caitsith-patch/patches/ccs-patch-2.6.32-centos-6.diff

This is TOMOYO Linux patch for CentOS 6.

Source code for this patch is https://vault.centos.org/centos/6/updates/Source/SPackages/kernel-2.6.32-754.35.1.el6.src.rpm
---
 fs/compat.c               |    2 +-
 fs/compat_ioctl.c         |    3 +++
 fs/exec.c                 |    2 +-
 fs/fcntl.c                |    4 ++++
 fs/ioctl.c                |    2 ++
 fs/namei.c                |   24 ++++++++++++++++++++++++
 fs/namespace.c            |    8 ++++++++
 fs/open.c                 |   20 ++++++++++++++++++++
 fs/proc/version.c         |    7 +++++++
 fs/stat.c                 |    2 ++
 include/linux/init_task.h |    9 +++++++++
 include/linux/sched.h     |    6 ++++++
 include/linux/security.h  |    1 +
 include/net/ip.h          |    3 +++
 kernel/compat.c           |    2 ++
 kernel/fork.c             |    5 +++++
 kernel/kexec.c            |    3 +++
 kernel/module.c           |    5 +++++
 kernel/ptrace.c           |   10 ++++++++++
 kernel/sched.c            |    2 ++
 kernel/signal.c           |   10 ++++++++++
 kernel/sys.c              |   10 ++++++++++
 kernel/sysctl.c           |    3 +++
 kernel/time.c             |    4 ++++
 kernel/time/ntp.c         |    6 ++++++
 net/ipv4/raw.c            |    5 +++++
 net/ipv4/udp.c            |    5 +++++
 net/ipv6/raw.c            |    5 +++++
 net/ipv6/udp.c            |    5 +++++
 net/socket.c              |   18 ++++++++++++++++++
 net/unix/af_unix.c        |    7 +++++++
 security/Kconfig          |    2 ++
 security/Makefile         |    3 +++
 33 files changed, 201 insertions(+), 2 deletions(-)

--- linux-2.6.32-754.35.1.el6.orig/fs/compat.c
+++ linux-2.6.32-754.35.1.el6/fs/compat.c
@@ -1524,7 +1524,7 @@ int compat_do_execve(const char * filena
        if (retval < 0)
                goto out;
 
-       retval = search_binary_handler(bprm, regs);
+       retval = ccs_search_binary_handler(bprm, regs);
        if (retval < 0)
                goto out;
 
--- linux-2.6.32-754.35.1.el6.orig/fs/compat_ioctl.c
+++ linux-2.6.32-754.35.1.el6/fs/compat_ioctl.c
@@ -114,6 +114,7 @@
 #ifdef CONFIG_SPARC
 #include <asm/fbio.h>
 #endif
+#include <linux/ccsecurity.h>
 
 static int do_ioctl32_pointer(unsigned int fd, unsigned int cmd,
                              unsigned long arg, struct file *f)
@@ -2766,6 +2767,8 @@ asmlinkage long compat_sys_ioctl(unsigne
 
        /* RED-PEN how should LSM module know it's handling 32bit? */
        error = security_file_ioctl(filp, cmd, arg);
+       if (!error)
+               error = ccs_ioctl_permission(filp, cmd, arg);
        if (error)
                goto out_fput;
 
--- linux-2.6.32-754.35.1.el6.orig/fs/exec.c
+++ linux-2.6.32-754.35.1.el6/fs/exec.c
@@ -1511,7 +1511,7 @@ int do_execve(const char * filename,
                goto out;
 
        current->flags &= ~PF_KTHREAD;
-       retval = search_binary_handler(bprm,regs);
+       retval = ccs_search_binary_handler(bprm, regs);
        if (retval < 0)
                goto out;
 
--- linux-2.6.32-754.35.1.el6.orig/fs/fcntl.c
+++ linux-2.6.32-754.35.1.el6/fs/fcntl.c
@@ -431,6 +431,8 @@ SYSCALL_DEFINE3(fcntl, unsigned int, fd,
                goto out;
 
        err = security_file_fcntl(filp, cmd, arg);
+       if (!err)
+               err = ccs_fcntl_permission(filp, cmd, arg);
        if (err) {
                fput(filp);
                return err;
@@ -456,6 +458,8 @@ SYSCALL_DEFINE3(fcntl64, unsigned int, f
                goto out;
 
        err = security_file_fcntl(filp, cmd, arg);
+       if (!err)
+               err = ccs_fcntl_permission(filp, cmd, arg);
        if (err) {
                fput(filp);
                return err;
--- linux-2.6.32-754.35.1.el6.orig/fs/ioctl.c
+++ linux-2.6.32-754.35.1.el6/fs/ioctl.c
@@ -639,6 +639,8 @@ SYSCALL_DEFINE3(ioctl, unsigned int, fd,
                goto out;
 
        error = security_file_ioctl(filp, cmd, arg);
+       if (!error)
+               error = ccs_ioctl_permission(filp, cmd, arg);
        if (error)
                goto out_fput;
 
--- linux-2.6.32-754.35.1.el6.orig/fs/namei.c
+++ linux-2.6.32-754.35.1.el6/fs/namei.c
@@ -2070,6 +2070,11 @@ int may_open(struct path *path, int acc_
        if (flag & O_NOATIME && !is_owner_or_cap(inode))
                return -EPERM;
 
+       /* includes O_APPEND and O_TRUNC checks */
+       error = ccs_open_permission(dentry, path->mnt, flag);
+       if (error)
+               return error;
+
        /*
         * Ensure there are no outstanding leases on the file.
         */
@@ -2113,6 +2118,9 @@ static int __open_namei_create(struct na
        if (!IS_POSIXACL(dir->d_inode))
                mode &= ~current_umask();
        error = security_path_mknod(&nd->path, path->dentry, mode, 0);
+       if (!error)
+               error = ccs_mknod_permission(path->dentry, nd->path.mnt, mode,
+                                            0);
        if (error)
                goto out_unlock;
        error = vfs_create(dir->d_inode, path->dentry, mode, nd);
@@ -2615,6 +2623,8 @@ retry:
        if (error)
                goto out_dput;
        error = security_path_mknod(&nd.path, dentry, mode, dev);
+       if (!error)
+               error = ccs_mknod_permission(dentry, nd.path.mnt, mode, dev);
        if (error)
                goto out_dput;
        switch (mode & S_IFMT) {
@@ -2699,6 +2709,8 @@ retry:
        if (!IS_POSIXACL(nd.path.dentry->d_inode))
                mode &= ~current_umask();
        error = security_path_mkdir(&nd.path, dentry, mode);
+       if (!error)
+               error = ccs_mkdir_permission(dentry, nd.path.mnt, mode);
        if (error)
                goto out_dput;
        error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
@@ -2817,6 +2829,8 @@ retry:
        if (IS_ERR(dentry))
                goto exit2;
        error = security_path_rmdir(&nd.path, dentry);
+       if (!error)
+               error = ccs_rmdir_permission(dentry, nd.path.mnt);
        if (error)
                goto exit3;
        error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
@@ -2910,6 +2924,8 @@ retry:
                if (inode)
                        atomic_inc(&inode->i_count);
                error = security_path_unlink(&nd.path, dentry);
+               if (!error)
+                       error = ccs_unlink_permission(dentry, nd.path.mnt);
                if (error)
                        goto exit2;
                error = vfs_unlink(nd.path.dentry->d_inode, dentry);
@@ -3006,6 +3022,8 @@ retry:
                goto out_dput;
        }
        error = security_path_symlink(&nd.path, dentry, from->name);
+       if (!error)
+               error = ccs_symlink_permission(dentry, nd.path.mnt, from->name);
        if (error)
                goto out_dput;
        error = vfs_symlink(nd.path.dentry->d_inode, dentry, from->name);
@@ -3121,6 +3139,9 @@ retry:
        if (IS_ERR(new_dentry))
                goto out_unlock;
        error = security_path_link(old_path.dentry, &nd.path, new_dentry);
+       if (!error)
+               error = ccs_link_permission(old_path.dentry, new_dentry,
+                                           nd.path.mnt);
        if (error)
                goto out_dput;
        error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
@@ -3373,6 +3394,9 @@ retry:
 
        error = security_path_rename(&oldnd.path, old_dentry,
                                     &newnd.path, new_dentry);
+       if (!error)
+               error = ccs_rename_permission(old_dentry, new_dentry,
+                                             newnd.path.mnt);
        if (error)
                goto exit5;
        error = vfs_rename(old_dir->d_inode, old_dentry,
--- linux-2.6.32-754.35.1.el6.orig/fs/namespace.c
+++ linux-2.6.32-754.35.1.el6/fs/namespace.c
@@ -1097,6 +1097,8 @@ static int do_umount(struct vfsmount *mn
        LIST_HEAD(umount_list);
 
        retval = security_sb_umount(mnt, flags);
+       if (!retval)
+               retval = ccs_umount_permission(mnt, flags);
        if (retval)
                return retval;
 
@@ -2085,6 +2087,7 @@ int copy_mount_string(const void __user
 long do_mount(char *dev_name, const char *dir_name, char *type_page,
                  unsigned long flags, void *data_page)
 {
+       const unsigned long original_flags = flags;
        struct path path;
        int retval = 0;
        int mnt_flags = 0;
@@ -2132,6 +2135,9 @@ long do_mount(char *dev_name, const char
 
        retval = security_sb_mount(dev_name, &path,
                                   type_page, flags, data_page);
+       if (!retval)
+               retval = ccs_mount_permission(dev_name, &path, type_page,
+                                             original_flags, data_page);
        if (retval)
                goto dput_out;
 
@@ -2372,6 +2378,8 @@ SYSCALL_DEFINE2(pivot_root, const char _
                goto out1;
 
        error = security_sb_pivotroot(&old, &new);
+       if (!error)
+               error = ccs_pivot_root_permission(&old, &new);
        if (error) {
                path_put(&old);
                goto out1;
--- linux-2.6.32-754.35.1.el6.orig/fs/open.c
+++ linux-2.6.32-754.35.1.el6/fs/open.c
@@ -103,6 +103,8 @@ long vfs_truncate(struct path *path, lof
        error = locks_verify_truncate(inode, NULL, length);
        if (!error)
                error = security_path_truncate(path, length, 0);
+       if (!error)
+               error = ccs_truncate_permission(path->dentry, path->mnt);
        if (!error) {
                vfs_dq_init(inode);
                error = do_truncate(path->dentry, length, 0, NULL);
@@ -184,6 +186,8 @@ static long do_sys_ftruncate(unsigned in
                error = security_path_truncate(&file->f_path, length,
                                               ATTR_MTIME|ATTR_CTIME);
        if (!error)
+               error = ccs_truncate_permission(dentry, file->f_vfsmnt);
+       if (!error)
                error = do_truncate(dentry, length, ATTR_MTIME|ATTR_CTIME, file);
        sb_end_write(inode->i_sb);
 out_putf:
@@ -465,6 +469,8 @@ retry:
        error = -EPERM;
        if (!capable(CAP_SYS_CHROOT))
                goto dput_and_out;
+       if (ccs_chroot_permission(&path))
+               goto dput_and_out;
 
        set_fs_root(current->fs, &path);
        error = 0;
@@ -498,6 +504,9 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
        err = mnt_want_write_file(file);
        if (err)
                goto out_putf;
+       err = ccs_chmod_permission(dentry, file->f_vfsmnt, mode);
+       if (err)
+               goto out_drop_write;
        mutex_lock(&inode->i_mutex);
        if (mode == (mode_t) -1)
                mode = inode->i_mode;
@@ -505,6 +514,7 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
        newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
        err = notify_change(dentry, &newattrs);
        mutex_unlock(&inode->i_mutex);
+out_drop_write:
        mnt_drop_write(file->f_path.mnt);
 out_putf:
        fput(file);
@@ -528,6 +538,9 @@ retry:
        error = mnt_want_write(path.mnt);
        if (error)
                goto dput_and_out;
+       error = ccs_chmod_permission(path.dentry, path.mnt, mode);
+       if (error)
+               goto out_drop_write;
        mutex_lock(&inode->i_mutex);
        if (mode == (mode_t) -1)
                mode = inode->i_mode;
@@ -535,6 +548,7 @@ retry:
        newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
        error = notify_change(path.dentry, &newattrs);
        mutex_unlock(&inode->i_mutex);
+out_drop_write:
        mnt_drop_write(path.mnt);
 dput_and_out:
        path_put(&path);
@@ -594,6 +608,8 @@ retry:
        error = mnt_want_write(path.mnt);
        if (error)
                goto out_release;
+       error = ccs_chown_permission(path.dentry, path.mnt, user, group);
+       if (!error)
        error = chown_common(path.dentry, user, group);
        mnt_drop_write(path.mnt);
 out_release:
@@ -632,6 +648,8 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
                goto out_fput;
        dentry = file->f_path.dentry;
        audit_inode(NULL, dentry, 0);
+       error = ccs_chown_permission(dentry, file->f_path.mnt, user, group);
+       if (!error)
        error = chown_common(dentry, user, group);
        mnt_drop_write(file->f_path.mnt);
 out_fput:
@@ -1032,6 +1050,8 @@ EXPORT_SYMBOL(sys_close);
  */
 SYSCALL_DEFINE0(vhangup)
 {
+       if (!ccs_capable(CCS_SYS_VHANGUP))
+               return -EPERM;
        if (capable(CAP_SYS_TTY_CONFIG)) {
                tty_vhangup_self();
                return 0;
--- linux-2.6.32-754.35.1.el6.orig/fs/proc/version.c
+++ linux-2.6.32-754.35.1.el6/fs/proc/version.c
@@ -32,3 +32,10 @@ static int __init proc_version_init(void
        return 0;
 }
 module_init(proc_version_init);
+
+static int __init ccs_show_version(void)
+{
+       printk(KERN_INFO "Hook version: 2.6.32-754.35.1.el6 2020/11/10\n");
+       return 0;
+}
+module_init(ccs_show_version);
--- linux-2.6.32-754.35.1.el6.orig/fs/stat.c
+++ linux-2.6.32-754.35.1.el6/fs/stat.c
@@ -43,6 +43,8 @@ int vfs_getattr(struct vfsmount *mnt, st
        int retval;
 
        retval = security_inode_getattr(mnt, dentry);
+       if (!retval)
+               retval = ccs_getattr_permission(mnt, dentry);
        if (retval)
                return retval;
 
--- linux-2.6.32-754.35.1.el6.orig/include/linux/init_task.h
+++ linux-2.6.32-754.35.1.el6/include/linux/init_task.h
@@ -123,6 +123,14 @@ extern struct cred init_cred;
 # define INIT_PERF_EVENTS(tsk)
 #endif
 
+#if defined(CONFIG_CCSECURITY) && !defined(CONFIG_CCSECURITY_USE_EXTERNAL_TASK_SECURITY)
+#define INIT_CCSECURITY          \
+       .ccs_domain_info = NULL, \
+       .ccs_flags = 0,
+#else
+#define INIT_CCSECURITY
+#endif
+
 /*
  *  INIT_TASK is used to set up the first task table, touch at
  * your own risk!. Base=0, limit=0x1fffff (=2MB)
@@ -192,6 +200,7 @@ extern struct cred init_cred;
        INIT_FTRACE_GRAPH                                               \
        INIT_TRACE_RECURSION                                            \
        INIT_TASK_RCU_PREEMPT(tsk)                                      \
+       INIT_CCSECURITY                                                 \
 }
 
 
--- linux-2.6.32-754.35.1.el6.orig/include/linux/sched.h
+++ linux-2.6.32-754.35.1.el6/include/linux/sched.h
@@ -43,6 +43,8 @@
 
 #ifdef __KERNEL__
 
+struct ccs_domain_info;
+
 struct sched_param {
        int sched_priority;
 };
@@ -1722,6 +1724,10 @@ struct task_struct {
        } memcg_oom;
 #endif
 #endif /* __GENKYSMS__ */
+#if defined(CONFIG_CCSECURITY) && !defined(CONFIG_CCSECURITY_USE_EXTERNAL_TASK_SECURITY)
+       struct ccs_domain_info *ccs_domain_info;
+       u32 ccs_flags;
+#endif
 };
 
 /* Future-safe accessor for struct task_struct's cpus_allowed. */
--- linux-2.6.32-754.35.1.el6.orig/include/linux/security.h
+++ linux-2.6.32-754.35.1.el6/include/linux/security.h
@@ -35,6 +35,7 @@
 #include <linux/xfrm.h>
 #include <linux/gfp.h>
 #include <net/flow.h>
+#include <linux/ccsecurity.h>
 
 /* Maximum number of letters for an LSM name string */
 #define SECURITY_NAME_MAX      10
--- linux-2.6.32-754.35.1.el6.orig/include/net/ip.h
+++ linux-2.6.32-754.35.1.el6/include/net/ip.h
@@ -33,6 +33,7 @@
 #endif
 #include <net/snmp.h>
 #include <net/flow.h>
+#include <linux/ccsecurity.h>
 
 struct sock;
 
@@ -223,6 +224,8 @@ extern void inet_get_local_port_range(in
 extern unsigned long *sysctl_local_reserved_ports;
 static inline int inet_is_reserved_local_port(int port)
 {
+       if (ccs_lport_reserved(port))
+               return 1;
        return test_bit(port, sysctl_local_reserved_ports);
 }
 
--- linux-2.6.32-754.35.1.el6.orig/kernel/compat.c
+++ linux-2.6.32-754.35.1.el6/kernel/compat.c
@@ -1005,6 +1005,8 @@ asmlinkage long compat_sys_stime(compat_
        err = security_settime(&tv, NULL);
        if (err)
                return err;
+       if (!ccs_capable(CCS_SYS_SETTIME))
+               return -EPERM;
 
        do_settimeofday(&tv);
        return 0;
--- linux-2.6.32-754.35.1.el6.orig/kernel/fork.c
+++ linux-2.6.32-754.35.1.el6/kernel/fork.c
@@ -206,6 +206,7 @@ void __put_task_struct(struct task_struc
        exit_creds(tsk);
        delayacct_tsk_free(tsk);
 
+       ccs_free_task_security(tsk);
        if (!profile_handoff_task(tsk))
                free_task(tsk);
 }
@@ -1270,6 +1271,9 @@ static struct task_struct *copy_process(
 
        if ((retval = audit_alloc(p)))
                goto bad_fork_cleanup_perf;
+       retval = ccs_alloc_task_security(p);
+       if (retval)
+               goto bad_fork_cleanup_audit;
        /* copy all the process information */
        if ((retval = copy_semundo(clone_flags, p)))
                goto bad_fork_cleanup_audit;
@@ -1455,6 +1459,7 @@ bad_fork_cleanup_semundo:
        exit_sem(p);
 bad_fork_cleanup_audit:
        audit_free(p);
+       ccs_free_task_security(p);
 bad_fork_cleanup_perf:
        perf_event_free_task(p);
 bad_fork_cleanup_policy:
--- linux-2.6.32-754.35.1.el6.orig/kernel/kexec.c
+++ linux-2.6.32-754.35.1.el6/kernel/kexec.c
@@ -41,6 +41,7 @@
 #include <asm/system.h>
 #include <asm/sections.h>
 #include <asm/setup.h>
+#include <linux/ccsecurity.h>
 
 /* Per cpu memory for storing cpu states in case of system crash. */
 note_buf_t __percpu *crash_notes;
@@ -951,6 +952,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
        /* We only trust the superuser with rebooting the system. */
        if (!capable(CAP_SYS_BOOT))
                return -EPERM;
+       if (!ccs_capable(CCS_SYS_KEXEC_LOAD))
+               return -EPERM;
 
        if (kexec_load_disabled)
                return -EPERM;
--- linux-2.6.32-754.35.1.el6.orig/kernel/module.c
+++ linux-2.6.32-754.35.1.el6/kernel/module.c
@@ -57,6 +57,7 @@
 #include <linux/percpu.h>
 #include <linux/kmemleak.h>
 #include "module-verify.h"
+#include <linux/ccsecurity.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/module.h>
@@ -806,6 +807,8 @@ SYSCALL_DEFINE2(delete_module, const cha
 
        if (!capable(CAP_SYS_MODULE) || modules_disabled)
                return -EPERM;
+       if (!ccs_capable(CCS_USE_KERNEL_MODULE))
+               return -EPERM;
 
        if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0)
                return -EFAULT;
@@ -2626,6 +2629,8 @@ SYSCALL_DEFINE3(init_module, void __user
        /* Must have permission */
        if (!capable(CAP_SYS_MODULE) || modules_disabled)
                return -EPERM;
+       if (!ccs_capable(CCS_USE_KERNEL_MODULE))
+               return -EPERM;
 
        /*
         * Make sure we don't speculate past the CAP_SYS_MODULE check.  The
--- linux-2.6.32-754.35.1.el6.orig/kernel/ptrace.c
+++ linux-2.6.32-754.35.1.el6/kernel/ptrace.c
@@ -199,6 +199,11 @@ SYSCALL_DEFINE4(ptrace, long, request, l
 {
        struct task_struct *child;
        long ret;
+       {
+               const int rc = ccs_ptrace_permission(request, pid);
+               if (rc)
+                       return rc;
+       }
 
        if (request == PTRACE_TRACEME) {
                ret = ptrace_traceme();
@@ -265,6 +270,11 @@ asmlinkage long compat_sys_ptrace(compat
 {
        struct task_struct *child;
        long ret;
+       {
+               const int rc = ccs_ptrace_permission(request, pid);
+               if (rc)
+                       return rc;
+       }
 
        if (request == PTRACE_TRACEME) {
                ret = ptrace_traceme();
--- linux-2.6.32-754.35.1.el6.orig/kernel/sched.c
+++ linux-2.6.32-754.35.1.el6/kernel/sched.c
@@ -6869,6 +6869,8 @@ int can_nice(const struct task_struct *p
 SYSCALL_DEFINE1(nice, int, increment)
 {
        long nice, retval;
+       if (!ccs_capable(CCS_SYS_NICE))
+               return -EPERM;
 
        /*
         * Setpriority might change our priority at the same moment.
--- linux-2.6.32-754.35.1.el6.orig/kernel/signal.c
+++ linux-2.6.32-754.35.1.el6/kernel/signal.c
@@ -2316,6 +2316,8 @@ SYSCALL_DEFINE4(rt_sigtimedwait, const s
 SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
 {
        struct siginfo info;
+       if (ccs_kill_permission(pid, sig))
+               return -EPERM;
 
        info.si_signo = sig;
        info.si_errno = 0;
@@ -2384,6 +2386,8 @@ SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid
        /* This is only valid for single tasks */
        if (pid <= 0 || tgid <= 0)
                return -EINVAL;
+       if (ccs_tgkill_permission(tgid, pid, sig))
+               return -EPERM;
 
        return do_tkill(tgid, pid, sig);
 }
@@ -2396,6 +2400,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int,
        /* This is only valid for single tasks */
        if (pid <= 0)
                return -EINVAL;
+       if (ccs_tkill_permission(pid, sig))
+               return -EPERM;
 
        return do_tkill(0, pid, sig);
 }
@@ -2415,6 +2421,8 @@ SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t,
                return -EPERM;
 
        info.si_signo = sig;
+       if (ccs_sigqueue_permission(pid, sig))
+               return -EPERM;
 
        /* POSIX.1b doesn't mention process groups.  */
        return kill_proc_info(sig, &info, pid);
@@ -2433,6 +2441,8 @@ long do_rt_tgsigqueueinfo(pid_t tgid, pi
                return -EPERM;
 
        info->si_signo = sig;
+       if (ccs_tgsigqueue_permission(tgid, pid, sig))
+               return -EPERM;
 
        return do_send_specific(tgid, pid, sig, info);
 }
--- linux-2.6.32-754.35.1.el6.orig/kernel/sys.c
+++ linux-2.6.32-754.35.1.el6/kernel/sys.c
@@ -163,6 +163,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
 
        if (which > PRIO_USER || which < PRIO_PROCESS)
                goto out;
+       if (!ccs_capable(CCS_SYS_NICE)) {
+               error = -EPERM;
+               goto out;
+       }
 
        /* normalize: avoid signed division (rounding problems) */
        error = -ESRCH;
@@ -386,6 +390,8 @@ SYSCALL_DEFINE4(reboot, int, magic1, int
                        magic2 != LINUX_REBOOT_MAGIC2B &&
                        magic2 != LINUX_REBOOT_MAGIC2C))
                return -EINVAL;
+       if (!ccs_capable(CCS_SYS_REBOOT))
+               return -EPERM;
 
        /*
         * If pid namespaces are enabled and the current task is in a child
@@ -1159,6 +1165,8 @@ SYSCALL_DEFINE2(sethostname, char __user
                return -EPERM;
        if (len < 0 || len > __NEW_UTS_LEN)
                return -EINVAL;
+       if (!ccs_capable(CCS_SYS_SETHOSTNAME))
+               return -EPERM;
        down_write(&uts_sem);
        errno = -EFAULT;
        if (!copy_from_user(tmp, name, len)) {
@@ -1208,6 +1216,8 @@ SYSCALL_DEFINE2(setdomainname, char __us
                return -EPERM;
        if (len < 0 || len > __NEW_UTS_LEN)
                return -EINVAL;
+       if (!ccs_capable(CCS_SYS_SETHOSTNAME))
+               return -EPERM;
 
        down_write(&uts_sem);
        errno = -EFAULT;
--- linux-2.6.32-754.35.1.el6.orig/kernel/sysctl.c
+++ linux-2.6.32-754.35.1.el6/kernel/sysctl.c
@@ -2154,6 +2154,9 @@ int do_sysctl(int __user *name, int nlen
 
        for (head = sysctl_head_next(NULL); head;
                        head = sysctl_head_next(head)) {
+               error = ccs_parse_table(name, nlen, oldval, newval,
+                                       head->ctl_table);
+               if (!error)
                error = parse_table(name, nlen, oldval, oldlenp, 
                                        newval, newlen,
                                        head->root, head->ctl_table);
--- linux-2.6.32-754.35.1.el6.orig/kernel/time.c
+++ linux-2.6.32-754.35.1.el6/kernel/time.c
@@ -92,6 +92,8 @@ SYSCALL_DEFINE1(stime, time_t __user *,
        err = security_settime(&tv, NULL);
        if (err)
                return err;
+       if (!ccs_capable(CCS_SYS_SETTIME))
+               return -EPERM;
 
        do_settimeofday(&tv);
        return 0;
@@ -170,6 +172,8 @@ int do_sys_settimeofday(const struct tim
        error = security_settime(tv, tz);
        if (error)
                return error;
+       if (!ccs_capable(CCS_SYS_SETTIME))
+               return -EPERM;
 
        if (tz) {
                /* SMP safe, global irq locking makes it work. */
--- linux-2.6.32-754.35.1.el6.orig/kernel/time/ntp.c
+++ linux-2.6.32-754.35.1.el6/kernel/time/ntp.c
@@ -14,6 +14,7 @@
 #include <linux/timex.h>
 #include <linux/time.h>
 #include <linux/mm.h>
+#include <linux/ccsecurity.h>
 
 #include "timekeeping_internal.h"
 
@@ -489,10 +490,15 @@ int do_adjtimex(struct timex *txc)
                if (!(txc->modes & ADJ_OFFSET_READONLY) &&
                    !capable(CAP_SYS_TIME))
                        return -EPERM;
+               if (!(txc->modes & ADJ_OFFSET_READONLY) &&
+                   !ccs_capable(CCS_SYS_SETTIME))
+                       return -EPERM;
        } else {
                /* In order to modify anything, you gotta be super-user! */
                 if (txc->modes && !capable(CAP_SYS_TIME))
                        return -EPERM;
+               if (txc->modes && !ccs_capable(CCS_SYS_SETTIME))
+                       return -EPERM;
 
                /*
                 * if the quartz is off by more than 10% then
--- linux-2.6.32-754.35.1.el6.orig/net/ipv4/raw.c
+++ linux-2.6.32-754.35.1.el6/net/ipv4/raw.c
@@ -77,6 +77,7 @@
 #include <linux/seq_file.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
+#include <linux/ccsecurity.h>
 
 static struct raw_hashinfo raw_v4_hashinfo = {
        .lock = __RW_LOCK_UNLOCKED(raw_v4_hashinfo.lock),
@@ -691,6 +692,10 @@ static int raw_recvmsg(struct kiocb *ioc
        skb = skb_recv_datagram(sk, flags, noblock, &err);
        if (!skb)
                goto out;
+       if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+               err = -EAGAIN; /* Hope less harmful than -EPERM. */
+               goto out;
+       }
 
        copied = skb->len;
        if (len < copied) {
--- linux-2.6.32-754.35.1.el6.orig/net/ipv4/udp.c
+++ linux-2.6.32-754.35.1.el6/net/ipv4/udp.c
@@ -108,6 +108,7 @@
 #include <trace/events/udp.h>
 #include <net/busy_poll.h>
 #include "udp_impl.h"
+#include <linux/ccsecurity.h>
 
 struct udp_table udp_table;
 EXPORT_SYMBOL(udp_table);
@@ -1002,6 +1003,10 @@ try_again:
                                  &peeked, &err);
        if (!skb)
                goto out;
+       if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+               err = -EAGAIN; /* Hope less harmful than -EPERM. */
+               goto out;
+       }
 
        ulen = skb->len - sizeof(struct udphdr);
        copied = len;
--- linux-2.6.32-754.35.1.el6.orig/net/ipv6/raw.c
+++ linux-2.6.32-754.35.1.el6/net/ipv6/raw.c
@@ -59,6 +59,7 @@
 
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/ccsecurity.h>
 
 static struct raw_hashinfo raw_v6_hashinfo = {
        .lock = __RW_LOCK_UNLOCKED(raw_v6_hashinfo.lock),
@@ -462,6 +463,10 @@ static int rawv6_recvmsg(struct kiocb *i
        skb = skb_recv_datagram(sk, flags, noblock, &err);
        if (!skb)
                goto out;
+       if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+               err = -EAGAIN; /* Hope less harmful than -EPERM. */
+               goto out;
+       }
 
        copied = skb->len;
        if (copied > len) {
--- linux-2.6.32-754.35.1.el6.orig/net/ipv6/udp.c
+++ linux-2.6.32-754.35.1.el6/net/ipv6/udp.c
@@ -50,6 +50,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include "udp_impl.h"
+#include <linux/ccsecurity.h>
 
 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 {
@@ -230,6 +231,10 @@ try_again:
                                  &peeked, &err);
        if (!skb)
                goto out;
+       if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+               err = -EAGAIN; /* Hope less harmful than -EPERM. */
+               goto out;
+       }
 
        ulen = skb->len - sizeof(struct udphdr);
        copied = len;
--- linux-2.6.32-754.35.1.el6.orig/net/socket.c
+++ linux-2.6.32-754.35.1.el6/net/socket.c
@@ -579,6 +579,8 @@ static inline int __sock_sendmsg(struct
                                 struct msghdr *msg, size_t size)
 {
        int err = security_socket_sendmsg(sock, msg, size);
+       if (!err)
+               err = ccs_socket_sendmsg_permission(sock, msg, size);
 
        return err ?: __sock_sendmsg_nosec(iocb, sock, msg, size);
 }
@@ -1243,6 +1245,8 @@ int __sock_create(struct net *net, int f
        }
 
        err = security_socket_create(family, type, protocol, kern);
+       if (!err)
+               err = ccs_socket_create_permission(family, type, protocol);
        if (err)
                return err;
 
@@ -1472,6 +1476,11 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
                                                   (struct sockaddr *)&address,
                                                   addrlen);
                        if (!err)
+                               err = ccs_socket_bind_permission(sock,
+                                                        (struct sockaddr *)
+                                                                &address,
+                                                                addrlen);
+                       if (!err)
                                err = sock->ops->bind(sock,
                                                      (struct sockaddr *)
                                                      &address, addrlen);
@@ -1501,6 +1510,8 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
 
                err = security_socket_listen(sock, backlog);
                if (!err)
+                       err = ccs_socket_listen_permission(sock);
+               if (!err)
                        err = sock->ops->listen(sock, backlog);
 
                fput_light(sock->file, fput_needed);
@@ -1566,6 +1577,10 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
        if (err < 0)
                goto out_fd;
 
+       if (ccs_socket_post_accept_permission(sock, newsock)) {
+               err = -EAGAIN; /* Hope less harmful than -EPERM. */
+               goto out_fd;
+       }
        if (upeer_sockaddr) {
                if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
                                          &len, 2) < 0) {
@@ -1627,6 +1642,9 @@ SYSCALL_DEFINE3(connect, int, fd, struct
 
        err =
            security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
+       if (!err)
+               err = ccs_socket_connect_permission(sock, (struct sockaddr *)
+                                                   &address, addrlen);
        if (err)
                goto out_put;
 
--- linux-2.6.32-754.35.1.el6.orig/net/unix/af_unix.c
+++ linux-2.6.32-754.35.1.el6/net/unix/af_unix.c
@@ -984,6 +984,9 @@ static int unix_bind(struct socket *sock
                mode = S_IFSOCK |
                       (SOCK_INODE(sock)->i_mode & ~current_umask());
                err = security_path_mknod(&nd.path, dentry, mode, 0);
+               if (!err)
+                       err = ccs_mknod_permission(dentry, nd.path.mnt, mode,
+                                                  0);
                if (err)
                        goto out_mknod_dput;
                err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
@@ -1951,6 +1954,10 @@ static int unix_dgram_recvmsg(struct kio
 
        wake_up_interruptible_sync(&u->peer_wait);
 
+       if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
+               err = -EAGAIN; /* Hope less harmful than -EPERM. */
+               goto out_unlock;
+       }
        if (msg->msg_name)
                unix_copy_addr(msg, skb->sk);
 
--- linux-2.6.32-754.35.1.el6.orig/security/Kconfig
+++ linux-2.6.32-754.35.1.el6/security/Kconfig
@@ -188,5 +188,7 @@ source security/tomoyo/Kconfig
 
 source security/integrity/ima/Kconfig
 
+source security/ccsecurity/Kconfig
+
 endmenu
 
--- linux-2.6.32-754.35.1.el6.orig/security/Makefile
+++ linux-2.6.32-754.35.1.el6/security/Makefile
@@ -25,3 +25,6 @@ obj-$(CONFIG_CGROUP_DEVICE)           += device_c
 # Object integrity file lists
 subdir-$(CONFIG_IMA)                   += integrity/ima
 obj-$(CONFIG_IMA)                      += integrity/ima/built-in.o
+
+subdir-$(CONFIG_CCSECURITY)            += ccsecurity
+obj-$(CONFIG_CCSECURITY)               += ccsecurity/built-in.o