.11/kernel/ptrace.c
406	406	@@ -1125,6 +1125,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
407	407	{
408	408	struct task_struct *child;

		@@ -427,8 +427,8 @@
427	427
428	428	if (request == PTRACE_TRACEME) {
429	429	ret = ptrace_traceme();
430		---- linux-4.13.2.orig/kernel/reboot.c
431		-+++ linux-4.13.2/kernel/reboot.c
	430	+--- linux-4.13.11.orig/kernel/reboot.c
	431	++++ linux-4.13.11/kernel/reboot.c
432	432	@@ -16,6 +16,7 @@
433	433	#include <linux/syscalls.h>
434	434	#include <linux/syscore_ops.h>

		@@ -446,8 +446,8 @@
446	446
447	447	/*
448	448	* If pid namespaces are enabled and the current task is in a child
449		---- linux-4.13.2.orig/kernel/sched/core.c
450		-+++ linux-4.13.2/kernel/sched/core.c
	449	+--- linux-4.13.11.orig/kernel/sched/core.c
	450	++++ linux-4.13.11/kernel/sched/core.c
451	451	@@ -3818,6 +3818,8 @@ int can_nice(const struct task_struct *p
452	452	SYSCALL_DEFINE1(nice, int, increment)
453	453	{

		@@ -457,8 +457,8 @@
457	457
458	458	/*
459	459	* Setpriority might change our priority at the same moment.
460		---- linux-4.13.2.orig/kernel/signal.c
461		-+++ linux-4.13.2/kernel/signal.c
	460	+--- linux-4.13.11.orig/kernel/signal.c
	461	++++ linux-4.13.11/kernel/signal.c
462	462	@@ -2915,6 +2915,8 @@ COMPAT_SYSCALL_DEFINE4(rt_sigtimedwait,
463	463	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
464	464	{

		@@ -504,8 +504,8 @@
504	504
505	505	return do_send_specific(tgid, pid, sig, info);
506	506	}
507		---- linux-4.13.2.orig/kernel/sys.c
508		-+++ linux-4.13.2/kernel/sys.c
	507	+--- linux-4.13.11.orig/kernel/sys.c
	508	++++ linux-4.13.11/kernel/sys.c
509	509	@@ -190,6 +190,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
510	510
511	511	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -535,8 +535,8 @@
535	535
536	536	down_write(&uts_sem);
537	537	errno = -EFAULT;
538		---- linux-4.13.2.orig/kernel/time/ntp.c
539		-+++ linux-4.13.2/kernel/time/ntp.c
	538	+--- linux-4.13.11.orig/kernel/time/ntp.c
	539	++++ linux-4.13.11/kernel/time/ntp.c
540	540	@@ -17,6 +17,7 @@
541	541	#include <linux/module.h>
542	542	#include <linux/rtc.h>

		@@ -570,8 +570,8 @@
570	570
571	571	if (txc->modes & ADJ_NANO) {
572	572	struct timespec ts;
573		---- linux-4.13.2.orig/net/ipv4/raw.c
574		-+++ linux-4.13.2/net/ipv4/raw.c
	573	+--- linux-4.13.11.orig/net/ipv4/raw.c
	574	++++ linux-4.13.11/net/ipv4/raw.c
575	575	@@ -755,6 +755,10 @@ static int raw_recvmsg(struct sock *sk,
576	576	skb = skb_recv_datagram(sk, flags, noblock, &err);
577	577	if (!skb)

		@@ -583,9 +583,9 @@
583	583
584	584	copied = skb->len;
585	585	if (len < copied) {
586		---- linux-4.13.2.orig/net/ipv4/udp.c
587		-+++ linux-4.13.2/net/ipv4/udp.c
588		-@@ -1579,6 +1579,8 @@ try_again:
	586	+--- linux-4.13.11.orig/net/ipv4/udp.c
	587	++++ linux-4.13.11/net/ipv4/udp.c
	588	+@@ -1582,6 +1582,8 @@ try_again:
589	589	skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
590	590	if (!skb)
591	591	return err;

		@@ -594,8 +594,8 @@
594	594
595	595	ulen = udp_skb_len(skb);
596	596	copied = len;
597		---- linux-4.13.2.orig/net/ipv6/raw.c
598		-+++ linux-4.13.2/net/ipv6/raw.c
	597	+--- linux-4.13.11.orig/net/ipv6/raw.c
	598	++++ linux-4.13.11/net/ipv6/raw.c
599	599	@@ -480,6 +480,10 @@ static int rawv6_recvmsg(struct sock *sk
600	600	skb = skb_recv_datagram(sk, flags, noblock, &err);
601	601	if (!skb)

		@@ -607,8 +607,8 @@
607	607
608	608	copied = skb->len;
609	609	if (copied > len) {
610		---- linux-4.13.2.orig/net/ipv6/udp.c
611		-+++ linux-4.13.2/net/ipv6/udp.c
	610	+--- linux-4.13.11.orig/net/ipv6/udp.c
	611	++++ linux-4.13.11/net/ipv6/udp.c
612	612	@@ -367,6 +367,8 @@ try_again:
613	613	skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
614	614	if (!skb)

		@@ -618,8 +618,8 @@
618	618
619	619	ulen = udp6_skb_len(skb);
620	620	copied = len;
621		---- linux-4.13.2.orig/net/socket.c
622		-+++ linux-4.13.2/net/socket.c
	621	+--- linux-4.13.11.orig/net/socket.c
	622	++++ linux-4.13.11/net/socket.c
623	623	@@ -1561,6 +1561,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
624	624	if (err < 0)
625	625	goto out_fd;

		@@ -631,8 +631,8 @@
631	631	if (upeer_sockaddr) {
632	632	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
633	633	&len, 2) < 0) {
634		---- linux-4.13.2.orig/net/unix/af_unix.c
635		-+++ linux-4.13.2/net/unix/af_unix.c
	634	+--- linux-4.13.11.orig/net/unix/af_unix.c
	635	++++ linux-4.13.11/net/unix/af_unix.c
636	636	@@ -2152,6 +2152,10 @@ static int unix_dgram_recvmsg(struct soc
637	637	POLLOUT \| POLLWRNORM \|
638	638	POLLWRBAND);

		@@ -652,8 +652,8 @@
652	652	mutex_unlock(&u->iolock);
653	653	out:
654	654	return err;
655		---- linux-4.13.2.orig/security/Kconfig
656		-+++ linux-4.13.2/security/Kconfig
	655	+--- linux-4.13.11.orig/security/Kconfig
	656	++++ linux-4.13.11/security/Kconfig
657	657	@@ -251,5 +251,7 @@ config DEFAULT_SECURITY
658	658	default "apparmor" if DEFAULT_SECURITY_APPARMOR
659	659	default "" if DEFAULT_SECURITY_DAC

		@@ -662,8 +662,8 @@
662	662	+
663	663	endmenu
664	664
665		---- linux-4.13.2.orig/security/Makefile
666		-+++ linux-4.13.2/security/Makefile
	665	+--- linux-4.13.11.orig/security/Makefile
	666	++++ linux-4.13.11/security/Makefile
667	667	@@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
668	668	# Object integrity file lists
669	669	subdir-$(CONFIG_INTEGRITY) += integrity

		@@ -671,8 +671,8 @@
671	671	+
672	672	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
673	673	+obj-$(CONFIG_CCSECURITY) += ccsecurity/
674		---- linux-4.13.2.orig/security/security.c
675		-+++ linux-4.13.2/security/security.c
	674	+--- linux-4.13.11.orig/security/security.c
	675	++++ linux-4.13.11/security/security.c
676	676	@@ -986,12 +986,19 @@ int security_task_create(unsigned long c
677	677
678	678	int security_task_alloc(struct task_struct *task, unsigned long clone_flags)

--- trunk/caitsith-patch/patches/ccs-patch-4.14.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-4.14.diff (revision 250)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 4.14-rc1.
	1	+This is TOMOYO Linux patch for kernel 4.14-rc7.
2	2
3		-Source code for this patch is https://git.kernel.org/torvalds/t/linux-4.14-rc1.tar.gz
	3	+Source code for this patch is https://git.kernel.org/torvalds/t/linux-4.14-rc7.tar.gz
4	4	---
5	5	fs/exec.c \| 2 -
6	6	fs/open.c \| 2 +

		@@ -28,8 +28,8 @@
28	28	security/security.c \| 9 +++++-
29	29	24 files changed, 153 insertions(+), 29 deletions(-)
30	30
31		---- linux-4.14-rc1.orig/fs/exec.c
32		-+++ linux-4.14-rc1/fs/exec.c
	31	+--- linux-4.14-rc7.orig/fs/exec.c
	32	++++ linux-4.14-rc7/fs/exec.c
33	33	@@ -1673,7 +1673,7 @@ static int exec_binprm(struct linux_binp
34	34	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
35	35	rcu_read_unlock();

		@@ -39,8 +39,8 @@
39	39	if (ret >= 0) {
40	40	audit_bprm(bprm);
41	41	trace_sched_process_exec(current, old_pid, bprm);
42		---- linux-4.14-rc1.orig/fs/open.c
43		-+++ linux-4.14-rc1/fs/open.c
	42	+--- linux-4.14-rc7.orig/fs/open.c
	43	++++ linux-4.14-rc7/fs/open.c
44	44	@@ -1171,6 +1171,8 @@ EXPORT_SYMBOL(sys_close);
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-4.14-rc1.orig/fs/proc/version.c
54		-+++ linux-4.14-rc1/fs/proc/version.c
	53	+--- linux-4.14-rc7.orig/fs/proc/version.c
	54	++++ linux-4.14-rc7/fs/proc/version.c
55	55	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 4.14-rc1 2017/09/17\n");
	62	++ printk(KERN_INFO "Hook version: 4.14-rc7 2017/11/04\n");
63	63	+ return 0;
64	64	+}
65	65	+fs_initcall(ccs_show_version);
66		---- linux-4.14-rc1.orig/include/linux/init_task.h
67		-+++ linux-4.14-rc1/include/linux/init_task.h
	66	+--- linux-4.14-rc7.orig/include/linux/init_task.h
	67	++++ linux-4.14-rc7/include/linux/init_task.h
68	68	@@ -218,6 +218,14 @@ extern struct cred init_cred;
69	69	#define INIT_TASK_SECURITY
70	70	#endif

		@@ -88,8 +88,8 @@
88	88	}
89	89
90	90
91		---- linux-4.14-rc1.orig/include/linux/sched.h
92		-+++ linux-4.14-rc1/include/linux/sched.h
	91	+--- linux-4.14-rc7.orig/include/linux/sched.h
	92	++++ linux-4.14-rc7/include/linux/sched.h
93	93	@@ -32,6 +32,7 @@ struct audit_context;
94	94	struct backing_dev_info;
95	95	struct bio_list;

		@@ -98,7 +98,7 @@
98	98	struct cfs_rq;
99	99	struct fs_struct;
100	100	struct futex_pi_state;
101		-@@ -1097,6 +1098,10 @@ struct task_struct {
	101	+@@ -1096,6 +1097,10 @@ struct task_struct {
102	102	/* Used by LSM modules for access restriction: */
103	103	void *security;
104	104	#endif

		@@ -109,8 +109,8 @@
109	109
110	110	/*
111	111	* New fields for task_struct should be added above here, so that
112		---- linux-4.14-rc1.orig/include/linux/security.h
113		-+++ linux-4.14-rc1/include/linux/security.h
	112	+--- linux-4.14-rc7.orig/include/linux/security.h
	113	++++ linux-4.14-rc7/include/linux/security.h
114	114	@@ -56,6 +56,7 @@ struct msg_queue;
115	115	struct xattr;
116	116	struct xfrm_sec_ctx;

		@@ -331,8 +331,8 @@
331	331	}
332	332	#endif /* CONFIG_SECURITY_PATH */
333	333
334		---- linux-4.14-rc1.orig/include/net/ip.h
335		-+++ linux-4.14-rc1/include/net/ip.h
	334	+--- linux-4.14-rc7.orig/include/net/ip.h
	335	++++ linux-4.14-rc7/include/net/ip.h
336	336	@@ -265,6 +265,8 @@ void inet_get_local_port_range(struct ne
337	337	#ifdef CONFIG_SYSCTL
338	338	static inline int inet_is_local_reserved_port(struct net *net, int port)

		@@ -351,8 +351,8 @@
351	351	return 0;
352	352	}
353	353
354		---- linux-4.14-rc1.orig/kernel/kexec.c
355		-+++ linux-4.14-rc1/kernel/kexec.c
	354	+--- linux-4.14-rc7.orig/kernel/kexec.c
	355	++++ linux-4.14-rc7/kernel/kexec.c
356	356	@@ -17,7 +17,7 @@
357	357	#include <linux/syscalls.h>
358	358	#include <linux/vmalloc.h>

		@@ -371,8 +371,8 @@
371	371
372	372	/*
373	373	* Verify we have a legal set of flags
374		---- linux-4.14-rc1.orig/kernel/module.c
375		-+++ linux-4.14-rc1/kernel/module.c
	374	+--- linux-4.14-rc7.orig/kernel/module.c
	375	++++ linux-4.14-rc7/kernel/module.c
376	376	@@ -66,6 +66,7 @@
377	377	#include <linux/audit.h>
378	378	#include <uapi/linux/module.h>

		@@ -399,8 +399,8 @@
399	399
400	400	return 0;
401	401	}
402		---- linux-4.14-rc1.orig/kernel/ptrace.c
403		-+++ linux-4.14-rc1/kernel/ptrace.c
	402	+--- linux-4.14-rc7.orig/kernel/ptrace.c
	403	++++ linux-4.14-rc7/kernel/ptrace.c
404	404	@@ -1123,6 +1123,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
405	405	{
406	406	struct task_struct *child;

		@@ -425,8 +425,8 @@
425	425
426	426	if (request == PTRACE_TRACEME) {
427	427	ret = ptrace_traceme();
428		---- linux-4.14-rc1.orig/kernel/reboot.c
429		-+++ linux-4.14-rc1/kernel/reboot.c
	428	+--- linux-4.14-rc7.orig/kernel/reboot.c
	429	++++ linux-4.14-rc7/kernel/reboot.c
430	430	@@ -16,6 +16,7 @@
431	431	#include <linux/syscalls.h>
432	432	#include <linux/syscore_ops.h>

		@@ -444,8 +444,8 @@
444	444
445	445	/*
446	446	* If pid namespaces are enabled and the current task is in a child
447		---- linux-4.14-rc1.orig/kernel/sched/core.c
448		-+++ linux-4.14-rc1/kernel/sched/core.c
	447	+--- linux-4.14-rc7.orig/kernel/sched/core.c
	448	++++ linux-4.14-rc7/kernel/sched/core.c
449	449	@@ -3852,6 +3852,8 @@ int can_nice(const struct task_struct *p
450	450	SYSCALL_DEFINE1(nice, int, increment)
451	451	{

		@@ -455,8 +455,8 @@
455	455
456	456	/*
457	457	* Setpriority might change our priority at the same moment.
458		---- linux-4.14-rc1.orig/kernel/signal.c
459		-+++ linux-4.14-rc1/kernel/signal.c
	458	+--- linux-4.14-rc7.orig/kernel/signal.c
	459	++++ linux-4.14-rc7/kernel/signal.c
460	460	@@ -2953,6 +2953,8 @@ COMPAT_SYSCALL_DEFINE4(rt_sigtimedwait,
461	461	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
462	462	{

		@@ -502,8 +502,8 @@
502	502
503	503	return do_send_specific(tgid, pid, sig, info);
504	504	}
505		---- linux-4.14-rc1.orig/kernel/sys.c
506		-+++ linux-4.14-rc1/kernel/sys.c
	505	+--- linux-4.14-rc7.orig/kernel/sys.c
	506	++++ linux-4.14-rc7/kernel/sys.c
507	507	@@ -190,6 +190,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
508	508
509	509	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -533,8 +533,8 @@
533	533
534	534	down_write(&uts_sem);
535	535	errno = -EFAULT;
536		---- linux-4.14-rc1.orig/kernel/time/ntp.c
537		-+++ linux-4.14-rc1/kernel/time/ntp.c
	536	+--- linux-4.14-rc7.orig/kernel/time/ntp.c
	537	++++ linux-4.14-rc7/kernel/time/ntp.c
538	538	@@ -17,6 +17,7 @@
539	539	#include <linux/module.h>
540	540	#include <linux/rtc.h>

		@@ -568,8 +568,8 @@
568	568
569	569	if (txc->modes & ADJ_NANO) {
570	570	struct timespec ts;
571		---- linux-4.14-rc1.orig/net/ipv4/raw.c
572		-+++ linux-4.14-rc1/net/ipv4/raw.c
	571	+--- linux-4.14-rc7.orig/net/ipv4/raw.c
	572	++++ linux-4.14-rc7/net/ipv4/raw.c
573	573	@@ -761,6 +761,10 @@ static int raw_recvmsg(struct sock *sk,
574	574	skb = skb_recv_datagram(sk, flags, noblock, &err);
575	575	if (!skb)

		@@ -581,9 +581,9 @@
581	581
582	582	copied = skb->len;
583	583	if (len < copied) {
584		---- linux-4.14-rc1.orig/net/ipv4/udp.c
585		-+++ linux-4.14-rc1/net/ipv4/udp.c
586		-@@ -1593,6 +1593,8 @@ try_again:
	584	+--- linux-4.14-rc7.orig/net/ipv4/udp.c
	585	++++ linux-4.14-rc7/net/ipv4/udp.c
	586	+@@ -1590,6 +1590,8 @@ try_again:
587	587	skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
588	588	if (!skb)
589	589	return err;

		@@ -592,8 +592,8 @@
592	592
593	593	ulen = udp_skb_len(skb);
594	594	copied = len;
595		---- linux-4.14-rc1.orig/net/ipv6/raw.c
596		-+++ linux-4.14-rc1/net/ipv6/raw.c
	595	+--- linux-4.14-rc7.orig/net/ipv6/raw.c
	596	++++ linux-4.14-rc7/net/ipv6/raw.c
597	597	@@ -483,6 +483,10 @@ static int rawv6_recvmsg(struct sock *sk
598	598	skb = skb_recv_datagram(sk, flags, noblock, &err);
599	599	if (!skb)

		@@ -605,8 +605,8 @@
605	605
606	606	copied = skb->len;
607	607	if (copied > len) {
608		---- linux-4.14-rc1.orig/net/ipv6/udp.c
609		-+++ linux-4.14-rc1/net/ipv6/udp.c
	608	+--- linux-4.14-rc7.orig/net/ipv6/udp.c
	609	++++ linux-4.14-rc7/net/ipv6/udp.c
610	610	@@ -371,6 +371,8 @@ try_again:
611	611	skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
612	612	if (!skb)

		@@ -616,8 +616,8 @@
616	616
617	617	ulen = udp6_skb_len(skb);
618	618	copied = len;
619		---- linux-4.14-rc1.orig/net/socket.c
620		-+++ linux-4.14-rc1/net/socket.c
	619	+--- linux-4.14-rc7.orig/net/socket.c
	620	++++ linux-4.14-rc7/net/socket.c
621	621	@@ -1575,6 +1575,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
622	622	if (err < 0)
623	623	goto out_fd;

		@@ -629,8 +629,8 @@
629	629	if (upeer_sockaddr) {
630	630	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
631	631	&len, 2) < 0) {
632		---- linux-4.14-rc1.orig/net/unix/af_unix.c
633		-+++ linux-4.14-rc1/net/unix/af_unix.c
	632	+--- linux-4.14-rc7.orig/net/unix/af_unix.c
	633	++++ linux-4.14-rc7/net/unix/af_unix.c
634	634	@@ -2131,6 +2131,10 @@ static int unix_dgram_recvmsg(struct soc
635	635	POLLOUT \| POLLWRNORM \|
636	636	POLLWRBAND);

		@@ -650,8 +650,8 @@
650	650	mutex_unlock(&u->iolock);
651	651	out:
652	652	return err;
653		---- linux-4.14-rc1.orig/security/Kconfig
654		-+++ linux-4.14-rc1/security/Kconfig
	653	+--- linux-4.14-rc7.orig/security/Kconfig
	654	++++ linux-4.14-rc7/security/Kconfig
655	655	@@ -251,5 +251,7 @@ config DEFAULT_SECURITY
656	656	default "apparmor" if DEFAULT_SECURITY_APPARMOR
657	657	default "" if DEFAULT_SECURITY_DAC

		@@ -660,8 +660,8 @@
660	660	+
661	661	endmenu
662	662
663		---- linux-4.14-rc1.orig/security/Makefile
664		-+++ linux-4.14-rc1/security/Makefile
	663	+--- linux-4.14-rc7.orig/security/Makefile
	664	++++ linux-4.14-rc7/security/Makefile
665	665	@@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
666	666	# Object integrity file lists
667	667	subdir-$(CONFIG_INTEGRITY) += integrity

		@@ -669,8 +669,8 @@
669	669	+
670	670	+subdir-$(CONFIG_CCSECURITY) += ccsecurity
671	671	+obj-$(CONFIG_CCSECURITY) += ccsecurity/
672		---- linux-4.14-rc1.orig/security/security.c
673		-+++ linux-4.14-rc1/security/security.c
	672	+--- linux-4.14-rc7.orig/security/security.c
	673	++++ linux-4.14-rc7/security/security.c
674	674	@@ -976,12 +976,19 @@ int security_file_open(struct file *file
675	675
676	676	int security_task_alloc(struct task_struct *task, unsigned long clone_flags)

--- trunk/caitsith-patch/patches/ccs-patch-4.4-vine-linux-6.diff (nonexistent)

+++ trunk/caitsith-patch/patches/ccs-patch-4.4-vine-linux-6.diff (revision 250)

		@@ -0,0 +1,682 @@
	1	+This is TOMOYO Linux patch for VineLinux 6.
	2	+
	3	+Source code for this patch is http://updates.vinelinux.org/Vine-6.5/updates/SRPMS/kernel-4.4.92-1vl6.src.rpm
	4	+---
	5	+ fs/exec.c \| 2 -
	6	+ fs/open.c \| 2 +
	7	+ fs/proc/version.c \| 7 +++++
	8	+ include/linux/init_task.h \| 9 ++++++
	9	+ include/linux/sched.h \| 6 ++++
	10	+ include/linux/security.h \| 62 ++++++++++++++++++++++++++++------------------
	11	+ include/net/ip.h \| 4 ++
	12	+ kernel/fork.c \| 5 +++
	13	+ kernel/kexec.c \| 4 ++
	14	+ kernel/module.c \| 5 +++
	15	+ kernel/ptrace.c \| 10 +++++++
	16	+ kernel/reboot.c \| 3 ++
	17	+ kernel/sched/core.c \| 2 +
	18	+ kernel/signal.c \| 10 +++++++
	19	+ kernel/sys.c \| 8 +++++
	20	+ kernel/time/ntp.c \| 8 +++++
	21	+ net/ipv4/raw.c \| 4 ++
	22	+ net/ipv4/udp.c \| 4 ++
	23	+ net/ipv6/raw.c \| 4 ++
	24	+ net/ipv6/udp.c \| 4 ++
	25	+ net/socket.c \| 4 ++
	26	+ net/unix/af_unix.c \| 4 ++
	27	+ security/Kconfig \| 2 +
	28	+ security/Makefile \| 3 ++
	29	+ 24 files changed, 150 insertions(+), 26 deletions(-)
	30	+
	31	+--- linux-4.4.92-1vl6.orig/fs/exec.c
	32	++++ linux-4.4.92-1vl6/fs/exec.c
	33	+@@ -1508,7 +1508,7 @@ static int exec_binprm(struct linux_binp
	34	+ old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
	35	+ rcu_read_unlock();
	36	+
	37	+- ret = search_binary_handler(bprm);
	38	++ ret = ccs_search_binary_handler(bprm);
	39	+ if (ret >= 0) {
	40	+ audit_bprm(bprm);
	41	+ trace_sched_process_exec(current, old_pid, bprm);
	42	+--- linux-4.4.92-1vl6.orig/fs/open.c
	43	++++ linux-4.4.92-1vl6/fs/open.c
	44	+@@ -1117,6 +1117,8 @@ EXPORT_SYMBOL(sys_close);
	45	+ */
	46	+ SYSCALL_DEFINE0(vhangup)
	47	+ {
	48	++ if (!ccs_capable(CCS_SYS_VHANGUP))
	49	++ return -EPERM;
	50	+ if (capable(CAP_SYS_TTY_CONFIG)) {
	51	+ tty_vhangup_self();
	52	+ return 0;
	53	+--- linux-4.4.92-1vl6.orig/fs/proc/version.c
	54	++++ linux-4.4.92-1vl6/fs/proc/version.c
	55	+@@ -32,3 +32,10 @@ static int __init proc_version_init(void
	56	+ return 0;
	57	+ }
	58	+ fs_initcall(proc_version_init);
	59	++
	60	++static int __init ccs_show_version(void)
	61	++{
	62	++ printk(KERN_INFO "Hook version: 4.4.92-1vl6 2017/11/04\n");
	63	++ return 0;
	64	++}
	65	++fs_initcall(ccs_show_version);
	66	+--- linux-4.4.92-1vl6.orig/include/linux/init_task.h
	67	++++ linux-4.4.92-1vl6/include/linux/init_task.h
	68	+@@ -183,6 +183,14 @@ extern struct task_group root_task_group
	69	+ # define INIT_KASAN(tsk)
	70	+ #endif
	71	+
	72	++#if defined(CONFIG_CCSECURITY) && !defined(CONFIG_CCSECURITY_USE_EXTERNAL_TASK_SECURITY)
	73	++#define INIT_CCSECURITY \
	74	++ .ccs_domain_info = NULL, \
	75	++ .ccs_flags = 0,
	76	++#else
	77	++#define INIT_CCSECURITY
	78	++#endif
	79	++
	80	+ /*
	81	+ * INIT_TASK is used to set up the first task table, touch at
	82	+ * your own risk!. Base=0, limit=0x1fffff (=2MB)
	83	+@@ -260,6 +268,7 @@ extern struct task_group root_task_group
	84	+ INIT_VTIME(tsk) \
	85	+ INIT_NUMA_BALANCING(tsk) \
	86	+ INIT_KASAN(tsk) \
	87	++ INIT_CCSECURITY \
	88	+ }
	89	+
	90	+
	91	+--- linux-4.4.92-1vl6.orig/include/linux/sched.h
	92	++++ linux-4.4.92-1vl6/include/linux/sched.h
	93	+@@ -6,6 +6,8 @@
	94	+ #include <linux/sched/prio.h>
	95	+
	96	+
	97	++struct ccs_domain_info;
	98	++
	99	+ struct sched_param {
	100	+ int sched_priority;
	101	+ };
	102	+@@ -1830,6 +1832,10 @@ struct task_struct {
	103	+ unsigned long task_state_change;
	104	+ #endif
	105	+ int pagefault_disabled;
	106	++#if defined(CONFIG_CCSECURITY) && !defined(CONFIG_CCSECURITY_USE_EXTERNAL_TASK_SECURITY)
	107	++ struct ccs_domain_info *ccs_domain_info;
	108	++ u32 ccs_flags;
	109	++#endif
	110	+ /* CPU-specific state of this task */
	111	+ struct thread_struct thread;
	112	+ /*
	113	+--- linux-4.4.92-1vl6.orig/include/linux/security.h
	114	++++ linux-4.4.92-1vl6/include/linux/security.h
	115	+@@ -53,6 +53,7 @@ struct msg_queue;
	116	+ struct xattr;
	117	+ struct xfrm_sec_ctx;
	118	+ struct mm_struct;
	119	++#include <linux/ccsecurity.h>
	120	+
	121	+ /* If capable should audit the security request */
	122	+ #define SECURITY_CAP_NOAUDIT 0
	123	+@@ -460,7 +461,10 @@ static inline int security_syslog(int ty
	124	+ static inline int security_settime(const struct timespec *ts,
	125	+ const struct timezone *tz)
	126	+ {
	127	+- return cap_settime(ts, tz);
	128	++ int error = cap_settime(ts, tz);
	129	++ if (!error)
	130	++ error = ccs_settime(ts, tz);
	131	++ return error;
	132	+ }
	133	+
	134	+ static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
	135	+@@ -529,18 +533,18 @@ static inline int security_sb_mount(cons
	136	+ const char *type, unsigned long flags,
	137	+ void *data)
	138	+ {
	139	+- return 0;
	140	++ return ccs_sb_mount(dev_name, path, type, flags, data);
	141	+ }
	142	+
	143	+ static inline int security_sb_umount(struct vfsmount *mnt, int flags)
	144	+ {
	145	+- return 0;
	146	++ return ccs_sb_umount(mnt, flags);
	147	+ }
	148	+
	149	+ static inline int security_sb_pivotroot(struct path *old_path,
	150	+ struct path *new_path)
	151	+ {
	152	+- return 0;
	153	++ return ccs_sb_pivotroot(old_path, new_path);
	154	+ }
	155	+
	156	+ static inline int security_sb_set_mnt_opts(struct super_block *sb,
	157	+@@ -679,7 +683,7 @@ static inline int security_inode_setattr
	158	+
	159	+ static inline int security_inode_getattr(const struct path *path)
	160	+ {
	161	+- return 0;
	162	++ return ccs_inode_getattr(path);
	163	+ }
	164	+
	165	+ static inline int security_inode_setxattr(struct dentry *dentry,
	166	+@@ -755,7 +759,7 @@ static inline void security_file_free(st
	167	+ static inline int security_file_ioctl(struct file *file, unsigned int cmd,
	168	+ unsigned long arg)
	169	+ {
	170	+- return 0;
	171	++ return ccs_file_ioctl(file, cmd, arg);
	172	+ }
	173	+
	174	+ static inline int security_mmap_file(struct file *file, unsigned long prot,
	175	+@@ -784,7 +788,7 @@ static inline int security_file_lock(str
	176	+ static inline int security_file_fcntl(struct file *file, unsigned int cmd,
	177	+ unsigned long arg)
	178	+ {
	179	+- return 0;
	180	++ return ccs_file_fcntl(file, cmd, arg);
	181	+ }
	182	+
	183	+ static inline void security_file_set_fowner(struct file *file)
	184	+@@ -807,7 +811,7 @@ static inline int security_file_receive(
	185	+ static inline int security_file_open(struct file *file,
	186	+ const struct cred *cred)
	187	+ {
	188	+- return 0;
	189	++ return ccs_file_open(file, cred);
	190	+ }
	191	+
	192	+ static inline int security_task_create(unsigned long clone_flags)
	193	+@@ -1169,7 +1173,7 @@ static inline int security_unix_may_send
	194	+ static inline int security_socket_create(int family, int type,
	195	+ int protocol, int kern)
	196	+ {
	197	+- return 0;
	198	++ return ccs_socket_create(family, type, protocol, kern);
	199	+ }
	200	+
	201	+ static inline int security_socket_post_create(struct socket *sock,
	202	+@@ -1184,19 +1188,19 @@ static inline int security_socket_bind(s
	203	+ struct sockaddr *address,
	204	+ int addrlen)
	205	+ {
	206	+- return 0;
	207	++ return ccs_socket_bind(sock, address, addrlen);
	208	+ }
	209	+
	210	+ static inline int security_socket_connect(struct socket *sock,
	211	+ struct sockaddr *address,
	212	+ int addrlen)
	213	+ {
	214	+- return 0;
	215	++ return ccs_socket_connect(sock, address, addrlen);
	216	+ }
	217	+
	218	+ static inline int security_socket_listen(struct socket *sock, int backlog)
	219	+ {
	220	+- return 0;
	221	++ return ccs_socket_listen(sock, backlog);
	222	+ }
	223	+
	224	+ static inline int security_socket_accept(struct socket *sock,
	225	+@@ -1208,7 +1212,7 @@ static inline int security_socket_accept
	226	+ static inline int security_socket_sendmsg(struct socket *sock,
	227	+ struct msghdr *msg, int size)
	228	+ {
	229	+- return 0;
	230	++ return ccs_socket_sendmsg(sock, msg, size);
	231	+ }
	232	+
	233	+ static inline int security_socket_recvmsg(struct socket *sock,
	234	+@@ -1450,42 +1454,42 @@ int security_path_chroot(struct path *pa
	235	+ #else /* CONFIG_SECURITY_PATH */
	236	+ static inline int security_path_unlink(struct path dir, struct dentry dentry)
	237	+ {
	238	+- return 0;
	239	++ return ccs_path_unlink(dir, dentry);
	240	+ }
	241	+
	242	+ static inline int security_path_mkdir(struct path dir, struct dentry dentry,
	243	+ umode_t mode)
	244	+ {
	245	+- return 0;
	246	++ return ccs_path_mkdir(dir, dentry, mode);
	247	+ }
	248	+
	249	+ static inline int security_path_rmdir(struct path dir, struct dentry dentry)
	250	+ {
	251	+- return 0;
	252	++ return ccs_path_rmdir(dir, dentry);
	253	+ }
	254	+
	255	+ static inline int security_path_mknod(struct path dir, struct dentry dentry,
	256	+ umode_t mode, unsigned int dev)
	257	+ {
	258	+- return 0;
	259	++ return ccs_path_mknod(dir, dentry, mode, dev);
	260	+ }
	261	+
	262	+ static inline int security_path_truncate(struct path *path)
	263	+ {
	264	+- return 0;
	265	++ return ccs_path_truncate(path);
	266	+ }
	267	+
	268	+ static inline int security_path_symlink(struct path dir, struct dentry dentry,
	269	+ const char *old_name)
	270	+ {
	271	+- return 0;
	272	++ return ccs_path_symlink(dir, dentry, old_name);
	273	+ }
	274	+
	275	+ static inline int security_path_link(struct dentry *old_dentry,
	276	+ struct path *new_dir,
	277	+ struct dentry *new_dentry)
	278	+ {
	279	+- return 0;
	280	++ return ccs_path_link(old_dentry, new_dir, new_dentry);
	281	+ }
	282	+
	283	+ static inline int security_path_rename(struct path *old_dir,
	284	+@@ -1494,22 +1498,32 @@ static inline int security_path_rename(s
	285	+ struct dentry *new_dentry,
	286	+ unsigned int flags)
	287	+ {
	288	+- return 0;
	289	++ /*
	290	++ * Not using RENAME_EXCHANGE here in order to avoid KABI breakage
	291	++ * by doing "#include <uapi/linux/fs.h>" .
	292	++ */
	293	++ if (flags & (1 << 1)) {
	294	++ int err = ccs_path_rename(new_dir, new_dentry, old_dir,
	295	++ old_dentry);
	296	++ if (err)
	297	++ return err;
	298	++ }
	299	++ return ccs_path_rename(old_dir, old_dentry, new_dir, new_dentry);
	300	+ }
	301	+
	302	+ static inline int security_path_chmod(struct path *path, umode_t mode)
	303	+ {
	304	+- return 0;
	305	++ return ccs_path_chmod(path, mode);
	306	+ }
	307	+
	308	+ static inline int security_path_chown(struct path *path, kuid_t uid, kgid_t gid)
	309	+ {
	310	+- return 0;
	311	++ return ccs_path_chown(path, uid, gid);
	312	+ }
	313	+
	314	+ static inline int security_path_chroot(struct path *path)
	315	+ {
	316	+- return 0;
	317	++ return ccs_path_chroot(path);
	318	+ }
	319	+ #endif /* CONFIG_SECURITY_PATH */
	320	+
	321	+--- linux-4.4.92-1vl6.orig/include/net/ip.h
	322	++++ linux-4.4.92-1vl6/include/net/ip.h
	323	+@@ -223,6 +223,8 @@ void inet_get_local_port_range(struct ne
	324	+ #ifdef CONFIG_SYSCTL
	325	+ static inline int inet_is_local_reserved_port(struct net *net, int port)
	326	+ {
	327	++ if (ccs_lport_reserved(port))
	328	++ return 1;
	329	+ if (!net->ipv4.sysctl_local_reserved_ports)
	330	+ return 0;
	331	+ return test_bit(port, net->ipv4.sysctl_local_reserved_ports);
	332	+@@ -236,6 +238,8 @@ static inline bool sysctl_dev_name_is_al
	333	+ #else
	334	+ static inline int inet_is_local_reserved_port(struct net *net, int port)
	335	+ {
	336	++ if (ccs_lport_reserved(port))
	337	++ return 1;
	338	+ return 0;
	339	+ }
	340	+ #endif
	341	+--- linux-4.4.92-1vl6.orig/kernel/fork.c
	342	++++ linux-4.4.92-1vl6/kernel/fork.c
	343	+@@ -258,6 +258,7 @@ void __put_task_struct(struct task_struc
	344	+ delayacct_tsk_free(tsk);
	345	+ put_signal_struct(tsk->signal);
	346	+
	347	++ ccs_free_task_security(tsk);
	348	+ if (!profile_handoff_task(tsk))
	349	+ free_task(tsk);
	350	+ }
	351	+@@ -1454,6 +1455,9 @@ static struct task_struct *copy_process(
	352	+ goto bad_fork_cleanup_perf;
	353	+ /* copy all the process information */
	354	+ shm_init_task(p);
	355	++ retval = ccs_alloc_task_security(p);
	356	++ if (retval)
	357	++ goto bad_fork_cleanup_audit;
	358	+ retval = copy_semundo(clone_flags, p);
	359	+ if (retval)
	360	+ goto bad_fork_cleanup_audit;
	361	+@@ -1675,6 +1679,7 @@ bad_fork_cleanup_semundo:
	362	+ exit_sem(p);
	363	+ bad_fork_cleanup_audit:
	364	+ audit_free(p);
	365	++ ccs_free_task_security(p);
	366	+ bad_fork_cleanup_perf:
	367	+ perf_event_free_task(p);
	368	+ bad_fork_cleanup_policy:
	369	+--- linux-4.4.92-1vl6.orig/kernel/kexec.c
	370	++++ linux-4.4.92-1vl6/kernel/kexec.c
	371	+@@ -17,7 +17,7 @@
	372	+ #include <linux/syscalls.h>
	373	+ #include <linux/vmalloc.h>
	374	+ #include <linux/slab.h>
	375	+-
	376	++#include <linux/ccsecurity.h>
	377	+ #include "kexec_internal.h"
	378	+
	379	+ static int copy_user_segment_list(struct kimage *image,
	380	+@@ -133,6 +133,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
	381	+ /* We only trust the superuser with rebooting the system. */
	382	+ if (!capable(CAP_SYS_BOOT) \|\| kexec_load_disabled)
	383	+ return -EPERM;
	384	++ if (!ccs_capable(CCS_SYS_KEXEC_LOAD))
	385	++ return -EPERM;
	386	+
	387	+ /*
	388	+ * Verify we have a legal set of flags
	389	+--- linux-4.4.92-1vl6.orig/kernel/module.c
	390	++++ linux-4.4.92-1vl6/kernel/module.c
	391	+@@ -61,6 +61,7 @@
	392	+ #include <linux/bsearch.h>
	393	+ #include <uapi/linux/module.h>
	394	+ #include "module-internal.h"
	395	++#include <linux/ccsecurity.h>
	396	+
	397	+ #define CREATE_TRACE_POINTS
	398	+ #include <trace/events/module.h>
	399	+@@ -959,6 +960,8 @@ SYSCALL_DEFINE2(delete_module, const cha
	400	+
	401	+ if (!capable(CAP_SYS_MODULE) \|\| modules_disabled)
	402	+ return -EPERM;
	403	++ if (!ccs_capable(CCS_USE_KERNEL_MODULE))
	404	++ return -EPERM;
	405	+
	406	+ if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0)
	407	+ return -EFAULT;
	408	+@@ -3338,6 +3341,8 @@ static int may_init_module(void)
	409	+ {
	410	+ if (!capable(CAP_SYS_MODULE) \|\| modules_disabled)
	411	+ return -EPERM;
	412	++ if (!ccs_capable(CCS_USE_KERNEL_MODULE))
	413	++ return -EPERM;
	414	+
	415	+ return 0;
	416	+ }
	417	+--- linux-4.4.92-1vl6.orig/kernel/ptrace.c
	418	++++ linux-4.4.92-1vl6/kernel/ptrace.c
	419	+@@ -1085,6 +1085,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
	420	+ {
	421	+ struct task_struct *child;
	422	+ long ret;
	423	++ {
	424	++ const int rc = ccs_ptrace_permission(request, pid);
	425	++ if (rc)
	426	++ return rc;
	427	++ }
	428	+
	429	+ if (request == PTRACE_TRACEME) {
	430	+ ret = ptrace_traceme();
	431	+@@ -1231,6 +1236,11 @@ COMPAT_SYSCALL_DEFINE4(ptrace, compat_lo
	432	+ {
	433	+ struct task_struct *child;
	434	+ long ret;
	435	++ {
	436	++ const int rc = ccs_ptrace_permission(request, pid);
	437	++ if (rc)
	438	++ return rc;
	439	++ }
	440	+
	441	+ if (request == PTRACE_TRACEME) {
	442	+ ret = ptrace_traceme();
	443	+--- linux-4.4.92-1vl6.orig/kernel/reboot.c
	444	++++ linux-4.4.92-1vl6/kernel/reboot.c
	445	+@@ -16,6 +16,7 @@
	446	+ #include <linux/syscalls.h>
	447	+ #include <linux/syscore_ops.h>
	448	+ #include <linux/uaccess.h>
	449	++#include <linux/ccsecurity.h>
	450	+
	451	+ /*
	452	+ * this indicates whether you can reboot with ctrl-alt-del: the default is yes
	453	+@@ -295,6 +296,8 @@ SYSCALL_DEFINE4(reboot, int, magic1, int
	454	+ magic2 != LINUX_REBOOT_MAGIC2B &&
	455	+ magic2 != LINUX_REBOOT_MAGIC2C))
	456	+ return -EINVAL;
	457	++ if (!ccs_capable(CCS_SYS_REBOOT))
	458	++ return -EPERM;
	459	+
	460	+ /*
	461	+ * If pid namespaces are enabled and the current task is in a child
	462	+--- linux-4.4.92-1vl6.orig/kernel/sched/core.c
	463	++++ linux-4.4.92-1vl6/kernel/sched/core.c
	464	+@@ -3548,6 +3548,8 @@ int can_nice(const struct task_struct *p
	465	+ SYSCALL_DEFINE1(nice, int, increment)
	466	+ {
	467	+ long nice, retval;
	468	++ if (!ccs_capable(CCS_SYS_NICE))
	469	++ return -EPERM;
	470	+
	471	+ /*
	472	+ * Setpriority might change our priority at the same moment.
	473	+--- linux-4.4.92-1vl6.orig/kernel/signal.c
	474	++++ linux-4.4.92-1vl6/kernel/signal.c
	475	+@@ -2855,6 +2855,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
	476	+ SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
	477	+ {
	478	+ struct siginfo info;
	479	++ if (ccs_kill_permission(pid, sig))
	480	++ return -EPERM;
	481	+
	482	+ info.si_signo = sig;
	483	+ info.si_errno = 0;
	484	+@@ -2923,6 +2925,8 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
	485	+ /* This is only valid for single tasks */
	486	+ if (pid <= 0 \|\| tgid <= 0)
	487	+ return -EINVAL;
	488	++ if (ccs_tgkill_permission(tgid, pid, sig))
	489	++ return -EPERM;
	490	+
	491	+ return do_tkill(tgid, pid, sig);
	492	+ }
	493	+@@ -2939,6 +2943,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int,
	494	+ /* This is only valid for single tasks */
	495	+ if (pid <= 0)
	496	+ return -EINVAL;
	497	++ if (ccs_tkill_permission(pid, sig))
	498	++ return -EPERM;
	499	+
	500	+ return do_tkill(0, pid, sig);
	501	+ }
	502	+@@ -2953,6 +2959,8 @@ static int do_rt_sigqueueinfo(pid_t pid,
	503	+ return -EPERM;
	504	+
	505	+ info->si_signo = sig;
	506	++ if (ccs_sigqueue_permission(pid, sig))
	507	++ return -EPERM;
	508	+
	509	+ /* POSIX.1b doesn't mention process groups. */
	510	+ return kill_proc_info(sig, info, pid);
	511	+@@ -3001,6 +3009,8 @@ static int do_rt_tgsigqueueinfo(pid_t tg
	512	+ return -EPERM;
	513	+
	514	+ info->si_signo = sig;
	515	++ if (ccs_tgsigqueue_permission(tgid, pid, sig))
	516	++ return -EPERM;
	517	+
	518	+ return do_send_specific(tgid, pid, sig, info);
	519	+ }
	520	+--- linux-4.4.92-1vl6.orig/kernel/sys.c
	521	++++ linux-4.4.92-1vl6/kernel/sys.c
	522	+@@ -183,6 +183,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
	523	+
	524	+ if (which > PRIO_USER \|\| which < PRIO_PROCESS)
	525	+ goto out;
	526	++ if (!ccs_capable(CCS_SYS_NICE)) {
	527	++ error = -EPERM;
	528	++ goto out;
	529	++ }
	530	+
	531	+ /* normalize: avoid signed division (rounding problems) */
	532	+ error = -ESRCH;
	533	+@@ -1222,6 +1226,8 @@ SYSCALL_DEFINE2(sethostname, char __user
	534	+
	535	+ if (len < 0 \|\| len > __NEW_UTS_LEN)
	536	+ return -EINVAL;
	537	++ if (!ccs_capable(CCS_SYS_SETHOSTNAME))
	538	++ return -EPERM;
	539	+ down_write(&uts_sem);
	540	+ errno = -EFAULT;
	541	+ if (!copy_from_user(tmp, name, len)) {
	542	+@@ -1272,6 +1278,8 @@ SYSCALL_DEFINE2(setdomainname, char __us
	543	+ return -EPERM;
	544	+ if (len < 0 \|\| len > __NEW_UTS_LEN)
	545	+ return -EINVAL;
	546	++ if (!ccs_capable(CCS_SYS_SETHOSTNAME))
	547	++ return -EPERM;
	548	+
	549	+ down_write(&uts_sem);
	550	+ errno = -EFAULT;
	551	+--- linux-4.4.92-1vl6.orig/kernel/time/ntp.c
	552	++++ linux-4.4.92-1vl6/kernel/time/ntp.c
	553	+@@ -16,6 +16,7 @@
	554	+ #include <linux/mm.h>
	555	+ #include <linux/module.h>
	556	+ #include <linux/rtc.h>
	557	++#include <linux/ccsecurity.h>
	558	+
	559	+ #include "ntp_internal.h"
	560	+
	561	+@@ -660,10 +661,15 @@ int ntp_validate_timex(struct timex *txc
	562	+ if (!(txc->modes & ADJ_OFFSET_READONLY) &&
	563	+ !capable(CAP_SYS_TIME))
	564	+ return -EPERM;
	565	++ if (!(txc->modes & ADJ_OFFSET_READONLY) &&
	566	++ !ccs_capable(CCS_SYS_SETTIME))
	567	++ return -EPERM;
	568	+ } else {
	569	+ /* In order to modify anything, you gotta be super-user! */
	570	+ if (txc->modes && !capable(CAP_SYS_TIME))
	571	+ return -EPERM;
	572	++ if (txc->modes && !ccs_capable(CCS_SYS_SETTIME))
	573	++ return -EPERM;
	574	+ /*
	575	+ * if the quartz is off by more than 10% then
	576	+ * something is VERY wrong!
	577	+@@ -678,6 +684,8 @@ int ntp_validate_timex(struct timex *txc
	578	+ /* In order to inject time, you gotta be super-user! */
	579	+ if (!capable(CAP_SYS_TIME))
	580	+ return -EPERM;
	581	++ if (!ccs_capable(CCS_SYS_SETTIME))
	582	++ return -EPERM;
	583	+
	584	+ if (txc->modes & ADJ_NANO) {
	585	+ struct timespec ts;
	586	+--- linux-4.4.92-1vl6.orig/net/ipv4/raw.c
	587	++++ linux-4.4.92-1vl6/net/ipv4/raw.c
	588	+@@ -742,6 +742,10 @@ static int raw_recvmsg(struct sock *sk,
	589	+ skb = skb_recv_datagram(sk, flags, noblock, &err);
	590	+ if (!skb)
	591	+ goto out;
	592	++ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
	593	++ err = -EAGAIN; /* Hope less harmful than -EPERM. */
	594	++ goto out;
	595	++ }
	596	+
	597	+ copied = skb->len;
	598	+ if (len < copied) {
	599	+--- linux-4.4.92-1vl6.orig/net/ipv4/udp.c
	600	++++ linux-4.4.92-1vl6/net/ipv4/udp.c
	601	+@@ -1286,6 +1286,10 @@ try_again:
	602	+ &peeked, &off, &err);
	603	+ if (!skb)
	604	+ goto out;
	605	++ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
	606	++ err = -EAGAIN; /* Hope less harmful than -EPERM. */
	607	++ goto out;
	608	++ }
	609	+
	610	+ ulen = skb->len - sizeof(struct udphdr);
	611	+ copied = len;
	612	+--- linux-4.4.92-1vl6.orig/net/ipv6/raw.c
	613	++++ linux-4.4.92-1vl6/net/ipv6/raw.c
	614	+@@ -478,6 +478,10 @@ static int rawv6_recvmsg(struct sock *sk
	615	+ skb = skb_recv_datagram(sk, flags, noblock, &err);
	616	+ if (!skb)
	617	+ goto out;
	618	++ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
	619	++ err = -EAGAIN; /* Hope less harmful than -EPERM. */
	620	++ goto out;
	621	++ }
	622	+
	623	+ copied = skb->len;
	624	+ if (copied > len) {
	625	+--- linux-4.4.92-1vl6.orig/net/ipv6/udp.c
	626	++++ linux-4.4.92-1vl6/net/ipv6/udp.c
	627	+@@ -417,6 +417,10 @@ try_again:
	628	+ &peeked, &off, &err);
	629	+ if (!skb)
	630	+ goto out;
	631	++ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
	632	++ err = -EAGAIN; /* Hope less harmful than -EPERM. */
	633	++ goto out;
	634	++ }
	635	+
	636	+ ulen = skb->len - sizeof(struct udphdr);
	637	+ copied = len;
	638	+--- linux-4.4.92-1vl6.orig/net/socket.c
	639	++++ linux-4.4.92-1vl6/net/socket.c
	640	+@@ -1476,6 +1476,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
	641	+ if (err < 0)
	642	+ goto out_fd;
	643	+
	644	++ if (ccs_socket_post_accept_permission(sock, newsock)) {
	645	++ err = -EAGAIN; /* Hope less harmful than -EPERM. */
	646	++ goto out_fd;
	647	++ }
	648	+ if (upeer_sockaddr) {
	649	+ if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
	650	+ &len, 2) < 0) {
	651	+--- linux-4.4.92-1vl6.orig/net/unix/af_unix.c
	652	++++ linux-4.4.92-1vl6/net/unix/af_unix.c
	653	+@@ -2144,6 +2144,10 @@ static int unix_dgram_recvmsg(struct soc
	654	+ wake_up_interruptible_sync_poll(&u->peer_wait,
	655	+ POLLOUT \| POLLWRNORM \| POLLWRBAND);
	656	+
	657	++ if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
	658	++ err = -EAGAIN; /* Hope less harmful than -EPERM. */
	659	++ goto out_unlock;
	660	++ }
	661	+ if (msg->msg_name)
	662	+ unix_copy_addr(msg, skb->sk);
	663	+
	664	+--- linux-4.4.92-1vl6.orig/security/Kconfig
	665	++++ linux-4.4.92-1vl6/security/Kconfig
	666	+@@ -163,5 +163,7 @@ config DEFAULT_SECURITY
	667	+ default "apparmor" if DEFAULT_SECURITY_APPARMOR
	668	+ default "" if DEFAULT_SECURITY_DAC
	669	+
	670	++source security/ccsecurity/Kconfig
	671	++
	672	+ endmenu
	673	+
	674	+--- linux-4.4.92-1vl6.orig/security/Makefile
	675	++++ linux-4.4.92-1vl6/security/Makefile
	676	+@@ -27,3 +27,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
	677	+ # Object integrity file lists
	678	+ subdir-$(CONFIG_INTEGRITY) += integrity
	679	+ obj-$(CONFIG_INTEGRITY) += integrity/
	680	++
	681	++subdir-$(CONFIG_CCSECURITY) += ccsecurity
	682	++obj-$(CONFIG_CCSECURITY) += ccsecurity/

--- trunk/caitsith-patch/patches/ccs-patch-4.4.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-4.4.diff (revision 250)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 4.4.88.
	1	+This is TOMOYO Linux patch for kernel 4.4.96.
2	2
3		-Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.4.88.tar.xz
	3	+Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.4.96.tar.xz
4	4	---
5	5	fs/exec.c \| 2 -
6	6	fs/open.c \| 2 +

		@@ -28,8 +28,8 @@
28	28	security/Makefile \| 3 ++
29	29	24 files changed, 150 insertions(+), 26 deletions(-)
30	30
31		---- linux-4.4.88.orig/fs/exec.c
32		-+++ linux-4.4.88/fs/exec.c
	31	+--- linux-4.4.96.orig/fs/exec.c
	32	++++ linux-4.4.96/fs/exec.c
33	33	@@ -1508,7 +1508,7 @@ static int exec_binprm(struct linux_binp
34	34	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
35	35	rcu_read_unlock();

		@@ -39,8 +39,8 @@
39	39	if (ret >= 0) {
40	40	audit_bprm(bprm);
41	41	trace_sched_process_exec(current, old_pid, bprm);
42		---- linux-4.4.88.orig/fs/open.c
43		-+++ linux-4.4.88/fs/open.c
	42	+--- linux-4.4.96.orig/fs/open.c
	43	++++ linux-4.4.96/fs/open.c
44	44	@@ -1117,6 +1117,8 @@ EXPORT_SYMBOL(sys_close);
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-4.4.88.orig/fs/proc/version.c
54		-+++ linux-4.4.88/fs/proc/version.c
	53	+--- linux-4.4.96.orig/fs/proc/version.c
	54	++++ linux-4.4.96/fs/proc/version.c
55	55	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 4.4.88 2017/09/14\n");
	62	++ printk(KERN_INFO "Hook version: 4.4.96 2017/11/04\n");
63	63	+ return 0;
64	64	+}
65	65	+fs_initcall(ccs_show_version);
66		---- linux-4.4.88.orig/include/linux/init_task.h
67		-+++ linux-4.4.88/include/linux/init_task.h
	66	+--- linux-4.4.96.orig/include/linux/init_task.h
	67	++++ linux-4.4.96/include/linux/init_task.h
68	68	@@ -183,6 +183,14 @@ extern struct task_group root_task_group
69	69	# define INIT_KASAN(tsk)
70	70	#endif

		@@ -88,8 +88,8 @@
88	88	}
89	89
90	90
91		---- linux-4.4.88.orig/include/linux/sched.h
92		-+++ linux-4.4.88/include/linux/sched.h
	91	+--- linux-4.4.96.orig/include/linux/sched.h
	92	++++ linux-4.4.96/include/linux/sched.h
93	93	@@ -6,6 +6,8 @@
94	94	#include <linux/sched/prio.h>
95	95

		@@ -110,8 +110,8 @@
110	110	/* CPU-specific state of this task */
111	111	struct thread_struct thread;
112	112	/*
113		---- linux-4.4.88.orig/include/linux/security.h
114		-+++ linux-4.4.88/include/linux/security.h
	113	+--- linux-4.4.96.orig/include/linux/security.h
	114	++++ linux-4.4.96/include/linux/security.h
115	115	@@ -53,6 +53,7 @@ struct msg_queue;
116	116	struct xattr;
117	117	struct xfrm_sec_ctx;

		@@ -318,8 +318,8 @@
318	318	}
319	319	#endif /* CONFIG_SECURITY_PATH */
320	320
321		---- linux-4.4.88.orig/include/net/ip.h
322		-+++ linux-4.4.88/include/net/ip.h
	321	+--- linux-4.4.96.orig/include/net/ip.h
	322	++++ linux-4.4.96/include/net/ip.h
323	323	@@ -223,6 +223,8 @@ void inet_get_local_port_range(struct ne
324	324	#ifdef CONFIG_SYSCTL
325	325	static inline int inet_is_local_reserved_port(struct net *net, int port)

		@@ -338,8 +338,8 @@
338	338	return 0;
339	339	}
340	340	#endif
341		---- linux-4.4.88.orig/kernel/fork.c
342		-+++ linux-4.4.88/kernel/fork.c
	341	+--- linux-4.4.96.orig/kernel/fork.c
	342	++++ linux-4.4.96/kernel/fork.c
343	343	@@ -258,6 +258,7 @@ void __put_task_struct(struct task_struc
344	344	delayacct_tsk_free(tsk);
345	345	put_signal_struct(tsk->signal);

		@@ -366,8 +366,8 @@
366	366	bad_fork_cleanup_perf:
367	367	perf_event_free_task(p);
368	368	bad_fork_cleanup_policy:
369		---- linux-4.4.88.orig/kernel/kexec.c
370		-+++ linux-4.4.88/kernel/kexec.c
	369	+--- linux-4.4.96.orig/kernel/kexec.c
	370	++++ linux-4.4.96/kernel/kexec.c
371	371	@@ -17,7 +17,7 @@
372	372	#include <linux/syscalls.h>
373	373	#include <linux/vmalloc.h>

		@@ -386,8 +386,8 @@
386	386
387	387	/*
388	388	* Verify we have a legal set of flags
389		---- linux-4.4.88.orig/kernel/module.c
390		-+++ linux-4.4.88/kernel/module.c
	389	+--- linux-4.4.96.orig/kernel/module.c
	390	++++ linux-4.4.96/kernel/module.c
391	391	@@ -61,6 +61,7 @@
392	392	#include <linux/bsearch.h>
393	393	#include <uapi/linux/module.h>

		@@ -414,8 +414,8 @@
414	414
415	415	return 0;
416	416	}
417		---- linux-4.4.88.orig/kernel/ptrace.c
418		-+++ linux-4.4.88/kernel/ptrace.c
	417	+--- linux-4.4.96.orig/kernel/ptrace.c
	418	++++ linux-4.4.96/kernel/ptrace.c
419	419	@@ -1085,6 +1085,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
420	420	{
421	421	struct task_struct *child;

		@@ -440,8 +440,8 @@
440	440
441	441	if (request == PTRACE_TRACEME) {
442	442	ret = ptrace_traceme();
443		---- linux-4.4.88.orig/kernel/reboot.c
444		-+++ linux-4.4.88/kernel/reboot.c
	443	+--- linux-4.4.96.orig/kernel/reboot.c
	444	++++ linux-4.4.96/kernel/reboot.c
445	445	@@ -16,6 +16,7 @@
446	446	#include <linux/syscalls.h>
447	447	#include <linux/syscore_ops.h>

		@@ -459,8 +459,8 @@
459	459
460	460	/*
461	461	* If pid namespaces are enabled and the current task is in a child
462		---- linux-4.4.88.orig/kernel/sched/core.c
463		-+++ linux-4.4.88/kernel/sched/core.c
	462	+--- linux-4.4.96.orig/kernel/sched/core.c
	463	++++ linux-4.4.96/kernel/sched/core.c
464	464	@@ -3548,6 +3548,8 @@ int can_nice(const struct task_struct *p
465	465	SYSCALL_DEFINE1(nice, int, increment)
466	466	{

		@@ -470,8 +470,8 @@
470	470
471	471	/*
472	472	* Setpriority might change our priority at the same moment.
473		---- linux-4.4.88.orig/kernel/signal.c
474		-+++ linux-4.4.88/kernel/signal.c
	473	+--- linux-4.4.96.orig/kernel/signal.c
	474	++++ linux-4.4.96/kernel/signal.c
475	475	@@ -2855,6 +2855,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
476	476	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
477	477	{

		@@ -517,8 +517,8 @@
517	517
518	518	return do_send_specific(tgid, pid, sig, info);
519	519	}
520		---- linux-4.4.88.orig/kernel/sys.c
521		-+++ linux-4.4.88/kernel/sys.c
	520	+--- linux-4.4.96.orig/kernel/sys.c
	521	++++ linux-4.4.96/kernel/sys.c
522	522	@@ -183,6 +183,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
523	523
524	524	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -548,8 +548,8 @@
548	548
549	549	down_write(&uts_sem);
550	550	errno = -EFAULT;
551		---- linux-4.4.88.orig/kernel/time/ntp.c
552		-+++ linux-4.4.88/kernel/time/ntp.c
	551	+--- linux-4.4.96.orig/kernel/time/ntp.c
	552	++++ linux-4.4.96/kernel/time/ntp.c
553	553	@@ -16,6 +16,7 @@
554	554	#include <linux/mm.h>
555	555	#include <linux/module.h>

		@@ -583,8 +583,8 @@
583	583
584	584	if (txc->modes & ADJ_NANO) {
585	585	struct timespec ts;
586		---- linux-4.4.88.orig/net/ipv4/raw.c
587		-+++ linux-4.4.88/net/ipv4/raw.c
	586	+--- linux-4.4.96.orig/net/ipv4/raw.c
	587	++++ linux-4.4.96/net/ipv4/raw.c
588	588	@@ -742,6 +742,10 @@ static int raw_recvmsg(struct sock *sk,
589	589	skb = skb_recv_datagram(sk, flags, noblock, &err);
590	590	if (!skb)

		@@ -596,8 +596,8 @@
596	596
597	597	copied = skb->len;
598	598	if (len < copied) {
599		---- linux-4.4.88.orig/net/ipv4/udp.c
600		-+++ linux-4.4.88/net/ipv4/udp.c
	599	+--- linux-4.4.96.orig/net/ipv4/udp.c
	600	++++ linux-4.4.96/net/ipv4/udp.c
601	601	@@ -1286,6 +1286,10 @@ try_again:
602	602	&peeked, &off, &err);
603	603	if (!skb)

		@@ -609,8 +609,8 @@
609	609
610	610	ulen = skb->len - sizeof(struct udphdr);
611	611	copied = len;
612		---- linux-4.4.88.orig/net/ipv6/raw.c
613		-+++ linux-4.4.88/net/ipv6/raw.c
	612	+--- linux-4.4.96.orig/net/ipv6/raw.c
	613	++++ linux-4.4.96/net/ipv6/raw.c
614	614	@@ -478,6 +478,10 @@ static int rawv6_recvmsg(struct sock *sk
615	615	skb = skb_recv_datagram(sk, flags, noblock, &err);
616	616	if (!skb)

		@@ -622,8 +622,8 @@
622	622
623	623	copied = skb->len;
624	624	if (copied > len) {
625		---- linux-4.4.88.orig/net/ipv6/udp.c
626		-+++ linux-4.4.88/net/ipv6/udp.c
	625	+--- linux-4.4.96.orig/net/ipv6/udp.c
	626	++++ linux-4.4.96/net/ipv6/udp.c
627	627	@@ -417,6 +417,10 @@ try_again:
628	628	&peeked, &off, &err);
629	629	if (!skb)

		@@ -635,8 +635,8 @@
635	635
636	636	ulen = skb->len - sizeof(struct udphdr);
637	637	copied = len;
638		---- linux-4.4.88.orig/net/socket.c
639		-+++ linux-4.4.88/net/socket.c
	638	+--- linux-4.4.96.orig/net/socket.c
	639	++++ linux-4.4.96/net/socket.c
640	640	@@ -1476,6 +1476,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
641	641	if (err < 0)
642	642	goto out_fd;

		@@ -648,8 +648,8 @@
648	648	if (upeer_sockaddr) {
649	649	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
650	650	&len, 2) < 0) {
651		---- linux-4.4.88.orig/net/unix/af_unix.c
652		-+++ linux-4.4.88/net/unix/af_unix.c
	651	+--- linux-4.4.96.orig/net/unix/af_unix.c
	652	++++ linux-4.4.96/net/unix/af_unix.c
653	653	@@ -2144,6 +2144,10 @@ static int unix_dgram_recvmsg(struct soc
654	654	wake_up_interruptible_sync_poll(&u->peer_wait,
655	655	POLLOUT \| POLLWRNORM \| POLLWRBAND);

		@@ -661,8 +661,8 @@
661	661	if (msg->msg_name)
662	662	unix_copy_addr(msg, skb->sk);
663	663
664		---- linux-4.4.88.orig/security/Kconfig
665		-+++ linux-4.4.88/security/Kconfig
	664	+--- linux-4.4.96.orig/security/Kconfig
	665	++++ linux-4.4.96/security/Kconfig
666	666	@@ -163,5 +163,7 @@ config DEFAULT_SECURITY
667	667	default "apparmor" if DEFAULT_SECURITY_APPARMOR
668	668	default "" if DEFAULT_SECURITY_DAC

		@@ -671,8 +671,8 @@
671	671	+
672	672	endmenu
673	673
674		---- linux-4.4.88.orig/security/Makefile
675		-+++ linux-4.4.88/security/Makefile
	674	+--- linux-4.4.96.orig/security/Makefile
	675	++++ linux-4.4.96/security/Makefile
676	676	@@ -27,3 +27,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
677	677	# Object integrity file lists
678	678	subdir-$(CONFIG_INTEGRITY) += integrity

--- trunk/caitsith-patch/patches/ccs-patch-4.9.diff (revision 249)

+++ trunk/caitsith-patch/patches/ccs-patch-4.9.diff (revision 250)

		@@ -1,6 +1,6 @@
1		-This is TOMOYO Linux patch for kernel 4.9.50.
	1	+This is TOMOYO Linux patch for kernel 4.9.60.
2	2
3		-Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.9.50.tar.xz
	3	+Source code for this patch is https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.9.60.tar.xz
4	4	---
5	5	fs/exec.c \| 2 -
6	6	fs/open.c \| 2 +

		@@ -28,8 +28,8 @@
28	28	security/Makefile \| 3 ++
29	29	24 files changed, 147 insertions(+), 26 deletions(-)
30	30
31		---- linux-4.9.50.orig/fs/exec.c
32		-+++ linux-4.9.50/fs/exec.c
	31	+--- linux-4.9.60.orig/fs/exec.c
	32	++++ linux-4.9.60/fs/exec.c
33	33	@@ -1661,7 +1661,7 @@ static int exec_binprm(struct linux_binp
34	34	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
35	35	rcu_read_unlock();

		@@ -39,8 +39,8 @@
39	39	if (ret >= 0) {
40	40	audit_bprm(bprm);
41	41	trace_sched_process_exec(current, old_pid, bprm);
42		---- linux-4.9.50.orig/fs/open.c
43		-+++ linux-4.9.50/fs/open.c
	42	+--- linux-4.9.60.orig/fs/open.c
	43	++++ linux-4.9.60/fs/open.c
44	44	@@ -1151,6 +1151,8 @@ EXPORT_SYMBOL(sys_close);
45	45	*/
46	46	SYSCALL_DEFINE0(vhangup)

		@@ -50,8 +50,8 @@
50	50	if (capable(CAP_SYS_TTY_CONFIG)) {
51	51	tty_vhangup_self();
52	52	return 0;
53		---- linux-4.9.50.orig/fs/proc/version.c
54		-+++ linux-4.9.50/fs/proc/version.c
	53	+--- linux-4.9.60.orig/fs/proc/version.c
	54	++++ linux-4.9.60/fs/proc/version.c
55	55	@@ -32,3 +32,10 @@ static int __init proc_version_init(void
56	56	return 0;
57	57	}

		@@ -59,12 +59,12 @@
59	59	+
60	60	+static int __init ccs_show_version(void)
61	61	+{
62		-+ printk(KERN_INFO "Hook version: 4.9.50 2017/09/14\n");
	62	++ printk(KERN_INFO "Hook version: 4.9.60 2017/11/04\n");
63	63	+ return 0;
64	64	+}
65	65	+fs_initcall(ccs_show_version);
66		---- linux-4.9.50.orig/include/linux/init_task.h
67		-+++ linux-4.9.50/include/linux/init_task.h
	66	+--- linux-4.9.60.orig/include/linux/init_task.h
	67	++++ linux-4.9.60/include/linux/init_task.h
68	68	@@ -193,6 +193,14 @@ extern struct task_group root_task_group
69	69	# define INIT_TASK_TI(tsk)
70	70	#endif

		@@ -88,8 +88,8 @@
88	88	}
89	89
90	90
91		---- linux-4.9.50.orig/include/linux/sched.h
92		-+++ linux-4.9.50/include/linux/sched.h
	91	+--- linux-4.9.60.orig/include/linux/sched.h
	92	++++ linux-4.9.60/include/linux/sched.h
93	93	@@ -6,6 +6,8 @@
94	94	#include <linux/sched/prio.h>
95	95

		@@ -110,8 +110,8 @@
110	110	/* CPU-specific state of this task */
111	111	struct thread_struct thread;
112	112	/*
113		---- linux-4.9.50.orig/include/linux/security.h
114		-+++ linux-4.9.50/include/linux/security.h
	113	+--- linux-4.9.60.orig/include/linux/security.h
	114	++++ linux-4.9.60/include/linux/security.h
115	115	@@ -55,6 +55,7 @@ struct msg_queue;
116	116	struct xattr;
117	117	struct xfrm_sec_ctx;

		@@ -318,8 +318,8 @@
318	318	}
319	319	#endif /* CONFIG_SECURITY_PATH */
320	320
321		---- linux-4.9.50.orig/include/net/ip.h
322		-+++ linux-4.9.50/include/net/ip.h
	321	+--- linux-4.9.60.orig/include/net/ip.h
	322	++++ linux-4.9.60/include/net/ip.h
323	323	@@ -252,6 +252,8 @@ void inet_get_local_port_range(struct ne
324	324	#ifdef CONFIG_SYSCTL
325	325	static inline int inet_is_local_reserved_port(struct net *net, int port)

		@@ -338,8 +338,8 @@
338	338	return 0;
339	339	}
340	340	#endif
341		---- linux-4.9.50.orig/kernel/fork.c
342		-+++ linux-4.9.50/kernel/fork.c
	341	+--- linux-4.9.60.orig/kernel/fork.c
	342	++++ linux-4.9.60/kernel/fork.c
343	343	@@ -390,6 +390,7 @@ void __put_task_struct(struct task_struc
344	344	delayacct_tsk_free(tsk);
345	345	put_signal_struct(tsk->signal);

		@@ -366,8 +366,8 @@
366	366	bad_fork_cleanup_perf:
367	367	perf_event_free_task(p);
368	368	bad_fork_cleanup_policy:
369		---- linux-4.9.50.orig/kernel/kexec.c
370		-+++ linux-4.9.50/kernel/kexec.c
	369	+--- linux-4.9.60.orig/kernel/kexec.c
	370	++++ linux-4.9.60/kernel/kexec.c
371	371	@@ -17,7 +17,7 @@
372	372	#include <linux/syscalls.h>
373	373	#include <linux/vmalloc.h>

		@@ -386,8 +386,8 @@
386	386
387	387	/*
388	388	* Verify we have a legal set of flags
389		---- linux-4.9.50.orig/kernel/module.c
390		-+++ linux-4.9.50/kernel/module.c
	389	+--- linux-4.9.60.orig/kernel/module.c
	390	++++ linux-4.9.60/kernel/module.c
391	391	@@ -63,6 +63,7 @@
392	392	#include <linux/dynamic_debug.h>
393	393	#include <uapi/linux/module.h>

		@@ -414,8 +414,8 @@
414	414
415	415	return 0;
416	416	}
417		---- linux-4.9.50.orig/kernel/ptrace.c
418		-+++ linux-4.9.50/kernel/ptrace.c
	417	+--- linux-4.9.60.orig/kernel/ptrace.c
	418	++++ linux-4.9.60/kernel/ptrace.c
419	419	@@ -1122,6 +1122,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
420	420	{
421	421	struct task_struct *child;

		@@ -440,8 +440,8 @@
440	440
441	441	if (request == PTRACE_TRACEME) {
442	442	ret = ptrace_traceme();
443		---- linux-4.9.50.orig/kernel/reboot.c
444		-+++ linux-4.9.50/kernel/reboot.c
	443	+--- linux-4.9.60.orig/kernel/reboot.c
	444	++++ linux-4.9.60/kernel/reboot.c
445	445	@@ -16,6 +16,7 @@
446	446	#include <linux/syscalls.h>
447	447	#include <linux/syscore_ops.h>

		@@ -459,9 +459,9 @@
459	459
460	460	/*
461	461	* If pid namespaces are enabled and the current task is in a child
462		---- linux-4.9.50.orig/kernel/sched/core.c
463		-+++ linux-4.9.50/kernel/sched/core.c
464		-@@ -3811,6 +3811,8 @@ int can_nice(const struct task_struct *p
	462	+--- linux-4.9.60.orig/kernel/sched/core.c
	463	++++ linux-4.9.60/kernel/sched/core.c
	464	+@@ -3812,6 +3812,8 @@ int can_nice(const struct task_struct *p
465	465	SYSCALL_DEFINE1(nice, int, increment)
466	466	{
467	467	long nice, retval;

		@@ -470,8 +470,8 @@
470	470
471	471	/*
472	472	* Setpriority might change our priority at the same moment.
473		---- linux-4.9.50.orig/kernel/signal.c
474		-+++ linux-4.9.50/kernel/signal.c
	473	+--- linux-4.9.60.orig/kernel/signal.c
	474	++++ linux-4.9.60/kernel/signal.c
475	475	@@ -2855,6 +2855,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
476	476	SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
477	477	{

		@@ -517,8 +517,8 @@
517	517
518	518	return do_send_specific(tgid, pid, sig, info);
519	519	}
520		---- linux-4.9.50.orig/kernel/sys.c
521		-+++ linux-4.9.50/kernel/sys.c
	520	+--- linux-4.9.60.orig/kernel/sys.c
	521	++++ linux-4.9.60/kernel/sys.c
522	522	@@ -183,6 +183,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
523	523
524	524	if (which > PRIO_USER \|\| which < PRIO_PROCESS)

		@@ -548,8 +548,8 @@
548	548
549	549	down_write(&uts_sem);
550	550	errno = -EFAULT;
551		---- linux-4.9.50.orig/kernel/time/ntp.c
552		-+++ linux-4.9.50/kernel/time/ntp.c
	551	+--- linux-4.9.60.orig/kernel/time/ntp.c
	552	++++ linux-4.9.60/kernel/time/ntp.c
553	553	@@ -17,6 +17,7 @@
554	554	#include <linux/module.h>
555	555	#include <linux/rtc.h>

		@@ -583,8 +583,8 @@
583	583
584	584	if (txc->modes & ADJ_NANO) {
585	585	struct timespec ts;
586		---- linux-4.9.50.orig/net/ipv4/raw.c
587		-+++ linux-4.9.50/net/ipv4/raw.c
	586	+--- linux-4.9.60.orig/net/ipv4/raw.c
	587	++++ linux-4.9.60/net/ipv4/raw.c
588	588	@@ -739,6 +739,10 @@ static int raw_recvmsg(struct sock *sk,
589	589	skb = skb_recv_datagram(sk, flags, noblock, &err);
590	590	if (!skb)

		@@ -596,8 +596,8 @@
596	596
597	597	copied = skb->len;
598	598	if (len < copied) {
599		---- linux-4.9.50.orig/net/ipv4/udp.c
600		-+++ linux-4.9.50/net/ipv4/udp.c
	599	+--- linux-4.9.60.orig/net/ipv4/udp.c
	600	++++ linux-4.9.60/net/ipv4/udp.c
601	601	@@ -1267,6 +1267,8 @@ try_again:
602	602	&peeked, &off, &err);
603	603	if (!skb)

		@@ -607,8 +607,8 @@
607	607
608	608	ulen = skb->len;
609	609	copied = len;
610		---- linux-4.9.50.orig/net/ipv6/raw.c
611		-+++ linux-4.9.50/net/ipv6/raw.c
	610	+--- linux-4.9.60.orig/net/ipv6/raw.c
	611	++++ linux-4.9.60/net/ipv6/raw.c
612	612	@@ -478,6 +478,10 @@ static int rawv6_recvmsg(struct sock *sk
613	613	skb = skb_recv_datagram(sk, flags, noblock, &err);
614	614	if (!skb)

		@@ -620,8 +620,8 @@
620	620
621	621	copied = skb->len;
622	622	if (copied > len) {
623		---- linux-4.9.50.orig/net/ipv6/udp.c
624		-+++ linux-4.9.50/net/ipv6/udp.c
	623	+--- linux-4.9.60.orig/net/ipv6/udp.c
	624	++++ linux-4.9.60/net/ipv6/udp.c
625	625	@@ -348,6 +348,8 @@ try_again:
626	626	&peeked, &off, &err);
627	627	if (!skb)

		@@ -631,8 +631,8 @@
631	631
632	632	ulen = skb->len;
633	633	copied = len;
634		---- linux-4.9.50.orig/net/socket.c
635		-+++ linux-4.9.50/net/socket.c
	634	+--- linux-4.9.60.orig/net/socket.c
	635	++++ linux-4.9.60/net/socket.c
636	636	@@ -1481,6 +1481,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
637	637	if (err < 0)
638	638	goto out_fd;

		@@ -644,8 +644,8 @@
644	644	if (upeer_sockaddr) {
645	645	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
646	646	&len, 2) < 0) {
647		---- linux-4.9.50.orig/net/unix/af_unix.c
648		-+++ linux-4.9.50/net/unix/af_unix.c
	647	+--- linux-4.9.60.orig/net/unix/af_unix.c
	648	++++ linux-4.9.60/net/unix/af_unix.c
649	649	@@ -2150,6 +2150,10 @@ static int unix_dgram_recvmsg(struct soc
650	650	POLLOUT \| POLLWRNORM \|
651	651	POLLWRBAND);

		@@ -665,8 +665,8 @@
665	665	mutex_unlock(&u->iolock);
666	666	out:
667	667	return err;
668		---- linux-4.9.50.orig/security/Kconfig
669		-+++ linux-4.9.50/security/Kconfig
	668	+--- linux-4.9.60.orig/security/Kconfig
	669	++++ linux-4.9.60/security/Kconfig
670	670	@@ -204,5 +204,7 @@ config DEFAULT_SECURITY
671	671	default "apparmor" if DEFAULT_SECURITY_APPARMOR
672	672	default "" if DEFAULT_SECURITY_DAC

		@@ -675,8 +675,8 @@
675	675	+
676	676	endmenu
677	677
678		---- linux-4.9.50.orig/security/Makefile
679		-+++ linux-4.9.50/security/Makefile
	678	+--- linux-4.9.60.orig/security/Makefile
	679	++++ linux-4.9.60/security/Makefile
680	680	@@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_c
681	681	# Object integrity file lists
682	682	subdir-$(CONFIG_INTEGRITY) += integrity

--- trunk/caitsith-patch/specs/build-vl6-3.4.sh (revision 249)

+++ trunk/caitsith-patch/specs/build-vl6-3.4.sh (nonexistent)

		@@ -1,93 +0,0 @@
1		-#! /bin/sh
2		-#
3		-# This is a kernel build script for VineLinux 6's 3.4 kernel.
4		-#
5		-
6		-die () {
7		- echo $1
8		- exit 1
9		-}
10		-
11		-cd /tmp/ \|\| die "Can't chdir to /tmp/ ."
12		-
13		-if [ ! -r kernel-3.4.110-4vl6.src.rpm ]
14		-then
15		- wget http://updates.vinelinux.org/Vine-6.5/updates/SRPMS/kernel-3.4.110-4vl6.src.rpm \|\| die "Can't download source package."
16		-fi
17		-LANG=C rpm --checksig kernel-3.4.110-4vl6.src.rpm \| grep -F ': (sha1) dsa sha1 md5 gpg OK' \|\| die "Can't verify signature."
18		-rpm -ivh kernel-3.4.110-4vl6.src.rpm \|\| die "Can't install source package."
19		-
20		-cd ~/rpm/SOURCES/ \|\| die "Can't chdir to ~/rpm/SOURCES/ ."
21		-if [ ! -r caitsith-patch-0.2-20170917.tar.gz ]
22		-then
23		- wget -O caitsith-patch-0.2-20170917.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170917.tar.gz' \|\| die "Can't download patch."
24		-fi
25		-
26		-cd /tmp/ \|\| die "Can't chdir to /tmp/ ."
27		-cp -p ~/rpm/SPECS/kernel34-vl.spec . \|\| die "Can't copy spec file."
28		-patch << "EOF" \|\| die "Can't patch spec file."
29		---- kernel34-vl.spec
30		-+++ kernel34-vl.spec
31		-@@ -34,7 +34,7 @@
32		- %define patchlevel 110
33		- %define kversion 3.%{sublevel}
34		- %define rpmversion 3.%{sublevel}.%{patchlevel}
35		--%define release 4%{?_dist_release}
36		-+%define release 4%{?_dist_release}_caitsith_0.2.2
37		-
38		- %define make_target bzImage
39		- %define hdrarch %_target_cpu
40		-@@ -126,6 +126,9 @@
41		- # to versions below the minimum
42		- #
43		-
44		-+
45		-+%define signmodules 0
46		-+
47		- #
48		- # First the general kernel 2.6 required versions as per
49		- # Documentation/Changes
50		-@@ -158,7 +161,7 @@
51		- #
52		- %define kernel_prereq fileutils, %{kmod}, initscripts >= 8.80, mkinitrd >= 6.0.93, linux-firmware >= 20110601-1
53		-
54		--Name: kernel
55		-+Name: cs-kernel
56		- Group: System Environment/Kernel
57		- License: GPLv2
58		- Version: %{rpmversion}
59		-@@ -771,6 +774,10 @@
60		-
61		- # END OF PATCH APPLICATIONS
62		-
63		-+# CaitSith
64		-+tar -zxf %_sourcedir/caitsith-patch-0.2-20170917.tar.gz
65		-+sed -i -e 's/CCSECURITY/CAITSITH/g' -e 's/ccsecurity/caitsith/g' -e 's/ccs_domain_info/cs_domain_info/g' -e 's/ccs_flags/cs_flags/g' patches/ccs-patch-*.diff
66		-+patch -sp1 < patches/ccs-patch-3.4-vine-linux-6.diff
67		- cp %{SOURCE10} Documentation/
68		-
69		- # put Vine logo
70		-@@ -789,6 +796,9 @@
71		- for i in *.config
72		- do
73		- mv $i .config
74		-+ # CaitSith
75		-+ cat config.caitsith >> .config
76		-+ sed -i -e "s/^CONFIG_DEBUG_INFO=.*/# CONFIG_DEBUG_INFO is not set/" -- .config
77		- Arch=`head -1 .config \| cut -b 3-`
78		- make ARCH=$Arch oldnoconfig
79		- echo "# $Arch" > configs/$i
80		-EOF
81		-mv kernel34-vl.spec cs-kernel.spec \|\| die "Can't rename spec file."
82		-echo ""
83		-echo ""
84		-echo ""
85		-echo "Edit /tmp/cs-kernel.spec if needed, and run"
86		-echo "rpmbuild -bb /tmp/cs-kernel.spec"
87		-echo "to build kernel rpm packages."
88		-echo ""
89		-ARCH=`uname -m`
90		-echo "I'll start 'rpmbuild -bb --target $ARCH /tmp/cs-kernel.spec' in 30 seconds. Press Ctrl-C to stop."
91		-sleep 30
92		-exec rpmbuild -bb --target $ARCH /tmp/cs-kernel.spec
93		-exit 0

Deleted: svn:executable

## -1 +0,0 ##

\ No newline at end of property

--- trunk/caitsith-patch/specs/build-c6-2.6.32.sh (revision 249)

+++ trunk/caitsith-patch/specs/build-c6-2.6.32.sh (revision 250)

		@@ -10,12 +10,12 @@
10	10
11	11	cd /tmp/ \|\| die "Can't chdir to /tmp/ ."
12	12
13		-if [ ! -r kernel-2.6.32-696.10.2.el6.src.rpm ]
	13	+if [ ! -r kernel-2.6.32-696.13.2.el6.src.rpm ]
14	14	then
15		- wget http://vault.centos.org/6.9/updates/Source/SPackages/kernel-2.6.32-696.10.2.el6.src.rpm \|\| die "Can't download source package."
	15	+ wget http://vault.centos.org/6.9/updates/Source/SPackages/kernel-2.6.32-696.13.2.el6.src.rpm \|\| die "Can't download source package."
16	16	fi
17		-LANG=C rpm --checksig kernel-2.6.32-696.10.2.el6.src.rpm \| grep -F ': rsa sha1 (md5) pgp md5 OK' \|\| die "Can't verify signature."
18		-rpm -ivh kernel-2.6.32-696.10.2.el6.src.rpm \|\| die "Can't install source package."
	17	+LANG=C rpm --checksig kernel-2.6.32-696.13.2.el6.src.rpm \| grep -F ': rsa sha1 (md5) pgp md5 OK' \|\| die "Can't verify signature."
	18	+rpm -ivh kernel-2.6.32-696.13.2.el6.src.rpm \|\| die "Can't install source package."
19	19
20	20	cd ~/rpmbuild/SOURCES/ \|\| die "Can't chdir to ~/rpmbuild/SOURCES/ ."
21	21	if [ ! -r caitsith-patch-0.2-20170917.tar.gz ]

		@@ -35,7 +35,7 @@
35	35	-# % define buildid .local
36	36	+%define buildid _caitsith_0.2.2
37	37
38		- %define distro_build 696.10.2
	38	+ %define distro_build 696.13.2
39	39	%define signmodules 1
40	40	@@ -437,7 +437,7 @@
41	41	# Packages that need to be installed before the kernel is, because the %post

--- trunk/caitsith-patch/specs/build-c7-3.10.sh (revision 249)

+++ trunk/caitsith-patch/specs/build-c7-3.10.sh (revision 250)

		@@ -10,12 +10,12 @@
10	10
11	11	cd /tmp/ \|\| die "Can't chdir to /tmp/ ."
12	12
13		-if [ ! -r kernel-3.10.0-693.2.2.el7.src.rpm ]
	13	+if [ ! -r kernel-3.10.0-693.5.2.el7.src.rpm ]
14	14	then
15		- wget http://vault.centos.org/centos/7/updates/Source/SPackages/kernel-3.10.0-693.2.2.el7.src.rpm \|\| die "Can't download source package."
	15	+ wget http://vault.centos.org/centos/7/updates/Source/SPackages/kernel-3.10.0-693.5.2.el7.src.rpm \|\| die "Can't download source package."
16	16	fi
17		-LANG=C rpm --checksig kernel-3.10.0-693.2.2.el7.src.rpm \| grep -F ': rsa sha1 (md5) pgp md5 OK' \|\| die "Can't verify signature."
18		-rpm -ivh kernel-3.10.0-693.2.2.el7.src.rpm \|\| die "Can't install source package."
	17	+LANG=C rpm --checksig kernel-3.10.0-693.5.2.el7.src.rpm \| grep -F ': rsa sha1 (md5) pgp md5 OK' \|\| die "Can't verify signature."
	18	+rpm -ivh kernel-3.10.0-693.5.2.el7.src.rpm \|\| die "Can't install source package."
19	19
20	20	cd ~/rpmbuild/SOURCES/ \|\| die "Can't chdir to ~/rpmbuild/SOURCES/ ."
21	21	if [ ! -r caitsith-patch-0.2-20170917.tar.gz ]

--- trunk/caitsith-patch/specs/build-vl6-4.4.sh (nonexistent)

+++ trunk/caitsith-patch/specs/build-vl6-4.4.sh (revision 250)

		@@ -0,0 +1,93 @@
	1	+#! /bin/sh
	2	+#
	3	+# This is a kernel build script for VineLinux 6's 4.4 kernel.
	4	+#
	5	+
	6	+die () {
	7	+ echo $1
	8	+ exit 1
	9	+}
	10	+
	11	+cd /tmp/ \|\| die "Can't chdir to /tmp/ ."
	12	+
	13	+if [ ! -r kernel-4.4.92-1vl6.src.rpm ]
	14	+then
	15	+ wget http://updates.vinelinux.org/Vine-6.5/updates/SRPMS/kernel-4.4.92-1vl6.src.rpm \|\| die "Can't download source package."
	16	+fi
	17	+LANG=C rpm --checksig kernel-4.4.92-1vl6.src.rpm \| grep -F ': (sha1) dsa sha1 md5 gpg OK' \|\| die "Can't verify signature."
	18	+rpm -ivh kernel-4.4.92-1vl6.src.rpm \|\| die "Can't install source package."
	19	+
	20	+cd ~/rpm/SOURCES/ \|\| die "Can't chdir to ~/rpm/SOURCES/ ."
	21	+if [ ! -r caitsith-patch-0.2-20170917.tar.gz ]
	22	+then
	23	+ wget -O caitsith-patch-0.2-20170917.tar.gz 'http://osdn.jp/frs/redir.php?f=/caitsith/66537/caitsith-patch-0.2-20170917.tar.gz' \|\| die "Can't download patch."
	24	+fi
	25	+
	26	+cd /tmp/ \|\| die "Can't chdir to /tmp/ ."
	27	+cp -p ~/rpm/SPECS/kernel44-vl.spec . \|\| die "Can't copy spec file."
	28	+patch << "EOF" \|\| die "Can't patch spec file."
	29	+--- kernel44-vl.spec
	30	++++ kernel44-vl.spec
	31	+@@ -34,7 +34,7 @@
	32	+ %define patchlevel 92
	33	+ %define kversion 4.%{sublevel}
	34	+ %define rpmversion 4.%{sublevel}.%{patchlevel}
	35	+-%define release 1%{?_dist_release}
	36	++%define release 1%{?_dist_release}_caitsith_0.2.2
	37	+
	38	+ %define make_target bzImage
	39	+ %define hdrarch %_target_cpu
	40	+@@ -126,6 +126,9 @@
	41	+ # to versions below the minimum
	42	+ #
	43	+
	44	++
	45	++%define signmodules 0
	46	++
	47	+ #
	48	+ # First the general kernel 2.6 required versions as per
	49	+ # Documentation/Changes
	50	+@@ -158,7 +161,7 @@
	51	+ #
	52	+ %define kernel_prereq fileutils, %{kmod}, initscripts >= 8.80, mkinitrd >= 6.0.93, linux-firmware >= 20110601-1
	53	+
	54	+-Name: kernel
	55	++Name: cs-kernel
	56	+ Group: System Environment/Kernel
	57	+ License: GPLv2
	58	+ Version: %{rpmversion}
	59	+@@ -666,6 +669,10 @@
	60	+
	61	+ # END OF PATCH APPLICATIONS
	62	+
	63	++# CaitSith
	64	++tar -zxf %_sourcedir/caitsith-patch-0.2-20170917.tar.gz
	65	++sed -i -e 's/CCSECURITY/CAITSITH/g' -e 's/ccsecurity/caitsith/g' -e 's/ccs_domain_info/cs_domain_info/g' -e 's/ccs_flags/cs_flags/g' patches/ccs-patch-*.diff
	66	++patch -sp1 < patches/ccs-patch-4.4-vine-linux-6.diff
	67	+ cp %{SOURCE10} Documentation/
	68	+
	69	+ # put Vine logo
	70	+@@ -684,6 +691,9 @@
	71	+ for i in *.config
	72	+ do
	73	+ mv $i .config
	74	++ # CaitSith
	75	++ cat config.caitsith >> .config
	76	++ sed -i -e "s/^CONFIG_DEBUG_INFO=.*/# CONFIG_DEBUG_INFO is not set/" -- .config
	77	+ Arch=`head -1 .config \| cut -b 3-`
	78	+ make ARCH=$Arch oldnoconfig
	79	+ echo "# $Arch" > configs/$i
	80	+EOF
	81	+mv kernel44-vl.spec cs-kernel.spec \|\| die "Can't rename spec file."
	82	+echo ""
	83	+echo ""
	84	+echo ""
	85	+echo "Edit /tmp/cs-kernel.spec if needed, and run"
	86	+echo "rpmbuild -bb /tmp/cs-kernel.spec"
	87	+echo "to build kernel rpm packages."
	88	+echo ""
	89	+ARCH=`uname -m`
	90	+echo "I'll start 'rpmbuild -bb --target $ARCH /tmp/cs-kernel.spec' in 30 seconds. Press Ctrl-C to stop."
	91	+sleep 30
	92	+exec rpmbuild -bb --target $ARCH /tmp/cs-kernel.spec
	93	+exit 0

Added: svn:executable

## -0,0 +1 ##

\ No newline at end of property

旧リポジトリブラウザで表示