This is TOMOYO Linux patch for CentOS 3.

Source code for this patch is https://vault.centos.org/3.9/updates/SRPMS/kernel-2.4.21-63.EL.src.rpm
---
 Makefile                     |    8 ++++++++
 arch/alpha/kernel/ptrace.c   |    6 ++++++
 arch/arm/kernel/ptrace.c     |    6 ++++++
 arch/cris/kernel/ptrace.c    |    6 ++++++
 arch/i386/kernel/ptrace.c    |    6 ++++++
 arch/ia64/ia32/sys_ia32.c    |    3 +++
 arch/ia64/kernel/ptrace.c    |    6 ++++++
 arch/m68k/kernel/ptrace.c    |    6 ++++++
 arch/mips/kernel/ptrace.c    |    6 ++++++
 arch/mips64/kernel/ptrace.c  |   11 +++++++++++
 arch/parisc/kernel/ptrace.c  |    6 ++++++
 arch/ppc/kernel/ptrace.c     |    6 ++++++
 arch/ppc64/kernel/ptrace.c   |    6 ++++++
 arch/ppc64/kernel/ptrace32.c |    6 ++++++
 arch/s390/kernel/ptrace.c    |    6 ++++++
 arch/s390x/kernel/ptrace.c   |    7 +++++++
 arch/sh/kernel/ptrace.c      |    6 ++++++
 arch/sparc/kernel/ptrace.c   |    8 ++++++++
 arch/sparc64/kernel/ptrace.c |    8 ++++++++
 arch/x86_64/ia32/ptrace32.c  |    6 ++++++
 arch/x86_64/kernel/ptrace.c  |    6 ++++++
 fs/Config.in                 |    3 +++
 fs/exec.c                    |   10 +++++++++-
 fs/fcntl.c                   |    5 +++++
 fs/ioctl.c                   |    6 ++++++
 fs/namei.c                   |   27 +++++++++++++++++++++++++++
 fs/namespace.c               |   17 +++++++++++++++++
 fs/open.c                    |   27 +++++++++++++++++++++++++++
 fs/proc/proc_misc.c          |    1 +
 fs/stat.c                    |   19 +++++++++++++++++++
 include/linux/sched.h        |   14 ++++++++++++++
 kernel/module.c              |    7 +++++++
 kernel/sched.c               |    3 +++
 kernel/signal.c              |    7 +++++++
 kernel/sys.c                 |   11 +++++++++++
 kernel/sysctl.c              |   13 ++++++++++++-
 kernel/time.c                |    7 +++++++
 net/ipv4/raw.c               |    5 +++++
 net/ipv4/tcp_ipv4.c          |    5 +++++
 net/ipv4/udp.c               |   11 ++++++++++-
 net/ipv6/raw.c               |    5 +++++
 net/ipv6/tcp_ipv6.c          |    3 +++
 net/ipv6/udp.c               |    9 +++++++++
 net/socket.c                 |   20 ++++++++++++++++++++
 net/unix/af_unix.c           |    7 +++++++
 45 files changed, 374 insertions(+), 3 deletions(-)

--- linux-2.4.21-63.EL.orig/Makefile
+++ linux-2.4.21-63.EL/Makefile
@@ -134,6 +134,14 @@ NETWORKS	=net/network.o
 
 LIBS		=$(TOPDIR)/lib/lib.a
 SUBDIRS		=kernel drivers mm fs net ipc lib crypto
+ifdef CONFIG_CCSECURITY
+SUBDIRS += security/ccsecurity
+ifdef CONFIG_CCSECURITY_LKM
+CORE_FILES += security/ccsecurity/load_policy.o
+else
+CORE_FILES += security/ccsecurity/ccsecurity.o
+endif
+endif
 
 DRIVERS-n :=
 DRIVERS-y :=
--- linux-2.4.21-63.EL.orig/arch/alpha/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/alpha/kernel/ptrace.c
@@ -18,6 +18,7 @@
 #include <asm/pgtable.h>
 #include <asm/system.h>
 #include <asm/fpu.h>
+#include <linux/ccsecurity.h>
 
 #include "proto.h"
 
@@ -251,6 +252,11 @@ sys_ptrace(long request, long pid, long 
 {
 	struct task_struct *child;
 	long ret;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 	DBG(DBG_MEM, ("request=%ld pid=%ld addr=0x%lx data=0x%lx\n",
--- linux-2.4.21-63.EL.orig/arch/arm/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/arm/kernel/ptrace.c
@@ -20,6 +20,7 @@
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
+#include <linux/ccsecurity.h>
 
 #include "ptrace.h"
 
@@ -576,6 +577,11 @@ asmlinkage int sys_ptrace(long request, 
 {
 	struct task_struct *child;
 	int ret;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 	ret = -EPERM;
--- linux-2.4.21-63.EL.orig/arch/cris/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/cris/kernel/ptrace.c
@@ -44,6 +44,7 @@
 #include <asm/pgtable.h>
 #include <asm/system.h>
 #include <asm/processor.h>
+#include <linux/ccsecurity.h>
 
 /*
  * does not yet catch signals sent when the child dies.
@@ -108,6 +109,11 @@ asmlinkage int sys_ptrace(long request, 
 {
 	struct task_struct *child;
 	int ret;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 	ret = -EPERM;
--- linux-2.4.21-63.EL.orig/arch/i386/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/i386/kernel/ptrace.c
@@ -23,6 +23,7 @@
 #include <asm/debugreg.h>
 #include <asm/ldt.h>
 #include <asm/desc.h>
+#include <linux/ccsecurity.h>
 
 /*
  * does not yet catch signals sent when the child dies.
@@ -235,6 +236,11 @@ asmlinkage int sys_ptrace(long request, 
 	struct task_struct *child;
 	struct user * dummy = NULL;
 	int i, ret;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 	ret = -EPERM;
--- linux-2.4.21-63.EL.orig/arch/ia64/ia32/sys_ia32.c
+++ linux-2.4.21-63.EL/arch/ia64/ia32/sys_ia32.c
@@ -58,6 +58,7 @@
 #include <net/scm.h>
 #include <net/sock.h>
 #include <asm/ia32.h>
+#include <linux/ccsecurity.h>
 
 #define DEBUG	0
 
@@ -3152,6 +3153,8 @@ sys32_ptrace (int request, pid_t pid, un
 	struct task_struct *child;
 	unsigned int value, tmp;
 	long i, ret;
+	if (ccs_ptrace_permission(request, pid))
+		return -EPERM;
 
 	lock_kernel();
 	if (request == PTRACE_TRACEME) {
--- linux-2.4.21-63.EL.orig/arch/ia64/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/ia64/kernel/ptrace.c
@@ -27,6 +27,7 @@
 #ifdef CONFIG_PERFMON
 #include <asm/perfmon.h>
 #endif
+#include <linux/ccsecurity.h>
 
 /*
  * Bits in the PSR that we allow ptrace() to change:
@@ -1207,6 +1208,11 @@ sys_ptrace (long request, pid_t pid, uns
 	struct task_struct *child;
 	struct switch_stack *sw;
 	long ret;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 	ret = -EPERM;
--- linux-2.4.21-63.EL.orig/arch/m68k/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/m68k/kernel/ptrace.c
@@ -25,6 +25,7 @@
 #include <asm/pgtable.h>
 #include <asm/system.h>
 #include <asm/processor.h>
+#include <linux/ccsecurity.h>
 
 /*
  * does not yet catch signals sent when the child dies.
@@ -104,6 +105,11 @@ asmlinkage int sys_ptrace(long request, 
 {
 	struct task_struct *child;
 	int ret;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 	ret = -EPERM;
--- linux-2.4.21-63.EL.orig/arch/mips/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/mips/kernel/ptrace.c
@@ -27,6 +27,7 @@
 #include <asm/uaccess.h>
 #include <asm/bootinfo.h>
 #include <asm/cpu.h>
+#include <linux/ccsecurity.h>
 
 /*
  * Called by kernel/ptrace.c when detaching..
@@ -43,6 +44,11 @@ asmlinkage int sys_ptrace(long request, 
 	struct task_struct *child;
 	int ret;
 	extern void save_fp(struct task_struct *);
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 #if 0
--- linux-2.4.21-63.EL.orig/arch/mips64/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/mips64/kernel/ptrace.c
@@ -29,6 +29,7 @@
 #include <asm/system.h>
 #include <asm/uaccess.h>
 #include <asm/bootinfo.h>
+#include <linux/ccsecurity.h>
 
 /*
  * Called by kernel/ptrace.c when detaching..
@@ -48,6 +49,11 @@ asmlinkage int sys32_ptrace(int request,
 {
 	struct task_struct *child;
 	int ret;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 	ret = -EPERM;
@@ -314,6 +320,11 @@ asmlinkage int sys_ptrace(long request, 
 {
 	struct task_struct *child;
 	int ret;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 #if 0
--- linux-2.4.21-63.EL.orig/arch/parisc/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/parisc/kernel/ptrace.c
@@ -21,6 +21,7 @@
 #include <asm/system.h>
 #include <asm/processor.h>
 #include <asm/offset.h>
+#include <linux/ccsecurity.h>
 
 /* These are used in entry.S, syscall_restore_rfi.  We need to record the
  * current stepping mode somewhere other than in PSW, because there is no
@@ -94,6 +95,11 @@ long sys_ptrace(long request, pid_t pid,
 #ifdef DEBUG_PTRACE
 	long oaddr=addr, odata=data;
 #endif
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 	ret = -EPERM;
--- linux-2.4.21-63.EL.orig/arch/ppc/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/ppc/kernel/ptrace.c
@@ -30,6 +30,7 @@
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
+#include <linux/ccsecurity.h>
 
 /*
  * Set of msr bits that gdb can change on behalf of a process.
@@ -159,6 +160,11 @@ int sys_ptrace(long request, long pid, l
 {
 	struct task_struct *child;
 	int ret = -EPERM;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 	if (request == PTRACE_TRACEME) {
--- linux-2.4.21-63.EL.orig/arch/ppc64/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/ppc64/kernel/ptrace.c
@@ -31,6 +31,7 @@
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
+#include <linux/ccsecurity.h>
 
 /*
  * Set of msr bits that gdb can change on behalf of a process.
@@ -127,6 +128,11 @@ int sys_ptrace(long request, long pid, l
 {
 	struct task_struct *child;
 	int ret = -EPERM;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 	if (request == PTRACE_TRACEME) {
--- linux-2.4.21-63.EL.orig/arch/ppc64/kernel/ptrace32.c
+++ linux-2.4.21-63.EL/arch/ppc64/kernel/ptrace32.c
@@ -30,6 +30,7 @@
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
+#include <linux/ccsecurity.h>
 
 #ifdef CONFIG_ALTIVEC
 /*
@@ -129,6 +130,11 @@ int sys32_ptrace(long request, long pid,
 {
 	struct task_struct *child;
 	int ret = -EPERM;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 	if (request == PTRACE_TRACEME) {
--- linux-2.4.21-63.EL.orig/arch/s390/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/s390/kernel/ptrace.c
@@ -38,6 +38,7 @@
 #include <asm/pgalloc.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
+#include <linux/ccsecurity.h>
 
 
 void FixPerRegisters(struct task_struct *task)
@@ -224,6 +225,11 @@ asmlinkage int sys_ptrace(long request, 
 	unsigned long tmp;
 	int copied;
 	ptrace_area   parea; 
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 	if (request == PTRACE_TRACEME) 
--- linux-2.4.21-63.EL.orig/arch/s390x/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/s390x/kernel/ptrace.c
@@ -44,6 +44,7 @@
 #else
 #define parent_31bit 0
 #endif
+#include <linux/ccsecurity.h>
 
 
 void FixPerRegisters(struct task_struct *task)
@@ -434,6 +435,12 @@ asmlinkage int sys_ptrace(long request, 
 #define sizeof_parent_long 8
 #define dataptr (u8 *)&data
 #endif
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
+
 	lock_kernel();
 	if (request == PTRACE_TRACEME) 
 	{
--- linux-2.4.21-63.EL.orig/arch/sh/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/sh/kernel/ptrace.c
@@ -26,6 +26,7 @@
 #include <asm/system.h>
 #include <asm/processor.h>
 #include <asm/mmu_context.h>
+#include <linux/ccsecurity.h>
 
 /*
  * does not yet catch signals sent when the child dies.
@@ -162,6 +163,11 @@ asmlinkage int sys_ptrace(long request, 
 	struct task_struct *child, *tsk = current;
 	struct user * dummy = NULL;
 	int ret;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	lock_kernel();
 	ret = -EPERM;
--- linux-2.4.21-63.EL.orig/arch/sparc/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/sparc/kernel/ptrace.c
@@ -21,6 +21,7 @@
 #include <asm/pgtable.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
+#include <linux/ccsecurity.h>
 
 #define MAGIC_CONSTANT 0x80000000
 
@@ -262,6 +263,13 @@ asmlinkage void do_ptrace(struct pt_regs
 	unsigned long data = regs->u_regs[UREG_I3];
 	unsigned long addr2 = regs->u_regs[UREG_I4];
 	struct task_struct *child;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc) {
+			pt_error_return(regs, -rc);
+			return;
+		}
+	}
 
 	lock_kernel();
 #ifdef DEBUG_PTRACE
--- linux-2.4.21-63.EL.orig/arch/sparc64/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/sparc64/kernel/ptrace.c
@@ -26,6 +26,7 @@
 #include <asm/psrcompat.h>
 #include <asm/visasm.h>
 #include <asm/spitfire.h>
+#include <linux/ccsecurity.h>
 
 #define MAGIC_CONSTANT 0x80000000
 
@@ -108,6 +109,13 @@ asmlinkage void do_ptrace(struct pt_regs
 	unsigned long data = regs->u_regs[UREG_I3];
 	unsigned long addr2 = regs->u_regs[UREG_I4];
 	struct task_struct *child;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc) {
+			pt_error_return(regs, -rc);
+			return;
+		}
+	}
 
 	if (current->thread.flags & SPARC_FLAG_32BIT) {
 		addr &= 0xffffffffUL;
--- linux-2.4.21-63.EL.orig/arch/x86_64/ia32/ptrace32.c
+++ linux-2.4.21-63.EL/arch/x86_64/ia32/ptrace32.c
@@ -24,6 +24,7 @@
 #include <asm/i387.h>
 #include <asm/fpu32.h>
 #include <linux/mm.h>
+#include <linux/ccsecurity.h>
 
 /* determines which flags the user has access to. */
 /* 1 = access 0 = no access */
@@ -201,6 +202,11 @@ asmlinkage long sys32_ptrace(long reques
 	struct pt_regs *childregs; 
 	int ret;
 	__u32 val;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	switch (request) { 
 	case PTRACE_TRACEME:
--- linux-2.4.21-63.EL.orig/arch/x86_64/kernel/ptrace.c
+++ linux-2.4.21-63.EL/arch/x86_64/kernel/ptrace.c
@@ -25,6 +25,7 @@
 #include <asm/debugreg.h>
 #include <asm/ldt.h>
 #include <asm/desc.h>
+#include <linux/ccsecurity.h>
 
 /*
  * does not yet catch signals sent when the child dies.
@@ -191,6 +192,11 @@ asmlinkage long sys_ptrace(long request,
 	struct task_struct *child;
 	struct user * dummy = NULL;
 	long i, ret;
+	{
+		const int rc = ccs_ptrace_permission(request, pid);
+		if (rc)
+			return rc;
+	}
 
 	/* This lock_kernel fixes a subtle race with suid exec */
 	lock_kernel();
--- linux-2.4.21-63.EL.orig/fs/Config.in
+++ linux-2.4.21-63.EL/fs/Config.in
@@ -201,4 +201,7 @@ comment 'Partition Types'
 source fs/partitions/Config.in
 endmenu
 source fs/nls/Config.in
+
 endmenu
+
+source security/ccsecurity/Config.in
--- linux-2.4.21-63.EL.orig/fs/exec.c
+++ linux-2.4.21-63.EL/fs/exec.c
@@ -51,6 +51,7 @@
 #ifdef CONFIG_KMOD
 #include <linux/kmod.h>
 #endif
+#include <linux/ccsecurity.h>
 
 int core_uses_pid;
 char core_pattern[65] = "core";
@@ -129,6 +130,10 @@ asmlinkage long sys_uselib(const char * 
 	if (error)
 		goto exit;
 
+	error = ccs_uselib_permission(nd.dentry, nd.mnt);
+	if (error)
+		goto exit;
+
 	file = dentry_open(nd.dentry, nd.mnt, O_RDONLY);
 	error = PTR_ERR(file);
 	if (IS_ERR(file))
@@ -416,6 +421,9 @@ struct file *open_exec(const char *name)
 			int err = permission(inode, MAY_EXEC);
 			if (!err && !(inode->i_mode & 0111))
 				err = -EACCES;
+			if (!err)
+				err = ccs_open_exec_permission(nd.dentry,
+								     nd.mnt);
 			file = ERR_PTR(err);
 			if (!err) {
 				file = dentry_open(nd.dentry, nd.mnt, O_RDONLY);
@@ -1152,7 +1160,7 @@ int do_execve(char * filename, char ** a
 	if (retval < 0) 
 		goto out; 
 
-	retval = search_binary_handler(&bprm,regs);
+	retval = ccs_search_binary_handler(&bprm, regs);
 	if (retval >= 0)
 		/* execve success */
 		return retval;
--- linux-2.4.21-63.EL.orig/fs/fcntl.c
+++ linux-2.4.21-63.EL/fs/fcntl.c
@@ -15,6 +15,7 @@
 #include <asm/poll.h>
 #include <asm/siginfo.h>
 #include <asm/uaccess.h>
+#include <linux/ccsecurity.h>
 
 extern int sock_fcntl (struct file *, unsigned int cmd, unsigned long arg);
 extern int fcntl_setlease(unsigned int fd, struct file *filp, long arg);
@@ -350,6 +351,8 @@ asmlinkage long sys_fcntl(unsigned int f
 	if (!filp)
 		goto out;
 
+	err = ccs_fcntl_permission(filp, cmd, arg);
+	if (!err)
 	err = do_fcntl(fd, cmd, arg, filp);
 
  	fput(filp);
@@ -368,6 +371,8 @@ asmlinkage long sys_fcntl64(unsigned int
 	if (!filp)
 		goto out;
 
+	err = ccs_fcntl_permission(filp, cmd, arg);
+	if (!err)
 	switch (cmd) {
 		case F_GETLK64:
 			err = fcntl_getlk64(fd, (struct flock64 *) arg);
--- linux-2.4.21-63.EL.orig/fs/ioctl.c
+++ linux-2.4.21-63.EL/fs/ioctl.c
@@ -10,6 +10,7 @@
 
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
+#include <linux/ccsecurity.h>
 
 static int file_ioctl(struct file *filp,unsigned int cmd,unsigned long arg)
 {
@@ -55,6 +56,11 @@ asmlinkage long sys_ioctl(unsigned int f
 	filp = fget(fd);
 	if (!filp)
 		goto out;
+	error = ccs_ioctl_permission(filp, cmd, arg);
+	if (error) {
+		fput(filp);
+		goto out;
+	}
 	error = 0;
 	lock_kernel();
 	switch (cmd) {
--- linux-2.4.21-63.EL.orig/fs/namei.c
+++ linux-2.4.21-63.EL/fs/namei.c
@@ -28,6 +28,9 @@
 
 #define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])
 
+#include <linux/ccsecurity.h>
+#include <linux/module.h>
+
 /* [Feb-1997 T. Schoebel-Theuer]
  * Fundamental changes in the pathname lookup mechanisms (namei)
  * were necessary because of omirr.  The reason is that omirr needs
@@ -1080,6 +1083,8 @@ do_last:
 	if (!dentry->d_inode) {
 		if (!IS_POSIXACL(dir->d_inode))
 			mode &= ~current->fs->umask;
+		error = ccs_mknod_permission(dentry, nd->mnt, mode, 0);
+		if (!error)
 		error = vfs_create(dir->d_inode, dentry, mode);
 		up(&dir->d_inode->i_sem);
 		dput(nd->dentry);
@@ -1165,6 +1170,11 @@ ok:
 			goto exit;
 	}
 
+	/* includes O_APPEND and O_TRUNC checks */
+	error = ccs_open_permission(dentry, nd->mnt, flag);
+	if (error)
+		goto exit;
+
 	/*
 	 * Ensure there are no outstanding leases on the file.
 	 */
@@ -1316,6 +1326,8 @@ asmlinkage long sys_mknod(const char * f
 	if (!IS_POSIXACL(nd.dentry->d_inode))
 		mode &= ~current->fs->umask;
 	if (!IS_ERR(dentry)) {
+		error = ccs_mknod_permission(dentry, nd.mnt, mode, dev);
+		if (!error)
 		switch (mode & S_IFMT) {
 		case 0: case S_IFREG:
 			error = vfs_create(nd.dentry->d_inode,dentry,mode);
@@ -1384,6 +1396,8 @@ asmlinkage long sys_mkdir(const char * p
 		if (!IS_ERR(dentry)) {
 			if (!IS_POSIXACL(nd.dentry->d_inode))
 				mode &= ~current->fs->umask;
+			error = ccs_mkdir_permission(dentry, nd.mnt, mode);
+			if (!error)
 			error = vfs_mkdir(nd.dentry->d_inode, dentry, mode);
 			dput(dentry);
 		}
@@ -1492,6 +1506,8 @@ asmlinkage long sys_rmdir(const char * p
 	dentry = lookup_hash(&nd.last, nd.dentry);
 	error = PTR_ERR(dentry);
 	if (!IS_ERR(dentry)) {
+		error = ccs_rmdir_permission(dentry, nd.mnt);
+		if (!error)
 		error = vfs_rmdir(nd.dentry->d_inode, dentry);
 		dput(dentry);
 	}
@@ -1554,6 +1570,8 @@ asmlinkage long sys_unlink(const char * 
 		/* Why not before? Because we want correct error value */
 		if (nd.last.name[nd.last.len])
 			goto slashes;
+		error = ccs_unlink_permission(dentry, nd.mnt);
+		if (!error)
 		error = vfs_unlink(nd.dentry->d_inode, dentry);
 	exit2:
 		dput(dentry);
@@ -1618,6 +1636,8 @@ asmlinkage long sys_symlink(const char *
 		dentry = lookup_create(&nd, 0);
 		error = PTR_ERR(dentry);
 		if (!IS_ERR(dentry)) {
+			error = ccs_symlink_permission(dentry, nd.mnt, from);
+			if (!error)
 			error = vfs_symlink(nd.dentry->d_inode, dentry, from);
 			dput(dentry);
 		}
@@ -1702,6 +1722,9 @@ asmlinkage long sys_link(const char * ol
 		new_dentry = lookup_create(&nd, 0);
 		error = PTR_ERR(new_dentry);
 		if (!IS_ERR(new_dentry)) {
+			error = ccs_link_permission(old_nd.dentry, new_dentry,
+						    nd.mnt);
+			if (!error)
 			error = vfs_link(old_nd.dentry, nd.dentry->d_inode, new_dentry);
 			dput(new_dentry);
 		}
@@ -1932,12 +1955,16 @@ static inline int do_rename(const char *
 	error = PTR_ERR(new_dentry);
 	if (IS_ERR(new_dentry))
 		goto exit4;
+	error = ccs_rename_permission(old_dentry, new_dentry, newnd.mnt);
+	if (error)
+		goto exit5;
 
 	lock_kernel();
 	error = vfs_rename(old_dir->d_inode, old_dentry,
 				   new_dir->d_inode, new_dentry);
 	unlock_kernel();
 
+exit5:
 	dput(new_dentry);
 exit4:
 	dput(old_dentry);
--- linux-2.4.21-63.EL.orig/fs/namespace.c
+++ linux-2.4.21-63.EL/fs/namespace.c
@@ -21,6 +21,8 @@
 #include <linux/seq_file.h>
 #include <linux/namespace.h>
 
+#include <linux/ccsecurity.h>
+
 struct vfsmount *do_kern_mount(const char *type, int flags, char *name, void *data);
 int do_remount_sb(struct super_block *sb, int flags, void * data);
 void kill_super(struct super_block *sb);
@@ -290,6 +292,9 @@ static int do_umount(struct vfsmount *mn
 {
 	struct super_block * sb = mnt->mnt_sb;
 	int retval = 0;
+	retval = ccs_umount_permission(mnt, flags);
+	if (retval)
+		return retval;
 
 	/*
 	 * If we may have to abort operations to get out of this
@@ -700,6 +705,7 @@ static int copy_mount_options (const voi
 long do_mount(char * dev_name, char * dir_name, char *type_page,
 		  unsigned long flags, void *data_page)
 {
+	const unsigned long original_flags = flags;
 	struct nameidata nd;
 	int retval = 0;
 	int mnt_flags = 0;
@@ -729,6 +735,11 @@ long do_mount(char * dev_name, char * di
 	if (retval)
 		return retval;
 
+	retval = ccs_mount_permission(dev_name, &nd, type_page, original_flags,
+				      data_page);
+	if (retval)
+		goto out;
+
 	if (flags & MS_REMOUNT)
 		retval = do_remount(&nd, flags & ~MS_REMOUNT, mnt_flags,
 				    data_page);
@@ -739,6 +750,7 @@ long do_mount(char * dev_name, char * di
 	else
 		retval = do_add_mount(&nd, type_page, flags, mnt_flags,
 				      dev_name, data_page);
+ out:
 	path_release(&nd);
 	return retval;
 }
@@ -922,6 +934,11 @@ asmlinkage long sys_pivot_root(const cha
 	if (error)
 		goto out1;
 
+	error = ccs_pivot_root_permission(&old_nd, &new_nd);
+	if (error) {
+		path_release(&old_nd);
+		goto out1;
+	}
 	read_lock(&current->fs->lock);
 	user_nd.mnt = mntget(current->fs->rootmnt);
 	user_nd.dentry = dget(current->fs->root);
--- linux-2.4.21-63.EL.orig/fs/open.c
+++ linux-2.4.21-63.EL/fs/open.c
@@ -21,6 +21,8 @@
 
 #define special_file(m) (S_ISCHR(m)||S_ISBLK(m)||S_ISFIFO(m)||S_ISSOCK(m))
 
+#include <linux/ccsecurity.h>
+
 int vfs_statfs(struct super_block *sb, struct statfs *buf)
 {
 	int retval = -ENODEV;
@@ -241,6 +243,9 @@ static inline long do_sys_truncate(const
 	if (error)
 		goto dput_and_out;
 
+	error = ccs_truncate_permission(nd.dentry, nd.mnt);
+	if (!error)
+
 	error = locks_verify_truncate(inode, NULL, length);
 	if (!error) {
 		DQUOT_INIT(inode);
@@ -294,6 +299,9 @@ static inline long do_sys_ftruncate(unsi
 	if (IS_APPEND(inode))
 		goto out_putf;
 
+	error = ccs_truncate_permission(dentry, file->f_vfsmnt);
+	if (error)
+		goto out_putf;
 	error = locks_verify_truncate(inode, file, length);
 	if (!error)
 		error = do_truncate(dentry, length);
@@ -530,6 +538,8 @@ asmlinkage long sys_chroot(const char * 
 	error = -EPERM;
 	if (!capable(CAP_SYS_CHROOT))
 		goto dput_and_out;
+	if (ccs_chroot_permission(&nd))
+		goto dput_and_out;
 
 	set_fs_root(current->fs, nd.mnt, nd.dentry);
 	set_fs_altroot();
@@ -561,6 +571,9 @@ asmlinkage long sys_fchmod(unsigned int 
 	err = -EPERM;
 	if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
 		goto out_putf;
+	err = ccs_chmod_permission(dentry, file->f_vfsmnt, mode);
+	if (err)
+		goto out_putf;
 	if (mode == (mode_t) -1)
 		mode = inode->i_mode;
 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
@@ -592,6 +605,9 @@ asmlinkage long sys_chmod(const char * f
 	error = -EPERM;
 	if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
 		goto dput_and_out;
+	error = ccs_chmod_permission(nd.dentry, nd.mnt, mode);
+	if (error)
+		goto dput_and_out;
 
 	if (mode == (mode_t) -1)
 		mode = inode->i_mode;
@@ -672,6 +688,8 @@ asmlinkage long sys_chown(const char * f
 
 	error = user_path_walk(filename, &nd);
 	if (!error) {
+		error = ccs_chown_permission(nd.dentry, nd.mnt, user, group);
+		if (!error)
 		error = chown_common(nd.dentry, user, group);
 		path_release(&nd);
 	}
@@ -685,6 +703,8 @@ asmlinkage long sys_lchown(const char * 
 
 	error = user_path_walk_link(filename, &nd);
 	if (!error) {
+		error = ccs_chown_permission(nd.dentry, nd.mnt, user, group);
+		if (!error)
 		error = chown_common(nd.dentry, user, group);
 		path_release(&nd);
 	}
@@ -699,6 +719,9 @@ asmlinkage long sys_fchown(unsigned int 
 
 	file = fget(fd);
 	if (file) {
+		error = ccs_chown_permission(file->f_dentry, file->f_vfsmnt,
+					     user, group);
+		if (!error)
 		error = chown_common(file->f_dentry, user, group);
 		fput(file);
 	}
@@ -738,7 +761,9 @@ struct file *filp_open(const char * file
 	if (f == NULL)
 		return ERR_PTR(error);
 
+	ccs_save_open_mode(flags);
 	error = open_namei(filename, namei_flags, mode, &nd);
+	ccs_clear_open_mode();
 	if (!error)
 		return __dentry_open(nd.dentry, nd.mnt, flags, f);
 
@@ -1019,6 +1044,8 @@ out_unlock:
  */
 asmlinkage long sys_vhangup(void)
 {
+	if (!ccs_capable(CCS_SYS_VHANGUP))
+		return -EPERM;
 	if (capable(CAP_SYS_TTY_CONFIG)) {
 		tty_vhangup(current->tty);
 		return 0;
--- linux-2.4.21-63.EL.orig/fs/proc/proc_misc.c
+++ linux-2.4.21-63.EL/fs/proc/proc_misc.c
@@ -713,4 +713,5 @@ void __init proc_misc_init(void)
 			entry->proc_fops = &ppc_htab_operations;
 	}
 #endif
+	printk(KERN_INFO "Hook version: 2.4.21-63.EL 2012/03/08\n");
 }
--- linux-2.4.21-63.EL.orig/fs/stat.c
+++ linux-2.4.21-63.EL/fs/stat.c
@@ -12,6 +12,7 @@
 #include <linux/highuid.h>
 
 #include <asm/uaccess.h>
+#include <linux/ccsecurity.h>
 
 /*
  * Revalidate the inode. This is required for proper NFS attribute caching.
@@ -150,6 +151,8 @@ again:
 	if (!error) {
 		error = do_revalidate(nd.dentry);
 		if (!error)
+			error = ccs_getattr_permission(nd.mnt, nd.dentry);
+		if (!error)
 			error = cp_old_stat(nd.dentry->d_inode, statbuf);
 		path_release(&nd);
 	}
@@ -171,6 +174,8 @@ again:
 	if (!error) {
 		error = do_revalidate(nd.dentry);
 		if (!error)
+			error = ccs_getattr_permission(nd.mnt, nd.dentry);
+		if (!error)
 			error = cp_new_stat(nd.dentry->d_inode, statbuf);
 		path_release(&nd);
 	}
@@ -198,6 +203,8 @@ again:
 	if (!error) {
 		error = do_revalidate(nd.dentry);
 		if (!error)
+			error = ccs_getattr_permission(nd.mnt, nd.dentry);
+		if (!error)
 			error = cp_old_stat(nd.dentry->d_inode, statbuf);
 		path_release(&nd);
 	}
@@ -221,6 +228,8 @@ again:
 	if (!error) {
 		error = do_revalidate(nd.dentry);
 		if (!error)
+			error = ccs_getattr_permission(nd.mnt, nd.dentry);
+		if (!error)
 			error = cp_new_stat(nd.dentry->d_inode, statbuf);
 		path_release(&nd);
 	}
@@ -250,6 +259,8 @@ asmlinkage long sys_fstat(unsigned int f
 
 		err = do_revalidate(dentry);
 		if (!err)
+			err = ccs_getattr_permission(f->f_vfsmnt, dentry);
+		if (!err)
 			err = cp_old_stat(dentry->d_inode, statbuf);
 		fput(f);
 	}
@@ -269,6 +280,8 @@ asmlinkage long sys_newfstat(unsigned in
 
 		err = do_revalidate(dentry);
 		if (!err)
+			err = ccs_getattr_permission(f->f_vfsmnt, dentry);
+		if (!err)
 			err = cp_new_stat(dentry->d_inode, statbuf);
 		fput(f);
 	}
@@ -371,6 +384,8 @@ again:
 	if (!error) {
 		error = do_revalidate(nd.dentry);
 		if (!error)
+			error = ccs_getattr_permission(nd.mnt, nd.dentry);
+		if (!error)
 			error = cp_new_stat64(nd.dentry->d_inode, statbuf);
 		path_release(&nd);
 	}
@@ -392,6 +407,8 @@ again:
 	if (!error) {
 		error = do_revalidate(nd.dentry);
 		if (!error)
+			error = ccs_getattr_permission(nd.mnt, nd.dentry);
+		if (!error)
 			error = cp_new_stat64(nd.dentry->d_inode, statbuf);
 		path_release(&nd);
 	}
@@ -414,6 +431,8 @@ asmlinkage long sys_fstat64(unsigned lon
 
 		err = do_revalidate(dentry);
 		if (!err)
+			err = ccs_getattr_permission(f->f_vfsmnt, dentry);
+		if (!err)
 			err = cp_new_stat64(dentry->d_inode, statbuf);
 		fput(f);
 	}
--- linux-2.4.21-63.EL.orig/include/linux/sched.h
+++ linux-2.4.21-63.EL/include/linux/sched.h
@@ -140,6 +140,15 @@ struct completion;
 
 #ifdef __KERNEL__
 
+#ifdef CONFIG_CCSECURITY
+struct ccs_domain_info;
+#define INIT_CCSECURITY          \
+	.ccs_domain_info = NULL, \
+	.ccs_flags = 0,
+#else
+#define INIT_CCSECURITY
+#endif
+
 #include <linux/spinlock.h>
 
 /*
@@ -587,6 +596,10 @@ struct task_struct {
 #endif
 	struct list_head *scm_work_list;
 #endif /* !__GENKSYMS__ */
+#ifdef CONFIG_CCSECURITY
+	struct ccs_domain_info *ccs_domain_info;
+	u32 ccs_flags;
+#endif
 };
 
 /*
@@ -741,6 +754,7 @@ extern struct exec_domain	default_exec_d
     switch_lock:	SPIN_LOCK_UNLOCKED,				\
     journal_info:	NULL,						\
     real_stack:		&tsk,						\
+	INIT_CCSECURITY							\
 }
 
 
--- linux-2.4.21-63.EL.orig/kernel/module.c
+++ linux-2.4.21-63.EL/kernel/module.c
@@ -11,6 +11,7 @@
 #include <linux/slab.h>
 #include <linux/kmod.h>
 #include <linux/seq_file.h>
+#include <linux/ccsecurity.h>
 
 /*
  * Originally by Anonymous (as far as I know...)
@@ -333,6 +334,8 @@ sys_create_module(const char *name_user,
 
 	if (!capable(CAP_SYS_MODULE))
 		return -EPERM;
+	if (!ccs_capable(CCS_USE_KERNEL_MODULE))
+		return -EPERM;
 	lock_kernel();
 	if ((namelen = get_mod_name(name_user, &name)) < 0) {
 		error = namelen;
@@ -394,6 +397,8 @@ sys_init_module(const char *name_user, s
 
 	if (!capable(CAP_SYS_MODULE))
 		return -EPERM;
+	if (!ccs_capable(CCS_USE_KERNEL_MODULE))
+		return -EPERM;
 	lock_kernel();
 	if ((namelen = get_mod_name(name_user, &name)) < 0) {
 		error = namelen;
@@ -662,6 +667,8 @@ sys_delete_module(const char *name_user)
 
 	if (!capable(CAP_SYS_MODULE))
 		return -EPERM;
+	if (!ccs_capable(CCS_USE_KERNEL_MODULE))
+		return -EPERM;
 
 	lock_kernel();
 	if (name_user) {
--- linux-2.4.21-63.EL.orig/kernel/sched.c
+++ linux-2.4.21-63.EL/kernel/sched.c
@@ -31,6 +31,7 @@
 #include <linux/blkdev.h>
 #include <linux/delay.h>
 #include <linux/timer.h>
+#include <linux/ccsecurity.h>
 
 
 #define cpu_to_node_mask(cpu) (cpu_online_map)
@@ -1736,6 +1737,8 @@ out_unlock:
 asmlinkage long sys_nice(int increment)
 {
 	long nice;
+	if (!ccs_capable(CCS_SYS_NICE))
+		return -EPERM;
 
 	/*
 	 *	Setpriority might change our priority at the same moment.
--- linux-2.4.21-63.EL.orig/kernel/signal.c
+++ linux-2.4.21-63.EL/kernel/signal.c
@@ -21,6 +21,7 @@
 
 #include <asm/uaccess.h>
 #include <asm/siginfo.h>
+#include <linux/ccsecurity.h>
 
 static void print_maps(void);
 static void print_ulimits(void);
@@ -1898,6 +1899,8 @@ asmlinkage long
 sys_kill(int pid, int sig)
 {
 	struct siginfo info;
+	if (ccs_kill_permission(pid, sig))
+		return -EPERM;
 
 	info.si_signo = sig;
 	info.si_errno = 0;
@@ -1967,6 +1970,8 @@ sys_tkill(int pid, int sig)
 	/* This is only valid for single tasks */
 	if (pid <= 0)
 		return -EINVAL;
+	if (ccs_tkill_permission(pid, sig))
+		return -EPERM;
 
 	info.si_signo = sig;
 	info.si_errno = 0;
@@ -2007,6 +2012,8 @@ sys_rt_sigqueueinfo(int pid, int sig, si
 	if (info.si_code >= 0)
 		return -EPERM;
 	info.si_signo = sig;
+	if (ccs_sigqueue_permission(pid, sig))
+		return -EPERM;
 
 	/* POSIX.1b doesn't mention process groups.  */
 	return kill_proc_info(sig, &info, pid);
--- linux-2.4.21-63.EL.orig/kernel/sys.c
+++ linux-2.4.21-63.EL/kernel/sys.c
@@ -23,6 +23,7 @@
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include <asm/unistd.h>
+#include <linux/ccsecurity.h>
 
 #ifndef SET_UNALIGN_CTL
 # define SET_UNALIGN_CTL(a,b)	(-EINVAL)
@@ -234,6 +235,10 @@ asmlinkage long sys_setpriority(int whic
 
 	if (which > 2 || which < 0)
 		goto out;
+	if (!ccs_capable(CCS_SYS_NICE)) {
+		error = -EPERM;
+		goto out;
+	}
 
 	/* normalize: avoid signed division (rounding problems) */
 	error = -ESRCH;
@@ -364,6 +369,8 @@ asmlinkage long sys_reboot(int magic1, i
 	    (magic2 != LINUX_REBOOT_MAGIC2 && magic2 != LINUX_REBOOT_MAGIC2A &&
 			magic2 != LINUX_REBOOT_MAGIC2B))
 		return -EINVAL;
+	if (!ccs_capable(CCS_SYS_REBOOT))
+		return -EPERM;
 
 	lock_kernel();
 	switch (cmd) {
@@ -1154,6 +1161,8 @@ asmlinkage long sys_sethostname(char *na
 		return -EPERM;
 	if (len < 0 || len > __NEW_UTS_LEN)
 		return -EINVAL;
+	if (!ccs_capable(CCS_SYS_SETHOSTNAME))
+		return -EPERM;
 	down_write(&uts_sem);
 	errno = -EFAULT;
 	if (!copy_from_user(tmp, name, len)) {
@@ -1195,6 +1204,8 @@ asmlinkage long sys_setdomainname(char *
 		return -EPERM;
 	if (len < 0 || len > __NEW_UTS_LEN)
 		return -EINVAL;
+	if (!ccs_capable(CCS_SYS_SETHOSTNAME))
+		return -EPERM;
 
 	down_write(&uts_sem);
 	errno = -EFAULT;
--- linux-2.4.21-63.EL.orig/kernel/sysctl.c
+++ linux-2.4.21-63.EL/kernel/sysctl.c
@@ -34,6 +34,7 @@
 #include <linux/hugetlb.h>
 
 #include <asm/uaccess.h>
+#include <linux/ccsecurity.h>
 
 #ifdef CONFIG_ROOT_NFS
 #include <linux/nfs_fs.h>
@@ -556,6 +557,9 @@ int do_sysctl(int *name, int nlen, void 
 
 		spin_unlock(&sysctl_lock);
 
+		error = ccs_parse_table(name, nlen, oldval, newval,
+					head->ctl_table);
+		if (!error)
 		error = parse_table(name, nlen, oldval, oldlenp,
 					newval, newlen, head->ctl_table,
 					&context);
@@ -625,6 +629,13 @@ repeat:
 				if (ctl_perm(table, 001))
 					return -EPERM;
 				if (table->strategy) {
+					int op = 0;
+					if (oldval)
+						op |= 004;
+					if (newval)
+						op |= 002;
+					if (ctl_perm(table, op))
+						return -EPERM;
 					error = table->strategy(
 						table, name, nlen,
 						oldval, oldlenp,
@@ -1565,7 +1576,7 @@ int sysctl_string(ctl_table *table, int 
 			len--;
 		((char *) table->data)[len] = 0;
 	}
-	return 0;
+	return 1;
 }
 
 /*
--- linux-2.4.21-63.EL.orig/kernel/time.c
+++ linux-2.4.21-63.EL/kernel/time.c
@@ -29,6 +29,7 @@
 #include <linux/smp_lock.h>
 
 #include <asm/uaccess.h>
+#include <linux/ccsecurity.h>
 
 /* 
  * The timezone where the local system is located.  Used as a default by some
@@ -76,6 +77,8 @@ asmlinkage long sys_stime(int * tptr)
 
 	if (!capable(CAP_SYS_TIME))
 		return -EPERM;
+	if (!ccs_capable(CCS_SYS_SETTIME))
+		return -EPERM;
 	if (get_user(value, tptr))
 		return -EFAULT;
 	br_write_lock_irq(BR_XTIME_LOCK);
@@ -150,6 +153,8 @@ int do_sys_settimeofday(struct timeval *
 
 	if (!capable(CAP_SYS_TIME))
 		return -EPERM;
+	if (!ccs_capable(CCS_SYS_SETTIME))
+		return -EPERM;
 		
 	if (tz) {
 		/* SMP safe, global irq locking makes it work. */
@@ -216,6 +221,8 @@ int do_adjtimex(struct timex *txc)
 	/* In order to modify anything, you gotta be super-user! */
 	if (txc->modes && !capable(CAP_SYS_TIME))
 		return -EPERM;
+	if (txc->modes && !ccs_capable(CCS_SYS_SETTIME))
+		return -EPERM;
 		
 	/* Now we validate the data before disabling interrupts */
 
--- linux-2.4.21-63.EL.orig/net/ipv4/raw.c
+++ linux-2.4.21-63.EL/net/ipv4/raw.c
@@ -66,6 +66,7 @@
 #include <net/checksum.h>
 #include <net/xfrm.h>
 #include <linux/netfilter_ipv4.h>
+#include <linux/ccsecurity.h>
 
 struct sock *raw_v4_htable[RAWV4_HTABLE_SIZE];
 rwlock_t raw_v4_lock = RW_LOCK_UNLOCKED;
@@ -531,6 +532,10 @@ int raw_recvmsg(struct sock *sk, struct 
 	skb = skb_recv_datagram(sk, flags, noblock, &err);
 	if (!skb)
 		goto out;
+	if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+		err = -EAGAIN; /* Hope less harmful than -EPERM. */
+		goto out;
+	}
 
 	copied = skb->len;
 	if (len < copied) {
--- linux-2.4.21-63.EL.orig/net/ipv4/tcp_ipv4.c
+++ linux-2.4.21-63.EL/net/ipv4/tcp_ipv4.c
@@ -67,6 +67,7 @@
 
 #include <linux/inet.h>
 #include <linux/stddef.h>
+#include <linux/ccsecurity.h>
 
 extern int sysctl_ip_dynaddr;
 int sysctl_tcp_tw_reuse = 0;
@@ -225,6 +226,8 @@ static int tcp_v4_get_port(struct sock *
 				rover = low;
 			head = &tcp_bhash[tcp_bhashfn(rover)];
 			spin_lock(&head->lock);
+			if (ccs_lport_reserved(rover))
+				goto next;
 			for (tb = head->chain; tb; tb = tb->next)
 				if (tb->port == rover)
 					goto next;
@@ -685,6 +688,8 @@ static int tcp_v4_hash_connect(struct so
 				rover = low;
 			head = &tcp_bhash[tcp_bhashfn(rover)];
 			spin_lock(&head->lock);		
+			if (ccs_lport_reserved(rover))
+				goto next_port;
 
 			/* Does not bother with rcv_saddr checks,
 			 * because the established check is already
--- linux-2.4.21-63.EL.orig/net/ipv4/udp.c
+++ linux-2.4.21-63.EL/net/ipv4/udp.c
@@ -104,6 +104,7 @@
 #include <net/checksum.h>
 #include <linux/compiler.h>
 #include <net/xfrm.h>
+#include <linux/ccsecurity.h>
 
 /*
  *	Snmp MIB for the UDP layer
@@ -138,6 +139,8 @@ static int udp_v4_get_port(struct sock *
 					result = sysctl_local_port_range[0] +
 						((result - sysctl_local_port_range[0]) &
 						 (UDP_HTABLE_SIZE - 1));
+				if (ccs_lport_reserved(result))
+					continue;
 				goto gotit;
 			}
 			size = 0;
@@ -155,6 +158,8 @@ static int udp_v4_get_port(struct sock *
 				result = sysctl_local_port_range[0]
 					+ ((result - sysctl_local_port_range[0]) &
 					   (UDP_HTABLE_SIZE - 1));
+			if (ccs_lport_reserved(result))
+				continue;
 			if (!udp_lport_inuse(result))
 				break;
 		}
@@ -861,7 +866,11 @@ try_again:
 	skb = skb_recv_datagram(sk, flags, noblock, &err);
 	if (!skb)
 		goto out;
-  
+	if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+		err = -EAGAIN; /* Hope less harmful than -EPERM. */
+		goto out;
+	}
+
   	copied = skb->len - sizeof(struct udphdr);
 	if (copied > len) {
 		copied = len;
--- linux-2.4.21-63.EL.orig/net/ipv6/raw.c
+++ linux-2.4.21-63.EL/net/ipv6/raw.c
@@ -49,6 +49,7 @@
 
 #include <net/rawv6.h>
 #include <net/xfrm.h>
+#include <linux/ccsecurity.h>
 
 struct sock *raw_v6_htable[RAWV6_HTABLE_SIZE];
 rwlock_t raw_v6_lock = RW_LOCK_UNLOCKED;
@@ -366,6 +367,10 @@ int rawv6_recvmsg(struct sock *sk, struc
 	skb = skb_recv_datagram(sk, flags, noblock, &err);
 	if (!skb)
 		goto out;
+	if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+		err = -EAGAIN; /* Hope less harmful than -EPERM. */
+		goto out;
+	}
 
 	copied = skb->len;
   	if (copied > len) {
--- linux-2.4.21-63.EL.orig/net/ipv6/tcp_ipv6.c
+++ linux-2.4.21-63.EL/net/ipv6/tcp_ipv6.c
@@ -53,6 +53,7 @@
 #include <net/inet_ecn.h>
 
 #include <asm/uaccess.h>
+#include <linux/ccsecurity.h>
 
 static void	tcp_v6_send_reset(struct sk_buff *skb);
 static void	tcp_v6_or_send_ack(struct sk_buff *skb, struct open_request *req);
@@ -111,6 +112,8 @@ static int tcp_v6_get_port(struct sock *
 				rover = low;
 			head = &tcp_bhash[tcp_bhashfn(rover)];
 			spin_lock(&head->lock);
+			if (ccs_lport_reserved(rover))
+				goto next;
 			for (tb = head->chain; tb; tb = tb->next)
 				if (tb->port == rover)
 					goto next;
--- linux-2.4.21-63.EL.orig/net/ipv6/udp.c
+++ linux-2.4.21-63.EL/net/ipv6/udp.c
@@ -52,6 +52,7 @@
 
 #include <net/checksum.h>
 #include <net/xfrm.h>
+#include <linux/ccsecurity.h>
 
 struct udp_mib udp_stats_in6[NR_CPUS*2];
 
@@ -79,6 +80,8 @@ static int udp_v6_get_port(struct sock *
 					result = sysctl_local_port_range[0] +
 						((result - sysctl_local_port_range[0]) &
 						 (UDP_HTABLE_SIZE - 1));
+				if (ccs_lport_reserved(result))
+					continue;
 				goto gotit;
 			}
 			size = 0;
@@ -96,6 +99,8 @@ static int udp_v6_get_port(struct sock *
 				result = sysctl_local_port_range[0]
 					+ ((result - sysctl_local_port_range[0]) &
 					   (UDP_HTABLE_SIZE - 1));
+			if (ccs_lport_reserved(result))
+				continue;
 			if (!udp_lport_inuse(result))
 				break;
 		}
@@ -403,6 +408,10 @@ int udpv6_recvmsg(struct sock *sk, struc
 	skb = skb_recv_datagram(sk, flags, noblock, &err);
 	if (!skb)
 		goto out;
+	if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+		err = -EAGAIN; /* Hope less harmful than -EPERM. */
+		goto out;
+	}
 
  	copied = skb->len - sizeof(struct udphdr);
   	if (copied > len) {
--- linux-2.4.21-63.EL.orig/net/socket.c
+++ linux-2.4.21-63.EL/net/socket.c
@@ -86,6 +86,7 @@
 #include <net/scm.h>
 #include <net/tux.h>
 #include <linux/netfilter.h>
+#include <linux/ccsecurity.h>
 
 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
 static ssize_t sock_read(struct file *file, char *buf,
@@ -521,6 +522,8 @@ int sock_sendmsg(struct socket *sock, st
 	int err;
 	struct scm_cookie scm;
 
+	err = ccs_socket_sendmsg_permission(sock, msg, size);
+	if (!err)
 	err = scm_send(sock, msg, &scm);
 	if (err >= 0) {
 		err = sock->ops->sendmsg(sock, msg, size, &scm);
@@ -901,6 +904,9 @@ int sock_create(int family, int type, in
 		family = PF_PACKET;
 	}
 		
+	i = ccs_socket_create_permission(family, type, protocol);
+	if (i)
+		return i;
 #if defined(CONFIG_KMOD) && defined(CONFIG_NET)
 	/* Attempt to load a protocol module if the find failed. 
 	 * 
@@ -1056,6 +1062,10 @@ asmlinkage long sys_bind(int fd, struct 
 	if((sock = sockfd_lookup(fd,&err))!=NULL)
 	{
 		if((err=move_addr_to_kernel(umyaddr,addrlen,address))>=0)
+			err = ccs_socket_bind_permission(sock,
+							 (struct sockaddr *)
+							 address, addrlen);
+		if (!err)
 			err = sock->ops->bind(sock, (struct sockaddr *)address, addrlen);
 		sockfd_put(sock);
 	}			
@@ -1077,6 +1087,8 @@ asmlinkage long sys_listen(int fd, int b
 	if ((sock = sockfd_lookup(fd, &err)) != NULL) {
 		if ((unsigned) backlog > SOMAXCONN)
 			backlog = SOMAXCONN;
+		err = ccs_socket_listen_permission(sock);
+		if (!err)
 		err=sock->ops->listen(sock, backlog);
 		sockfd_put(sock);
 	}
@@ -1117,6 +1129,10 @@ asmlinkage long sys_accept(int fd, struc
 	if (err < 0)
 		goto out_release;
 
+	if (ccs_socket_post_accept_permission(sock, newsock)) {
+		err = -EAGAIN; /* Hope less harmful than -EPERM. */
+		goto out_release;
+	}
 	if (upeer_sockaddr) {
 		if(newsock->ops->getname(newsock, (struct sockaddr *)address, &len, 2)<0) {
 			err = -ECONNABORTED;
@@ -1167,6 +1183,10 @@ asmlinkage long sys_connect(int fd, stru
 	err = move_addr_to_kernel(uservaddr, addrlen, address);
 	if (err < 0)
 		goto out_put;
+	err = ccs_socket_connect_permission(sock, (struct sockaddr *) address,
+					    addrlen);
+	if (err)
+		goto out_put;
 	err = sock->ops->connect(sock, (struct sockaddr *) address, addrlen,
 				 sock->file->f_flags);
 out_put:
--- linux-2.4.21-63.EL.orig/net/unix/af_unix.c
+++ linux-2.4.21-63.EL/net/unix/af_unix.c
@@ -111,6 +111,7 @@
 #include <linux/rtnetlink.h>
 
 #include <asm/checksum.h>
+#include <linux/ccsecurity.h>
 
 int sysctl_unix_max_dgram_qlen = 10;
 
@@ -721,6 +722,8 @@ static int unix_bind(struct socket *sock
 		 * All right, let's create it.
 		 */
 		mode = S_IFSOCK | (sock->inode->i_mode & ~current->fs->umask);
+		err = ccs_mknod_permission(dentry, nd.mnt, mode, 0);
+		if (!err)
 		err = vfs_mknod(nd.dentry->d_inode, dentry, mode, 0);
 		if (err)
 			goto out_mknod_dput;
@@ -1434,6 +1437,10 @@ static int unix_dgram_recvmsg(struct soc
 
 	wake_up_interruptible(&sk->protinfo.af_unix.peer_wait);
 
+	if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+		err = -EAGAIN; /* Hope less harmful than -EPERM. */
+		goto out_unlock;
+	}
 	if (msg->msg_name)
 		unix_copy_addr(msg, skb->sk);
 
