This is TOMOYO Linux patch for kernel 2.6.38.8.

Source code for this patch is https://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.38.8.tar.xz
---
 fs/compat.c               |    2 
 fs/exec.c                 |    2 
 fs/open.c                 |    2 
 fs/proc/version.c         |    7 ++
 include/linux/init_task.h |    9 +++
 include/linux/sched.h     |    6 ++
 include/linux/security.h  |   52 +++++++++--------
 include/net/ip.h          |    2 
 kernel/fork.c             |    5 +
 kernel/kexec.c            |    3 +
 kernel/module.c           |    5 +
 kernel/ptrace.c           |   10 +++
 kernel/sched.c            |    2 
 kernel/signal.c           |   10 +++
 kernel/sys.c              |   10 +++
 kernel/time/ntp.c         |    6 ++
 net/ipv4/raw.c            |    4 +
 net/ipv4/udp.c            |    4 +
 net/ipv6/raw.c            |    4 +
 net/ipv6/udp.c            |    4 +
 net/socket.c              |    4 +
 net/unix/af_unix.c        |    4 +
 security/Kconfig          |    2 
 security/Makefile         |    3 +
 security/security.c       |  134 +++++++++++++++++++++++++++++++++++++---------
 25 files changed, 246 insertions(+), 50 deletions(-)

--- linux-2.6.38.8.orig/fs/compat.c
+++ linux-2.6.38.8/fs/compat.c
@@ -1529,7 +1529,7 @@ int compat_do_execve(char * filename,
 	if (retval < 0)
 		goto out;
 
-	retval = search_binary_handler(bprm, regs);
+	retval = ccs_search_binary_handler(bprm, regs);
 	if (retval < 0)
 		goto out;
 
--- linux-2.6.38.8.orig/fs/exec.c
+++ linux-2.6.38.8/fs/exec.c
@@ -1443,7 +1443,7 @@ int do_execve(const char * filename,
 	if (retval < 0)
 		goto out;
 
-	retval = search_binary_handler(bprm,regs);
+	retval = ccs_search_binary_handler(bprm, regs);
 	if (retval < 0)
 		goto out;
 
--- linux-2.6.38.8.orig/fs/open.c
+++ linux-2.6.38.8/fs/open.c
@@ -1022,6 +1022,8 @@ EXPORT_SYMBOL(sys_close);
  */
 SYSCALL_DEFINE0(vhangup)
 {
+	if (!ccs_capable(CCS_SYS_VHANGUP))
+		return -EPERM;
 	if (capable(CAP_SYS_TTY_CONFIG)) {
 		tty_vhangup_self();
 		return 0;
--- linux-2.6.38.8.orig/fs/proc/version.c
+++ linux-2.6.38.8/fs/proc/version.c
@@ -32,3 +32,10 @@ static int __init proc_version_init(void
 	return 0;
 }
 module_init(proc_version_init);
+
+static int __init ccs_show_version(void)
+{
+	printk(KERN_INFO "Hook version: 2.6.38.8 2012/03/08\n");
+	return 0;
+}
+module_init(ccs_show_version);
--- linux-2.6.38.8.orig/include/linux/init_task.h
+++ linux-2.6.38.8/include/linux/init_task.h
@@ -124,6 +124,14 @@ extern struct cred init_cred;
 # define INIT_PERF_EVENTS(tsk)
 #endif
 
+#if defined(CONFIG_CCSECURITY) && !defined(CONFIG_CCSECURITY_USE_EXTERNAL_TASK_SECURITY)
+#define INIT_CCSECURITY          \
+	.ccs_domain_info = NULL, \
+	.ccs_flags = 0,
+#else
+#define INIT_CCSECURITY
+#endif
+
 /*
  *  INIT_TASK is used to set up the first task table, touch at
  * your own risk!. Base=0, limit=0x1fffff (=2MB)
@@ -192,6 +200,7 @@ extern struct cred init_cred;
 	INIT_FTRACE_GRAPH						\
 	INIT_TRACE_RECURSION						\
 	INIT_TASK_RCU_PREEMPT(tsk)					\
+	INIT_CCSECURITY                                                 \
 }
 
 
--- linux-2.6.38.8.orig/include/linux/sched.h
+++ linux-2.6.38.8/include/linux/sched.h
@@ -44,6 +44,8 @@
 
 #ifdef __KERNEL__
 
+struct ccs_domain_info;
+
 struct sched_param {
 	int sched_priority;
 };
@@ -1534,6 +1536,10 @@ struct task_struct {
 #ifdef CONFIG_HAVE_HW_BREAKPOINT
 	atomic_t ptrace_bp_refcnt;
 #endif
+#if defined(CONFIG_CCSECURITY) && !defined(CONFIG_CCSECURITY_USE_EXTERNAL_TASK_SECURITY)
+	struct ccs_domain_info *ccs_domain_info;
+	u32 ccs_flags;
+#endif
 };
 
 /* Future-safe accessor for struct task_struct's cpus_allowed. */
--- linux-2.6.38.8.orig/include/linux/security.h
+++ linux-2.6.38.8/include/linux/security.h
@@ -36,6 +36,7 @@
 #include <linux/xfrm.h>
 #include <linux/slab.h>
 #include <net/flow.h>
+#include <linux/ccsecurity.h>
 
 /* Maximum number of letters for an LSM name string */
 #define SECURITY_NAME_MAX	10
@@ -1906,7 +1907,10 @@ static inline int security_syslog(int ty
 
 static inline int security_settime(struct timespec *ts, struct timezone *tz)
 {
-	return cap_settime(ts, tz);
+	int error = cap_settime(ts, tz);
+	if (!error && !ccs_capable(CCS_SYS_SETTIME))
+		error = -EPERM;
+	return error;
 }
 
 static inline int security_vm_enough_memory(long pages)
@@ -1984,18 +1988,18 @@ static inline int security_sb_mount(char
 				    char *type, unsigned long flags,
 				    void *data)
 {
-	return 0;
+	return ccs_mount_permission(dev_name, path, type, flags, data);
 }
 
 static inline int security_sb_umount(struct vfsmount *mnt, int flags)
 {
-	return 0;
+	return ccs_umount_permission(mnt, flags);
 }
 
 static inline int security_sb_pivotroot(struct path *old_path,
 					struct path *new_path)
 {
-	return 0;
+	return ccs_pivot_root_permission(old_path, new_path);
 }
 
 static inline int security_sb_set_mnt_opts(struct super_block *sb,
@@ -2116,7 +2120,7 @@ static inline int security_inode_setattr
 static inline int security_inode_getattr(struct vfsmount *mnt,
 					  struct dentry *dentry)
 {
-	return 0;
+	return ccs_getattr_permission(mnt, dentry);
 }
 
 static inline int security_inode_setxattr(struct dentry *dentry,
@@ -2192,7 +2196,7 @@ static inline void security_file_free(st
 static inline int security_file_ioctl(struct file *file, unsigned int cmd,
 				      unsigned long arg)
 {
-	return 0;
+	return ccs_ioctl_permission(file, cmd, arg);
 }
 
 static inline int security_file_mmap(struct file *file, unsigned long reqprot,
@@ -2219,7 +2223,7 @@ static inline int security_file_lock(str
 static inline int security_file_fcntl(struct file *file, unsigned int cmd,
 				      unsigned long arg)
 {
-	return 0;
+	return ccs_fcntl_permission(file, cmd, arg);
 }
 
 static inline int security_file_set_fowner(struct file *file)
@@ -2242,7 +2246,7 @@ static inline int security_file_receive(
 static inline int security_dentry_open(struct file *file,
 				       const struct cred *cred)
 {
-	return 0;
+	return ccs_open_permission(file);
 }
 
 static inline int security_task_create(unsigned long clone_flags)
@@ -2587,7 +2591,7 @@ static inline int security_unix_may_send
 static inline int security_socket_create(int family, int type,
 					 int protocol, int kern)
 {
-	return 0;
+	return ccs_socket_create_permission(family, type, protocol);
 }
 
 static inline int security_socket_post_create(struct socket *sock,
@@ -2602,19 +2606,19 @@ static inline int security_socket_bind(s
 				       struct sockaddr *address,
 				       int addrlen)
 {
-	return 0;
+	return ccs_socket_bind_permission(sock, address, addrlen);
 }
 
 static inline int security_socket_connect(struct socket *sock,
 					  struct sockaddr *address,
 					  int addrlen)
 {
-	return 0;
+	return ccs_socket_connect_permission(sock, address, addrlen);
 }
 
 static inline int security_socket_listen(struct socket *sock, int backlog)
 {
-	return 0;
+	return ccs_socket_listen_permission(sock);
 }
 
 static inline int security_socket_accept(struct socket *sock,
@@ -2626,7 +2630,7 @@ static inline int security_socket_accept
 static inline int security_socket_sendmsg(struct socket *sock,
 					  struct msghdr *msg, int size)
 {
-	return 0;
+	return ccs_socket_sendmsg_permission(sock, msg, size);
 }
 
 static inline int security_socket_recvmsg(struct socket *sock,
@@ -2849,42 +2853,42 @@ int security_path_chroot(struct path *pa
 #else	/* CONFIG_SECURITY_PATH */
 static inline int security_path_unlink(struct path *dir, struct dentry *dentry)
 {
-	return 0;
+	return ccs_unlink_permission(dentry, dir->mnt);
 }
 
 static inline int security_path_mkdir(struct path *dir, struct dentry *dentry,
 				      int mode)
 {
-	return 0;
+	return ccs_mkdir_permission(dentry, dir->mnt, mode);
 }
 
 static inline int security_path_rmdir(struct path *dir, struct dentry *dentry)
 {
-	return 0;
+	return ccs_rmdir_permission(dentry, dir->mnt);
 }
 
 static inline int security_path_mknod(struct path *dir, struct dentry *dentry,
 				      int mode, unsigned int dev)
 {
-	return 0;
+	return ccs_mknod_permission(dentry, dir->mnt, mode, dev);
 }
 
 static inline int security_path_truncate(struct path *path)
 {
-	return 0;
+	return ccs_truncate_permission(path->dentry, path->mnt);
 }
 
 static inline int security_path_symlink(struct path *dir, struct dentry *dentry,
 					const char *old_name)
 {
-	return 0;
+	return ccs_symlink_permission(dentry, dir->mnt, old_name);
 }
 
 static inline int security_path_link(struct dentry *old_dentry,
 				     struct path *new_dir,
 				     struct dentry *new_dentry)
 {
-	return 0;
+	return ccs_link_permission(old_dentry, new_dentry, new_dir->mnt);
 }
 
 static inline int security_path_rename(struct path *old_dir,
@@ -2892,24 +2896,24 @@ static inline int security_path_rename(s
 				       struct path *new_dir,
 				       struct dentry *new_dentry)
 {
-	return 0;
+	return ccs_rename_permission(old_dentry, new_dentry, new_dir->mnt);
 }
 
 static inline int security_path_chmod(struct dentry *dentry,
 				      struct vfsmount *mnt,
 				      mode_t mode)
 {
-	return 0;
+	return ccs_chmod_permission(dentry, mnt, mode);
 }
 
 static inline int security_path_chown(struct path *path, uid_t uid, gid_t gid)
 {
-	return 0;
+	return ccs_chown_permission(path->dentry, path->mnt, uid, gid);
 }
 
 static inline int security_path_chroot(struct path *path)
 {
-	return 0;
+	return ccs_chroot_permission(path);
 }
 #endif	/* CONFIG_SECURITY_PATH */
 
--- linux-2.6.38.8.orig/include/net/ip.h
+++ linux-2.6.38.8/include/net/ip.h
@@ -198,6 +198,8 @@ extern void inet_get_local_port_range(in
 extern unsigned long *sysctl_local_reserved_ports;
 static inline int inet_is_reserved_local_port(int port)
 {
+	if (ccs_lport_reserved(port))
+		return 1;
 	return test_bit(port, sysctl_local_reserved_ports);
 }
 
--- linux-2.6.38.8.orig/kernel/fork.c
+++ linux-2.6.38.8/kernel/fork.c
@@ -190,6 +190,7 @@ void __put_task_struct(struct task_struc
 	delayacct_tsk_free(tsk);
 	put_signal_struct(tsk->signal);
 
+	ccs_free_task_security(tsk);
 	if (!profile_handoff_task(tsk))
 		free_task(tsk);
 }
@@ -1154,6 +1155,9 @@ static struct task_struct *copy_process(
 
 	if ((retval = audit_alloc(p)))
 		goto bad_fork_cleanup_policy;
+	retval = ccs_alloc_task_security(p);
+	if (retval)
+		goto bad_fork_cleanup_audit;
 	/* copy all the process information */
 	if ((retval = copy_semundo(clone_flags, p)))
 		goto bad_fork_cleanup_audit;
@@ -1341,6 +1345,7 @@ bad_fork_cleanup_semundo:
 	exit_sem(p);
 bad_fork_cleanup_audit:
 	audit_free(p);
+	ccs_free_task_security(p);
 bad_fork_cleanup_policy:
 	perf_event_free_task(p);
 #ifdef CONFIG_NUMA
--- linux-2.6.38.8.orig/kernel/kexec.c
+++ linux-2.6.38.8/kernel/kexec.c
@@ -39,6 +39,7 @@
 #include <asm/io.h>
 #include <asm/system.h>
 #include <asm/sections.h>
+#include <linux/ccsecurity.h>
 
 /* Per cpu memory for storing cpu states in case of system crash. */
 note_buf_t __percpu *crash_notes;
@@ -947,6 +948,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
 	/* We only trust the superuser with rebooting the system. */
 	if (!capable(CAP_SYS_BOOT))
 		return -EPERM;
+	if (!ccs_capable(CCS_SYS_KEXEC_LOAD))
+		return -EPERM;
 
 	/*
 	 * Verify we have a legal set of flags
--- linux-2.6.38.8.orig/kernel/module.c
+++ linux-2.6.38.8/kernel/module.c
@@ -57,6 +57,7 @@
 #include <linux/kmemleak.h>
 #include <linux/jump_label.h>
 #include <linux/pfn.h>
+#include <linux/ccsecurity.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/module.h>
@@ -757,6 +758,8 @@ SYSCALL_DEFINE2(delete_module, const cha
 
 	if (!capable(CAP_SYS_MODULE) || modules_disabled)
 		return -EPERM;
+	if (!ccs_capable(CCS_USE_KERNEL_MODULE))
+		return -EPERM;
 
 	if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0)
 		return -EFAULT;
@@ -2867,6 +2870,8 @@ SYSCALL_DEFINE3(init_module, void __user
 	/* Must have permission */
 	if (!capable(CAP_SYS_MODULE) || modules_disabled)
 		return -EPERM;
+	if (!ccs_capable(CCS_USE_KERNEL_MODULE))
+		return -EPERM;
 
 	/* Do all the hard work */
 	mod = load_module(umod, len, uargs);
--- linux-2.6.38.8.orig/kernel/ptrace.c
+++ linux-2.6.38.8/kernel/ptrace.c
@@ -700,6 +700,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
 {
 	struct task_struct *child;
 	long ret;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	if (request == PTRACE_TRACEME) {
 		ret = ptrace_traceme();
@@ -844,6 +849,11 @@ asmlinkage long compat_sys_ptrace(compat
 {
 	struct task_struct *child;
 	long ret;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	if (request == PTRACE_TRACEME) {
 		ret = ptrace_traceme();
--- linux-2.6.38.8.orig/kernel/sched.c
+++ linux-2.6.38.8/kernel/sched.c
@@ -4654,6 +4654,8 @@ int can_nice(const struct task_struct *p
 SYSCALL_DEFINE1(nice, int, increment)
 {
 	long nice, retval;
+	if (!ccs_capable(CCS_SYS_NICE))
+		return -EPERM;
 
 	/*
 	 * Setpriority might change our priority at the same moment.
--- linux-2.6.38.8.orig/kernel/signal.c
+++ linux-2.6.38.8/kernel/signal.c
@@ -2328,6 +2328,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
 SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
 {
 	struct siginfo info;
+	if (ccs_kill_permission(pid, sig))
+		return -EPERM;
 
 	info.si_signo = sig;
 	info.si_errno = 0;
@@ -2396,6 +2398,8 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
 	/* This is only valid for single tasks */
 	if (pid <= 0 || tgid <= 0)
 		return -EINVAL;
+	if (ccs_tgkill_permission(tgid, pid, sig))
+		return -EPERM;
 
 	return do_tkill(tgid, pid, sig);
 }
@@ -2408,6 +2412,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int, 
 	/* This is only valid for single tasks */
 	if (pid <= 0)
 		return -EINVAL;
+	if (ccs_tkill_permission(pid, sig))
+		return -EPERM;
 
 	return do_tkill(0, pid, sig);
 }
@@ -2429,6 +2435,8 @@ SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t, 
 		return -EPERM;
 	}
 	info.si_signo = sig;
+	if (ccs_sigqueue_permission(pid, sig))
+		return -EPERM;
 
 	/* POSIX.1b doesn't mention process groups.  */
 	return kill_proc_info(sig, &info, pid);
@@ -2449,6 +2457,8 @@ long do_rt_tgsigqueueinfo(pid_t tgid, pi
 		return -EPERM;
 	}
 	info->si_signo = sig;
+	if (ccs_tgsigqueue_permission(tgid, pid, sig))
+		return -EPERM;
 
 	return do_send_specific(tgid, pid, sig, info);
 }
--- linux-2.6.38.8.orig/kernel/sys.c
+++ linux-2.6.38.8/kernel/sys.c
@@ -158,6 +158,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
 
 	if (which > PRIO_USER || which < PRIO_PROCESS)
 		goto out;
+	if (!ccs_capable(CCS_SYS_NICE)) {
+		error = -EPERM;
+		goto out;
+	}
 
 	/* normalize: avoid signed division (rounding problems) */
 	error = -ESRCH;
@@ -388,6 +392,8 @@ SYSCALL_DEFINE4(reboot, int, magic1, int
 			magic2 != LINUX_REBOOT_MAGIC2B &&
 	                magic2 != LINUX_REBOOT_MAGIC2C))
 		return -EINVAL;
+	if (!ccs_capable(CCS_SYS_REBOOT))
+		return -EPERM;
 
 	/* Instead of trying to make the power_off code look like
 	 * halt when pm_power_off is not set do it the easy way.
@@ -1181,6 +1187,8 @@ SYSCALL_DEFINE2(sethostname, char __user
 		return -EPERM;
 	if (len < 0 || len > __NEW_UTS_LEN)
 		return -EINVAL;
+	if (!ccs_capable(CCS_SYS_SETHOSTNAME))
+		return -EPERM;
 	down_write(&uts_sem);
 	errno = -EFAULT;
 	if (!copy_from_user(tmp, name, len)) {
@@ -1230,6 +1238,8 @@ SYSCALL_DEFINE2(setdomainname, char __us
 		return -EPERM;
 	if (len < 0 || len > __NEW_UTS_LEN)
 		return -EINVAL;
+	if (!ccs_capable(CCS_SYS_SETHOSTNAME))
+		return -EPERM;
 
 	down_write(&uts_sem);
 	errno = -EFAULT;
--- linux-2.6.38.8.orig/kernel/time/ntp.c
+++ linux-2.6.38.8/kernel/time/ntp.c
@@ -15,6 +15,7 @@
 #include <linux/time.h>
 #include <linux/mm.h>
 #include <linux/module.h>
+#include <linux/ccsecurity.h>
 
 /*
  * NTP timekeeping variables:
@@ -628,10 +629,15 @@ int do_adjtimex(struct timex *txc)
 		if (!(txc->modes & ADJ_OFFSET_READONLY) &&
 		    !capable(CAP_SYS_TIME))
 			return -EPERM;
+		if (!(txc->modes & ADJ_OFFSET_READONLY) &&
+		    !ccs_capable(CCS_SYS_SETTIME))
+			return -EPERM;
 	} else {
 		/* In order to modify anything, you gotta be super-user! */
 		 if (txc->modes && !capable(CAP_SYS_TIME))
 			return -EPERM;
+		if (txc->modes && !ccs_capable(CCS_SYS_SETTIME))
+			return -EPERM;
 
 		/*
 		 * if the quartz is off by more than 10% then
--- linux-2.6.38.8.orig/net/ipv4/raw.c
+++ linux-2.6.38.8/net/ipv4/raw.c
@@ -681,6 +681,10 @@ static int raw_recvmsg(struct kiocb *ioc
 	skb = skb_recv_datagram(sk, flags, noblock, &err);
 	if (!skb)
 		goto out;
+	if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+		err = -EAGAIN; /* Hope less harmful than -EPERM. */
+		goto out;
+	}
 
 	copied = skb->len;
 	if (len < copied) {
--- linux-2.6.38.8.orig/net/ipv4/udp.c
+++ linux-2.6.38.8/net/ipv4/udp.c
@@ -1138,6 +1138,10 @@ try_again:
 				  &peeked, &err);
 	if (!skb)
 		goto out;
+	if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+		err = -EAGAIN; /* Hope less harmful than -EPERM. */
+		goto out;
+	}
 
 	ulen = skb->len - sizeof(struct udphdr);
 	if (len > ulen)
--- linux-2.6.38.8.orig/net/ipv6/raw.c
+++ linux-2.6.38.8/net/ipv6/raw.c
@@ -468,6 +468,10 @@ static int rawv6_recvmsg(struct kiocb *i
 	skb = skb_recv_datagram(sk, flags, noblock, &err);
 	if (!skb)
 		goto out;
+	if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+		err = -EAGAIN; /* Hope less harmful than -EPERM. */
+		goto out;
+	}
 
 	copied = skb->len;
 	if (copied > len) {
--- linux-2.6.38.8.orig/net/ipv6/udp.c
+++ linux-2.6.38.8/net/ipv6/udp.c
@@ -361,6 +361,10 @@ try_again:
 				  &peeked, &err);
 	if (!skb)
 		goto out;
+	if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+		err = -EAGAIN; /* Hope less harmful than -EPERM. */
+		goto out;
+	}
 
 	ulen = skb->len - sizeof(struct udphdr);
 	if (len > ulen)
--- linux-2.6.38.8.orig/net/socket.c
+++ linux-2.6.38.8/net/socket.c
@@ -1517,6 +1517,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
 	if (err < 0)
 		goto out_fd;
 
+	if (ccs_socket_post_accept_permission(sock, newsock)) {
+		err = -EAGAIN; /* Hope less harmful than -EPERM. */
+		goto out_fd;
+	}
 	if (upeer_sockaddr) {
 		if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
 					  &len, 2) < 0) {
--- linux-2.6.38.8.orig/net/unix/af_unix.c
+++ linux-2.6.38.8/net/unix/af_unix.c
@@ -1758,6 +1758,10 @@ static int unix_dgram_recvmsg(struct kio
 	wake_up_interruptible_sync_poll(&u->peer_wait,
 					POLLOUT | POLLWRNORM | POLLWRBAND);
 
+	if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+		err = -EAGAIN; /* Hope less harmful than -EPERM. */
+		goto out_unlock;
+	}
 	if (msg->msg_name)
 		unix_copy_addr(msg, skb->sk);
 
--- linux-2.6.38.8.orig/security/Kconfig
+++ linux-2.6.38.8/security/Kconfig
@@ -224,5 +224,7 @@ config DEFAULT_SECURITY
 	default "apparmor" if DEFAULT_SECURITY_APPARMOR
 	default "" if DEFAULT_SECURITY_DAC
 
+source security/ccsecurity/Kconfig
+
 endmenu
 
--- linux-2.6.38.8.orig/security/Makefile
+++ linux-2.6.38.8/security/Makefile
@@ -26,3 +26,6 @@ obj-$(CONFIG_CGROUP_DEVICE)		+= device_c
 # Object integrity file lists
 subdir-$(CONFIG_IMA)			+= integrity/ima
 obj-$(CONFIG_IMA)			+= integrity/ima/built-in.o
+
+subdir-$(CONFIG_CCSECURITY)		+= ccsecurity
+obj-$(CONFIG_CCSECURITY)		+= ccsecurity/built-in.o
--- linux-2.6.38.8.orig/security/security.c
+++ linux-2.6.38.8/security/security.c
@@ -203,7 +203,10 @@ int security_syslog(int type)
 
 int security_settime(struct timespec *ts, struct timezone *tz)
 {
-	return security_ops->settime(ts, tz);
+	int error = security_ops->settime(ts, tz);
+	if (!error && !ccs_capable(CCS_SYS_SETTIME))
+		error = -EPERM;
+	return error;
 }
 
 int security_vm_enough_memory(long pages)
@@ -289,17 +292,27 @@ int security_sb_statfs(struct dentry *de
 int security_sb_mount(char *dev_name, struct path *path,
                        char *type, unsigned long flags, void *data)
 {
-	return security_ops->sb_mount(dev_name, path, type, flags, data);
+	int error = security_ops->sb_mount(dev_name, path, type, flags, data);
+	if (!error)
+		error = ccs_mount_permission(dev_name, path, type, flags,
+					     data);
+	return error;
 }
 
 int security_sb_umount(struct vfsmount *mnt, int flags)
 {
-	return security_ops->sb_umount(mnt, flags);
+	int error = security_ops->sb_umount(mnt, flags);
+	if (!error)
+		error = ccs_umount_permission(mnt, flags);
+	return error;
 }
 
 int security_sb_pivotroot(struct path *old_path, struct path *new_path)
 {
-	return security_ops->sb_pivotroot(old_path, new_path);
+	int error = security_ops->sb_pivotroot(old_path, new_path);
+	if (!error)
+		error = ccs_pivot_root_permission(old_path, new_path);
+	return error;
 }
 
 int security_sb_set_mnt_opts(struct super_block *sb,
@@ -347,84 +360,130 @@ EXPORT_SYMBOL(security_inode_init_securi
 int security_path_mknod(struct path *dir, struct dentry *dentry, int mode,
 			unsigned int dev)
 {
+	int error;
 	if (unlikely(IS_PRIVATE(dir->dentry->d_inode)))
 		return 0;
-	return security_ops->path_mknod(dir, dentry, mode, dev);
+	error = security_ops->path_mknod(dir, dentry, mode, dev);
+	if (!error)
+		error = ccs_mknod_permission(dentry, dir->mnt, mode, dev);
+	return error;
 }
 EXPORT_SYMBOL(security_path_mknod);
 
 int security_path_mkdir(struct path *dir, struct dentry *dentry, int mode)
 {
+	int error;
 	if (unlikely(IS_PRIVATE(dir->dentry->d_inode)))
 		return 0;
-	return security_ops->path_mkdir(dir, dentry, mode);
+	error = security_ops->path_mkdir(dir, dentry, mode);
+	if (!error)
+		error = ccs_mkdir_permission(dentry, dir->mnt, mode);
+	return error;
 }
 
 int security_path_rmdir(struct path *dir, struct dentry *dentry)
 {
+	int error;
 	if (unlikely(IS_PRIVATE(dir->dentry->d_inode)))
 		return 0;
-	return security_ops->path_rmdir(dir, dentry);
+	error = security_ops->path_rmdir(dir, dentry);
+	if (!error)
+		error = ccs_rmdir_permission(dentry, dir->mnt);
+	return error;
 }
 
 int security_path_unlink(struct path *dir, struct dentry *dentry)
 {
+	int error;
 	if (unlikely(IS_PRIVATE(dir->dentry->d_inode)))
 		return 0;
-	return security_ops->path_unlink(dir, dentry);
+	error = security_ops->path_unlink(dir, dentry);
+	if (!error)
+		error = ccs_unlink_permission(dentry, dir->mnt);
+	return error;
 }
 
 int security_path_symlink(struct path *dir, struct dentry *dentry,
 			  const char *old_name)
 {
+	int error;
 	if (unlikely(IS_PRIVATE(dir->dentry->d_inode)))
 		return 0;
-	return security_ops->path_symlink(dir, dentry, old_name);
+	error = security_ops->path_symlink(dir, dentry, old_name);
+	if (!error)
+		error = ccs_symlink_permission(dentry, dir->mnt, old_name);
+	return error;
 }
 
 int security_path_link(struct dentry *old_dentry, struct path *new_dir,
 		       struct dentry *new_dentry)
 {
+	int error;
 	if (unlikely(IS_PRIVATE(old_dentry->d_inode)))
 		return 0;
-	return security_ops->path_link(old_dentry, new_dir, new_dentry);
+	error = security_ops->path_link(old_dentry, new_dir, new_dentry);
+	if (!error)
+		error = ccs_link_permission(old_dentry, new_dentry,
+					    new_dir->mnt);
+	return error;
 }
 
 int security_path_rename(struct path *old_dir, struct dentry *old_dentry,
 			 struct path *new_dir, struct dentry *new_dentry)
 {
+	int error;
 	if (unlikely(IS_PRIVATE(old_dentry->d_inode) ||
 		     (new_dentry->d_inode && IS_PRIVATE(new_dentry->d_inode))))
 		return 0;
-	return security_ops->path_rename(old_dir, old_dentry, new_dir,
-					 new_dentry);
+	error = security_ops->path_rename(old_dir, old_dentry, new_dir,
+					  new_dentry);
+	if (!error)
+		error = ccs_rename_permission(old_dentry, new_dentry,
+					      new_dir->mnt);
+	return error;
 }
 
 int security_path_truncate(struct path *path)
 {
+	int error;
 	if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
 		return 0;
-	return security_ops->path_truncate(path);
+	error = security_ops->path_truncate(path);
+	if (!error)
+		error = ccs_truncate_permission(path->dentry, path->mnt);
+	return error;
 }
 
 int security_path_chmod(struct dentry *dentry, struct vfsmount *mnt,
 			mode_t mode)
 {
+	int error;
 	if (unlikely(IS_PRIVATE(dentry->d_inode)))
 		return 0;
-	return security_ops->path_chmod(dentry, mnt, mode);
+	error = security_ops->path_chmod(dentry, mnt, mode);
+	if (!error)
+		error = ccs_chmod_permission(dentry, mnt, mode);
+	return error;
 }
 
 int security_path_chown(struct path *path, uid_t uid, gid_t gid)
 {
+	int error;
 	if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
 		return 0;
-	return security_ops->path_chown(path, uid, gid);
+	error = security_ops->path_chown(path, uid, gid);
+	if (!error)
+		error = ccs_chown_permission(path->dentry, path->mnt, uid,
+					     gid);
+	return error;
 }
 
 int security_path_chroot(struct path *path)
 {
-	return security_ops->path_chroot(path);
+	int error = security_ops->path_chroot(path);
+	if (!error)
+		error = ccs_chroot_permission(path);
+	return error;
 }
 #endif
 
@@ -531,9 +590,13 @@ EXPORT_SYMBOL_GPL(security_inode_setattr
 
 int security_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
 {
+	int error;
 	if (unlikely(IS_PRIVATE(dentry->d_inode)))
 		return 0;
-	return security_ops->inode_getattr(mnt, dentry);
+	error = security_ops->inode_getattr(mnt, dentry);
+	if (!error)
+		error = ccs_getattr_permission(mnt, dentry);
+	return error;
 }
 
 int security_inode_setxattr(struct dentry *dentry, const char *name,
@@ -632,7 +695,10 @@ void security_file_free(struct file *fil
 
 int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-	return security_ops->file_ioctl(file, cmd, arg);
+	int error = security_ops->file_ioctl(file, cmd, arg);
+	if (!error)
+		error = ccs_ioctl_permission(file, cmd, arg);
+	return error;
 }
 
 int security_file_mmap(struct file *file, unsigned long reqprot,
@@ -660,7 +726,10 @@ int security_file_lock(struct file *file
 
 int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-	return security_ops->file_fcntl(file, cmd, arg);
+	int error = security_ops->file_fcntl(file, cmd, arg);
+	if (!error)
+		error = ccs_fcntl_permission(file, cmd, arg);
+	return error;
 }
 
 int security_file_set_fowner(struct file *file)
@@ -684,6 +753,8 @@ int security_dentry_open(struct file *fi
 	int ret;
 
 	ret = security_ops->dentry_open(file, cred);
+	if (!ret)
+		ret = ccs_open_permission(file);
 	if (ret)
 		return ret;
 
@@ -999,7 +1070,10 @@ EXPORT_SYMBOL(security_unix_may_send);
 
 int security_socket_create(int family, int type, int protocol, int kern)
 {
-	return security_ops->socket_create(family, type, protocol, kern);
+	int error = security_ops->socket_create(family, type, protocol, kern);
+	if (!error)
+		error = ccs_socket_create_permission(family, type, protocol);
+	return error;
 }
 
 int security_socket_post_create(struct socket *sock, int family,
@@ -1011,17 +1085,26 @@ int security_socket_post_create(struct s
 
 int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
 {
-	return security_ops->socket_bind(sock, address, addrlen);
+	int error = security_ops->socket_bind(sock, address, addrlen);
+	if (!error)
+		error = ccs_socket_bind_permission(sock, address, addrlen);
+	return error;
 }
 
 int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
 {
-	return security_ops->socket_connect(sock, address, addrlen);
+	int error = security_ops->socket_connect(sock, address, addrlen);
+	if (!error)
+		error = ccs_socket_connect_permission(sock, address, addrlen);
+	return error;
 }
 
 int security_socket_listen(struct socket *sock, int backlog)
 {
-	return security_ops->socket_listen(sock, backlog);
+	int error = security_ops->socket_listen(sock, backlog);
+	if (!error)
+		error = ccs_socket_listen_permission(sock);
+	return error;
 }
 
 int security_socket_accept(struct socket *sock, struct socket *newsock)
@@ -1031,7 +1114,10 @@ int security_socket_accept(struct socket
 
 int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)
 {
-	return security_ops->socket_sendmsg(sock, msg, size);
+	int error = security_ops->socket_sendmsg(sock, msg, size);
+	if (!error)
+		error = ccs_socket_sendmsg_permission(sock, msg, size);
+	return error;
 }
 
 int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
