--- zzzz-none-000/linux-2.6.19.2/fs/namei.c	2007-01-10 19:10:37.000000000 +0000
+++ davinci-8020-5505/linux-2.6.19.2/fs/namei.c	2007-01-19 14:42:56.000000000 +0000
@@ -32,6 +32,7 @@
 #include <linux/file.h>
 #include <linux/fcntl.h>
 #include <linux/namei.h>
+#include <linux/grsecurity.h>
 #include <asm/namei.h>
 #include <asm/uaccess.h>
 
@@ -640,6 +641,13 @@
 	err = security_inode_follow_link(path->dentry, nd);
 	if (err)
 		goto loop;
+
+	if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
+				  path->dentry->d_inode, path->dentry, nd->mnt)) {
+		err = -EACCES;
+		goto loop;
+	}
+
 	current->link_count++;
 	current->total_link_count++;
 	nd->depth++;
@@ -985,11 +993,18 @@
 				break;
 		}
 return_base:
+		if (!gr_acl_handle_hidden_file(nd->dentry, nd->mnt)) {
+			path_release(nd);
+			return -ENOENT;
+		}
 		return 0;
 out_dput:
 		dput_path(&next, nd);
 		break;
 	}
+	if (!gr_acl_handle_hidden_file(nd->dentry, nd->mnt))
+		err = -ENOENT;
+
 	path_release(nd);
 return_err:
 	return err;
@@ -1601,9 +1616,17 @@
 	int error;
 	struct dentry *dir = nd->dentry;
 
+	if (!gr_acl_handle_creat(path->dentry, nd->dentry, nd->mnt, flag, mode)) {
+		error = -EACCES;
+		goto out_unlock_dput;
+	}
+
 	if (!IS_POSIXACL(dir->d_inode))
 		mode &= ~current->fs->umask;
 	error = vfs_create(dir->d_inode, path->dentry, mode, nd);
+	if (!error)
+		gr_handle_create(path->dentry, nd->mnt);
+out_unlock_dput:
 	mutex_unlock(&dir->d_inode->i_mutex);
 	dput(nd->dentry);
 	nd->dentry = path->dentry;
@@ -1654,6 +1677,17 @@
 					 nd, flag);
 		if (error)
 			return error;
+
+		if (gr_handle_rawio(nd->dentry->d_inode)) {
+			error = -EPERM;
+			goto exit;
+		}
+
+		if (!gr_acl_handle_open(nd->dentry, nd->mnt, flag)) {
+			error = -EACCES;
+			goto exit;
+		}
+
 		goto ok;
 	}
 
@@ -1703,6 +1737,23 @@
 	/*
 	 * It already exists.
 	 */
+
+	if (gr_handle_rawio(path.dentry->d_inode)) {
+		mutex_unlock(&dir->d_inode->i_mutex);
+		error = -EPERM;
+		goto exit_dput;
+	}
+	if (!gr_acl_handle_open(path.dentry, nd->mnt, flag)) {
+		mutex_unlock(&dir->d_inode->i_mutex);
+		error = -EACCES;
+		goto exit_dput;
+	}
+	if (gr_handle_fifo(path.dentry, nd->mnt, dir, flag, acc_mode)) {
+		mutex_unlock(&dir->d_inode->i_mutex);
+		error = -EACCES;
+		goto exit_dput;
+	}
+
 	mutex_unlock(&dir->d_inode->i_mutex);
 	audit_inode_update(path.dentry->d_inode);
 
@@ -1758,6 +1809,13 @@
 	error = security_inode_follow_link(path.dentry, nd);
 	if (error)
 		goto exit_dput;
+
+	if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
+				  path.dentry, nd->mnt)) {
+		error = -EACCES;
+		goto exit_dput;
+	}
+
 	error = __do_follow_link(&path, nd);
 	if (error) {
 		/* Does someone understand code flow here? Or it is only
@@ -1886,6 +1944,22 @@
 	if (!IS_POSIXACL(nd.dentry->d_inode))
 		mode &= ~current->fs->umask;
 	if (!IS_ERR(dentry)) {
+		if (gr_handle_chroot_mknod(dentry, nd.mnt, mode)) {
+			error = -EPERM;
+			dput(dentry);
+			mutex_unlock(&nd.dentry->d_inode->i_mutex);
+			path_release(&nd);
+			goto out;
+		}
+
+		if (!gr_acl_handle_mknod(dentry, nd.dentry, nd.mnt, mode)) {
+			error = -EACCES;
+			dput(dentry);
+			mutex_unlock(&nd.dentry->d_inode->i_mutex);
+			path_release(&nd);
+			goto out;
+		}
+
 		switch (mode & S_IFMT) {
 		case 0: case S_IFREG:
 			error = vfs_create(nd.dentry->d_inode,dentry,mode,&nd);
@@ -1903,6 +1977,10 @@
 		default:
 			error = -EINVAL;
 		}
+
+		if (!error)
+			gr_handle_create(dentry, nd.mnt);
+
 		dput(dentry);
 	}
 	mutex_unlock(&nd.dentry->d_inode->i_mutex);
@@ -1960,9 +2038,18 @@
 	if (IS_ERR(dentry))
 		goto out_unlock;
 
+	if (!gr_acl_handle_mkdir(dentry, nd.dentry, nd.mnt)) {
+		error = -EACCES;
+		goto out_unlock_dput;
+	}
+
 	if (!IS_POSIXACL(nd.dentry->d_inode))
 		mode &= ~current->fs->umask;
 	error = vfs_mkdir(nd.dentry->d_inode, dentry, mode);
+
+	if (!error)
+		gr_handle_create(dentry, nd.mnt);
+out_unlock_dput:
 	dput(dentry);
 out_unlock:
 	mutex_unlock(&nd.dentry->d_inode->i_mutex);
@@ -2045,6 +2132,8 @@
 	char * name;
 	struct dentry *dentry;
 	struct nameidata nd;
+	ino_t saved_ino = 0;
+	dev_t saved_dev = 0;
 
 	name = getname(pathname);
 	if(IS_ERR(name))
@@ -2070,7 +2159,22 @@
 	error = PTR_ERR(dentry);
 	if (IS_ERR(dentry))
 		goto exit2;
+
+	if (dentry->d_inode != NULL) {
+		if (dentry->d_inode->i_nlink <= 1) {
+			saved_ino = dentry->d_inode->i_ino;
+			saved_dev = dentry->d_inode->i_sb->s_dev;
+		}
+
+		if (!gr_acl_handle_rmdir(dentry, nd.mnt)) {
+			error = -EACCES;
+			goto dput_exit2;
+		}
+	}
 	error = vfs_rmdir(nd.dentry->d_inode, dentry);
+	if (!error && (saved_dev || saved_ino))
+		gr_handle_delete(saved_ino, saved_dev);
+dput_exit2:
 	dput(dentry);
 exit2:
 	mutex_unlock(&nd.dentry->d_inode->i_mutex);
@@ -2129,6 +2233,8 @@
 	struct dentry *dentry;
 	struct nameidata nd;
 	struct inode *inode = NULL;
+	ino_t saved_ino = 0;
+	dev_t saved_dev = 0;
 
 	name = getname(pathname);
 	if(IS_ERR(name))
@@ -2144,13 +2250,26 @@
 	dentry = lookup_hash(&nd);
 	error = PTR_ERR(dentry);
 	if (!IS_ERR(dentry)) {
+		error = 0;
 		/* Why not before? Because we want correct error value */
 		if (nd.last.name[nd.last.len])
 			goto slashes;
 		inode = dentry->d_inode;
-		if (inode)
+		if (inode) {
+			if (inode->i_nlink <= 1) {
+				saved_ino = inode->i_ino;
+				saved_dev = inode->i_sb->s_dev;
+			}
+
+			if (!gr_acl_handle_unlink(dentry, nd.mnt))
+				error = -EACCES;
+
 			atomic_inc(&inode->i_count);
-		error = vfs_unlink(nd.dentry->d_inode, dentry);
+		}
+		if (!error)
+			error = vfs_unlink(nd.dentry->d_inode, dentry);
+		if (!error && (saved_ino || saved_dev))
+			gr_handle_delete(saved_ino, saved_dev);
 	exit2:
 		dput(dentry);
 	}
@@ -2231,7 +2350,16 @@
 	if (IS_ERR(dentry))
 		goto out_unlock;
 
+	if (!gr_acl_handle_symlink(dentry, nd.dentry, nd.mnt, from)) {
+		error = -EACCES;
+		goto out_dput_unlock;
+	}
+
 	error = vfs_symlink(nd.dentry->d_inode, dentry, from, S_IALLUGO);
+
+	if (!error)
+		gr_handle_create(dentry, nd.mnt);
+out_dput_unlock:
 	dput(dentry);
 out_unlock:
 	mutex_unlock(&nd.dentry->d_inode->i_mutex);
@@ -2326,7 +2454,25 @@
 	error = PTR_ERR(new_dentry);
 	if (IS_ERR(new_dentry))
 		goto out_unlock;
+
+	if (gr_handle_hardlink(old_nd.dentry, old_nd.mnt,
+			       old_nd.dentry->d_inode,
+			       old_nd.dentry->d_inode->i_mode, to)) {
+		error = -EACCES;
+		goto out_unlock_dput;
+	}
+
+	if (!gr_acl_handle_link(new_dentry, nd.dentry, nd.mnt,
+				old_nd.dentry, old_nd.mnt, to)) {
+		error = -EACCES;
+		goto out_unlock_dput;
+	}
+
 	error = vfs_link(old_nd.dentry, nd.dentry->d_inode, new_dentry);
+
+	if (!error)
+		gr_handle_create(new_dentry, nd.mnt);
+out_unlock_dput:
 	dput(new_dentry);
 out_unlock:
 	mutex_unlock(&nd.dentry->d_inode->i_mutex);
@@ -2552,8 +2698,16 @@
 	if (new_dentry == trap)
 		goto exit5;
 
-	error = vfs_rename(old_dir->d_inode, old_dentry,
+	error = gr_acl_handle_rename(new_dentry, newnd.dentry, newnd.mnt,
+				     old_dentry, old_dir->d_inode, oldnd.mnt,
+				     newname);
+
+	if (!error)
+		error = vfs_rename(old_dir->d_inode, old_dentry,
 				   new_dir->d_inode, new_dentry);
+	if (!error)
+		gr_handle_rename(old_dir->d_inode, newnd.dentry->d_inode, old_dentry, 
+				 new_dentry, oldnd.mnt, new_dentry->d_inode ? 1 : 0);
 exit5:
 	dput(new_dentry);
 exit4: