2.6.25-rc7

 kernel

diff --git a/kernel/sys.c b/kernel/sys.c
index d1fe71e..a626116 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -315,7 +315,7 @@ static void kernel_kexec(void)
 #endif
 }
 
-void kernel_shutdown_prepare(enum system_states state)
+static void kernel_shutdown_prepare(enum system_states state)
 {
    blocking_notifier_call_chain(&reboot_notifier_list,
       (state == SYSTEM_HALT)?SYS_HALT:SYS_POWER_OFF, NULL);
@@ -916,8 +916,8 @@ asmlinkage long sys_setpgid(pid_t pid, pid_t pgid)
 {
    struct task_struct *p;
    struct task_struct *group_leader = current->group_leader;
-   int err = -EINVAL;
-   struct pid_namespace *ns;
+   struct pid *pgrp;
+   int err;
 
    if (!pid)
       pid = task_pid_vnr(group_leader);
@@ -929,12 +929,10 @@ asmlinkage long sys_setpgid(pid_t pid, pid_t pgid)
    /* From this point forward we keep holding onto the tasklist lock
     * so that our parent does not change from under us. -DaveM
     */
-   ns = current->nsproxy->pid_ns;
-
    write_lock_irq(&tasklist_lock);
 
    err = -ESRCH;
-   p = find_task_by_pid_ns(pid, ns);
+   p = find_task_by_vpid(pid);
    if (!p)
       goto out;
 
@@ -942,7 +940,7 @@ asmlinkage long sys_setpgid(pid_t pid, pid_t pgid)
    if (!thread_group_leader(p))
       goto out;
 
-   if (p->real_parent->tgid == group_leader->tgid) {
+   if (same_thread_group(p->real_parent, group_leader)) {
       err = -EPERM;
       if (task_session(p) != task_session(group_leader))
          goto out;
@@ -959,10 +957,12 @@ asmlinkage long sys_setpgid(pid_t pid, pid_t pgid)
    if (p->signal->leader)
       goto out;
 
+   pgrp = task_pid(p);
    if (pgid != pid) {
       struct task_struct *g;
 
-      g = find_task_by_pid_type_ns(PIDTYPE_PGID, pgid, ns);
+      pgrp = find_vpid(pgid);
+      g = pid_task(pgrp, PIDTYPE_PGID);
       if (!g || task_session(g) != task_session(group_leader))
          goto out;
    }
@@ -971,13 +971,10 @@ asmlinkage long sys_setpgid(pid_t pid, pid_t pgid)
    if (err)
       goto out;
 
-   if (task_pgrp_nr_ns(p, ns) != pgid) {
-      struct pid *pid;
-
+   if (task_pgrp(p) != pgrp) {
       detach_pid(p, PIDTYPE_PGID);
-      pid = find_vpid(pgid);
-      attach_pid(p, PIDTYPE_PGID, pid);
-      set_task_pgrp(p, pid_nr(pid));
+      attach_pid(p, PIDTYPE_PGID, pgrp);
+      set_task_pgrp(p, pid_nr(pgrp));
    }
 
    err = 0;
@@ -994,17 +991,14 @@ asmlinkage long sys_getpgid(pid_t pid)
    else {
       int retval;
       struct task_struct *p;
-      struct pid_namespace *ns;
-
-      ns = current->nsproxy->pid_ns;
 
       read_lock(&tasklist_lock);
-      p = find_task_by_pid_ns(pid, ns);
+      p = find_task_by_vpid(pid);
       retval = -ESRCH;
       if (p) {
          retval = security_task_getpgid(p);
          if (!retval)
-            retval = task_pgrp_nr_ns(p, ns);
+            retval = task_pgrp_vnr(p);
       }
       read_unlock(&tasklist_lock);
       return retval;
@@ -1028,19 +1022,16 @@ asmlinkage long sys_getsid(pid_t pid)
    else {
       int retval;
       struct task_struct *p;
-      struct pid_namespace *ns;
-
-      ns = current->nsproxy->pid_ns;
 
-      read_lock(&tasklist_lock);
-      p = find_task_by_pid_ns(pid, ns);
+      rcu_read_lock();
+      p = find_task_by_vpid(pid);
       retval = -ESRCH;
       if (p) {
          retval = security_task_getsid(p);
          if (!retval)
-            retval = task_session_nr_ns(p, ns);
+            retval = task_session_vnr(p);
       }
-      read_unlock(&tasklist_lock);
+      rcu_read_unlock();
       return retval;
    }
 }
@@ -1048,35 +1039,29 @@ asmlinkage long sys_getsid(pid_t pid)
 asmlinkage long sys_setsid(void)
 {
    struct task_struct *group_leader = current->group_leader;
-   pid_t session;
+   struct pid *sid = task_pid(group_leader);
+   pid_t session = pid_vnr(sid);
    int err = -EPERM;
 
    write_lock_irq(&tasklist_lock);
-
    /* Fail if I am already a session leader */
    if (group_leader->signal->leader)
       goto out;
 
-   session = group_leader->pid;
    /* Fail if a process group id already exists that equals the
     * proposed session id.
-    *
-    * Don't check if session id == 1 because kernel threads use this
-    * session id and so the check will always fail and make it so
-    * init cannot successfully call setsid.
     */
-   if (session > 1 && find_task_by_pid_type_ns(PIDTYPE_PGID,
-            session, &init_pid_ns))
+   if (pid_task(sid, PIDTYPE_PGID))
       goto out;
 
    group_leader->signal->leader = 1;
-   __set_special_pids(session, session);
+   __set_special_pids(sid);
 
    spin_lock(&group_leader->sighand->siglock);
    group_leader->signal->tty = NULL;
    spin_unlock(&group_leader->sighand->siglock);
 
-   err = task_pgrp_vnr(group_leader);
+   err = session;
 out:
    write_unlock_irq(&tasklist_lock);
    return err;
@@ -1145,16 +1130,16 @@ static int groups_to_user(gid_t __user *grouplist,
     struct group_info *group_info)
 {
    int i;
-   int count = group_info->ngroups;
+   unsigned int count = group_info->ngroups;
 
    for (i = 0; i < group_info->nblocks; i++) {
-      int cp_count = min(NGROUPS_PER_BLOCK, count);
-      int off = i * NGROUPS_PER_BLOCK;
-      int len = cp_count * sizeof(*grouplist);
+      unsigned int cp_count = min(NGROUPS_PER_BLOCK, count);
+      unsigned int len = cp_count * sizeof(*grouplist);
 
-      if (copy_to_user(grouplist+off, group_info->blocks[i], len))
+      if (copy_to_user(grouplist, group_info->blocks[i], len))
          return -EFAULT;
 
+      grouplist += NGROUPS_PER_BLOCK;
       count -= cp_count;
    }
    return 0;
@@ -1165,16 +1150,16 @@ static int groups_from_user(struct group_info *group_info,
     gid_t __user *grouplist)
 {
    int i;
-   int count = group_info->ngroups;
+   unsigned int count = group_info->ngroups;
 
    for (i = 0; i < group_info->nblocks; i++) {
-      int cp_count = min(NGROUPS_PER_BLOCK, count);
-      int off = i * NGROUPS_PER_BLOCK;
-      int len = cp_count * sizeof(*grouplist);
+      unsigned int cp_count = min(NGROUPS_PER_BLOCK, count);
+      unsigned int len = cp_count * sizeof(*grouplist);
 
-      if (copy_from_user(group_info->blocks[i], grouplist+off, len))
+      if (copy_from_user(group_info->blocks[i], grouplist, len))
          return -EFAULT;
 
+      grouplist += NGROUPS_PER_BLOCK;
       count -= cp_count;
    }
    return 0;
@@ -1472,7 +1457,7 @@ asmlinkage long sys_setrlimit(unsigned int resource, struct rlimit __user *rlim)
    if ((new_rlim.rlim_max > old_rlim->rlim_max) &&
        !capable(CAP_SYS_RESOURCE))
       return -EPERM;
-   if (resource == RLIMIT_NOFILE && new_rlim.rlim_max > NR_OPEN)
+   if (resource == RLIMIT_NOFILE && new_rlim.rlim_max > sysctl_nr_open)
       return -EPERM;
 
    retval = security_task_setrlimit(resource, &new_rlim);
@@ -1637,7 +1622,7 @@ asmlinkage long sys_umask(int mask)
    mask = xchg(¤t->fs->umask, mask & S_IRWXUGO);
    return mask;
 }
-    
+
 asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
            unsigned long arg4, unsigned long arg5)
 {
@@ -1742,6 +1727,17 @@ asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
          error = prctl_set_seccomp(arg2);
          break;
 
+      case PR_CAPBSET_READ:
+         if (!cap_valid(arg2))
+            return -EINVAL;
+         return !!cap_raised(current->cap_bset, arg2);
+      case PR_CAPBSET_DROP:
+#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
+         return cap_prctl_drop(arg2);
+#else
+         return -EINVAL;
+#endif
+
       default:
          error = -EINVAL;
          break;