--- zzzz-none-000/linux-2.6.19.2/kernel/sys.c	2007-01-10 19:10:37.000000000 +0000
+++ davinci-8020-5505/linux-2.6.19.2/kernel/sys.c	2008-04-10 12:21:44.000000000 +0000
@@ -29,6 +29,7 @@
 #include <linux/signal.h>
 #include <linux/cn_proc.h>
 #include <linux/getcpu.h>
+#include <linux/grsecurity.h>
 
 #include <linux/compat.h>
 #include <linux/syscalls.h>
@@ -572,6 +573,12 @@
 		error = -EACCES;
 		goto out;
 	}
+
+	if (gr_handle_chroot_setpriority(p, niceval)) {
+		error = -EACCES;
+		goto out;
+	}
+
 	no_nice = security_task_setnice(p, niceval);
 	if (no_nice) {
 		error = no_nice;
@@ -954,6 +961,9 @@
 	if (rgid != (gid_t) -1 ||
 	    (egid != (gid_t) -1 && egid != old_rgid))
 		current->sgid = new_egid;
+
+	gr_set_role_label(current, current->uid, new_rgid);
+
 	current->fsgid = new_egid;
 	current->egid = new_egid;
 	current->gid = new_rgid;
@@ -981,6 +991,9 @@
 			current->mm->dumpable = suid_dumpable;
 			smp_wmb();
 		}
+
+		gr_set_role_label(current, current->uid, gid);
+
 		current->gid = current->egid = current->sgid = current->fsgid = gid;
 	} else if ((gid == current->gid) || (gid == current->sgid)) {
 		if (old_egid != gid) {
@@ -1018,6 +1031,9 @@
 		current->mm->dumpable = suid_dumpable;
 		smp_wmb();
 	}
+
+	gr_set_role_label(current, new_ruid, current->gid);
+
 	current->uid = new_ruid;
 	return 0;
 }
@@ -1120,6 +1136,9 @@
 	} else if ((uid != current->uid) && (uid != new_suid))
 		return -EPERM;
 
+	if (gr_check_crash_uid(uid))
+		return -EPERM;
+
 	if (old_euid != uid) {
 		current->mm->dumpable = suid_dumpable;
 		smp_wmb();
@@ -1222,8 +1241,10 @@
 		current->egid = egid;
 	}
 	current->fsgid = current->egid;
-	if (rgid != (gid_t) -1)
+	if (rgid != (gid_t) -1) {
+		gr_set_role_label(current, current->uid, rgid);
 		current->gid = rgid;
+	}
 	if (sgid != (gid_t) -1)
 		current->sgid = sgid;
 
@@ -2086,7 +2107,7 @@
 			error = current->mm->dumpable;
 			break;
 		case PR_SET_DUMPABLE:
-			if (arg2 < 0 || arg2 > 1) {
+			if (arg2 > 1) {
 				error = -EINVAL;
 				break;
 			}
@@ -2185,7 +2206,7 @@
 		 * need for a compat_getcpu). 32bit has enough
 		 * padding
 		 */
-		unsigned long t0, t1;
+		unsigned long t0 = 0, t1 = 0;
 		get_user(t0, &cache->blob[0]);
 		get_user(t1, &cache->blob[1]);
 		t0++;