diff -urNpd a/linux-3.10.18-vs2.3.6.6/drivers/net/tun.c b/linux-3.10.18-vs2.3.6.6/drivers/net/tun.c --- a/linux-3.10.18-vs2.3.6.6/drivers/net/tun.c 2013-11-04 22:44:18.000000000 -0600 +++ b/linux-3.10.18-vs2.3.6.6/drivers/net/tun.c 2013-11-04 22:32:24.000000000 -0600 @@ -1641,7 +1641,7 @@ static int tun_set_iff(struct net *net, int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ? MAX_TAP_QUEUES : 1; - if (!vx_ns_capable(net->user_ns, CAP_NET_ADMIN, NXC_TUN_CREATE)) + if (!nx_ns_capable(net->user_ns, CAP_NET_ADMIN, NXC_TUN_CREATE)) return -EPERM; err = security_tun_dev_create(); if (err < 0) diff -urNpd a/linux-3.10.18-vs2.3.6.6/fs/namespace.c b/linux-3.10.18-vs2.3.6.6/fs/namespace.c --- a/linux-3.10.18-vs2.3.6.6/fs/namespace.c 2013-11-04 22:44:28.000000000 -0600 +++ b/linux-3.10.18-vs2.3.6.6/fs/namespace.c 2013-11-04 22:32:42.000000000 -0600 @@ -1301,7 +1301,8 @@ static int do_umount(struct mount *mnt, */ static inline bool may_mount(void) { - return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN); + return vx_ns_capable(current->nsproxy->mnt_ns->user_ns, + CAP_SYS_ADMIN, VXC_SECURE_MOUNT); } /* diff -urNpd a/linux-3.10.18-vs2.3.6.6/fs/proc/root.c b/linux-3.10.18-vs2.3.6.6/fs/proc/root.c --- a/linux-3.10.18-vs2.3.6.6/fs/proc/root.c 2013-11-04 22:44:31.000000000 -0600 +++ b/linux-3.10.18-vs2.3.6.6/fs/proc/root.c 2013-11-04 22:32:45.000000000 -0600 @@ -116,7 +116,8 @@ static struct dentry *proc_mount(struct options = data; if (!current_user_ns()->may_mount_proc || - !ns_capable(ns->user_ns, CAP_SYS_ADMIN)) + !vx_ns_capable(ns->user_ns, + CAP_SYS_ADMIN, VXC_SECURE_MOUNT)) return ERR_PTR(-EPERM); } diff -urNpd a/linux-3.10.18-vs2.3.6.6/include/linux/vserver/base.h b/linux-3.10.18-vs2.3.6.6/include/linux/vserver/base.h --- a/linux-3.10.18-vs2.3.6.6/include/linux/vserver/base.h 2013-11-04 22:44:18.000000000 -0600 +++ b/linux-3.10.18-vs2.3.6.6/include/linux/vserver/base.h 2013-11-04 22:32:24.000000000 -0600 @@ -143,6 +143,9 @@ enum { #define nx_capable(b, c) (capable(b) || \ (cap_raised(current_cap(), b) && nx_ncaps(c))) +#define nx_ns_capable(n, b, c) (ns_capable(n, b) || \ + (cap_raised(current_cap(), b) && nx_ncaps(c))) + #define vx_task_initpid(t, n) \ ((t)->vx_info && \ ((t)->vx_info->vx_initpid == (n))) diff -urNpd a/linux-3.10.18-vs2.3.6.6/include/uapi/vserver/context.h b/linux-3.10.18-vs2.3.6.6/include/uapi/vserver/context.h --- a/linux-3.10.18-vs2.3.6.6/include/uapi/vserver/context.h 2013-11-04 22:44:28.000000000 -0600 +++ b/linux-3.10.18-vs2.3.6.6/include/uapi/vserver/context.h 2013-11-04 22:32:42.000000000 -0600 @@ -66,8 +66,8 @@ #define VXC_OOM_ADJUST 0x00002000 #define VXC_AUDIT_CONTROL 0x00004000 -/* #define VXC_SECURE_MOUNT 0x00010000 -#define VXC_SECURE_REMOUNT 0x00020000 */ +#define VXC_SECURE_MOUNT 0x00010000 +/* #define VXC_SECURE_REMOUNT 0x00020000 */ #define VXC_BINARY_MOUNT 0x00040000 #define VXC_DEV_MOUNT 0x00080000 diff -urNpd a/linux-3.10.18-vs2.3.6.6/ipc/shm.c b/linux-3.10.18-vs2.3.6.6/ipc/shm.c --- a/linux-3.10.18-vs2.3.6.6/ipc/shm.c 2013-11-04 22:44:24.000000000 -0600 +++ b/linux-3.10.18-vs2.3.6.6/ipc/shm.c 2013-11-04 22:32:35.000000000 -0600 @@ -576,7 +576,7 @@ static int newseg(struct ipc_namespace * ns->shm_tot += numpages; error = shp->shm_perm.id; - shm_unlock(shp); + ipc_unlock_object(&shp->shm_perm); rcu_read_unlock(); vx_ipcshm_add(current_vx_info(), key, numpages);