--- trunk/1.6.x/ccs-patch/README.ccs	2008/12/24 07:07:28	2003
+++ trunk/1.7.x/ccs-patch/README.ccs	2009/09/01 03:33:37	2974
@@ -1753,7 +1753,7 @@
       new conditions for checking file's type and permissions.
       For example,
 
-        allow_read /etc/fstab if path1.type=regular path1.perm=0644
+        allow_read /etc/fstab if path1.type=file path1.perm=0644
 
       will allow opening /etc/fstab for reading only if /etc/fstab is a regular
       file and it's permission is 0644, and
@@ -1796,3 +1796,194 @@
 
       I meant to print SYAORAN-ERROR: message when error == -EPERM,
       but I was printing it when error == 0 since 1.6.0 .
+
+Fix 2009/01/05
+
+    @ Use kmap_atomic()/kunmap_atomic() for reading "struct linux_binprm".
+
+      As remove_arg_zero() uses kmap_atomic(KM_USER0), I modified to use
+      kmap_atomic(KM_USER0) rather than kmap().
+
+Fix 2009/01/28
+
+    @ Fix "allow_read" + "allow_write" != "allow_read/write" problem.
+
+      Since 1.6.0 , due to a bug in ccs_update_single_path_acl(),
+      appending "allow_read/write" entry didn't update internal "allow_read"
+      and "allow_write" entries. As a result, attempt to open(O_RDWR) succeeds
+      but open(O_RDONLY) and open(O_WRONLY) fail.
+
+      Workaround is to write an entry twice when newly appending that entry.
+      If written twice, internal "allow_read" and "allow_write" entries
+      are updated.
+
+Fix 2009/02/26
+
+    @ Fix profile read error.
+
+      Incorrect profiles were shown in /proc/ccs/profile
+      if either CONFIG_SAKURA or CONFIG_TOMOYO is disabled.
+
+Fix 2009/03/02
+
+    @ Undelete CONFIG_TOMOYO_AUDIT option.
+
+      While HDD-less systems can use profiles with MAX_GRANT_LOG=0 and
+      MAX_REJECT_LOG=0 , I undeleted CONFIG_TOMOYO_AUDIT option for saving
+      memory used for /proc/ccs/grant_log and /proc/ccs/reject_log interfaces.
+
+Fix 2009/03/13
+
+    @ Show only profile entry names ever specified.
+
+      Even if an administrator specifies only COMMENT= and MAC_FOR_FILE=
+      entries for /proc/ccs/profile , all available profile entries are shown.
+      This was designed to help administrators to know what entries are
+      available, but sometimes makes administrators feel noisy because of
+      entries showing default values.
+
+      Thus, I modified to show only profile entry names ever specified.
+
+Fix 2009/03/18
+
+    @ Add MAC_FOR_IOCTL functionality.
+
+      To be able to restrict ioctl() requests, I added MAC_FOR_IOCTL
+      functionality.
+
+      This functionality requires modification of ccs-patch-\*.diff .
+
+    @ Use better name for socket's pathname.
+
+      Until now, socket's pathname was represented as "socket:[\$]" format
+      where \$ is inode's number. But inode's number is useless for name based
+      access control. Therefore, I modified to represent socket's pathname as
+      "socket:[family=\$:type=\$:protocol=\$]" format.
+
+      This will help administrator to control ioctl() against sockets more
+      precisely.
+
+    @ Fix misplaced ccs_capable() call.  (only 2.6.8-\* and 2.6.9-\*)
+
+      Location to insert ccs_capable(TOMOYO_SYS_IOCTL) in sys_ioctl() was
+      wrong since version 1.1 .
+
+    @ Insert ccs_check_ioctl_permission() call.
+
+      To make MAC_FOR_IOCTL functionality working, I inserted
+      ccs_check_ioctl_permission() call into ccs-patch-\*.diff .
+
+Fix 2009/03/23
+
+    @ Move sysctl()'s check from ccs-patch-\*.diff to fs/tomoyo_file.c .
+
+      Since try_parse_table() in kernel/sysctl.c is almost identical between
+      all versions, I moved that function to fs/tomoyo_file.c .
+
+    @ Relocate definitions and functions.
+
+      To reduce exposed symbols, I relocated some definitions and functions.
+
+Fix 2009/03/24
+
+    @ Add CONFIG_TOMOYO_BUILTIN_INITIALIZERS option.
+
+      Some systems don't have /sbin/modprobe and /sbin/hotplug .
+      Thus, I made these pathnames configurable.
+
+Version 1.6.7 2009/04/01   Feature enhancement release.
+
+Fix 2009/04/06
+
+    @ Drop "undelete domain" command.
+
+      I added "undelete domain" command on 2007/01/19, but never used by policy
+      management tools. The garbage collector I added on 2007/01/29 will
+      automatically reuse memory and allow administrators switch domain policy
+      periodically, provided that the administrator kills processes in old
+      domains before recreating new domains with the same domainnames.
+
+      Thus, I dropped "undelete domain" command.
+
+    @ Escape invalid characters in ccs_check_mount_permission2().
+
+      ccs_check_mount_permission2() was passing unencoded strings to printk()
+      and ccs_update_mount_acl() and ccs_check_supervisor(). This may cause
+      /proc/ccs/system_policy and /proc/ccs/query to contain invalid
+      characters within a string.
+
+Fix 2009/04/07
+
+    @ Fix IPv4's "address_group" handling error.
+
+      Since 1.6.5 , due to lack of ntohl() (byte order conversion) in
+      ccs_update_address_group_entry(), "address_group" with IPv4 address was
+      not working.
+
+      This problem happens on little endian platforms (e.g. x86).
+
+Fix 2009/05/08
+
+    @ Add condition for symlink's target pathname.
+
+      Until now, "allow_symlink" keyword allows creation of a symlink but does
+      not check the symlink's target. Usually it is no problem because
+      permission checks are done using dereferenced pathname. But in some
+      cases, we should restrict the symlink's target. For example,
+      "ln -s .htpasswd /var/www/html/readme.html" by CGI program should be
+      blocked because we will allow Apache to read both
+      /var/www/html/readme.html and /var/www/html/.htpasswd .
+
+      Thus, I added new condition, "symlink.target".
+
+        allow_symlink /var/www/html/\*.html if symlink.target="\*.html"
+
+        allow_symlink /var/www/html/\*\-.\* if symlink.target="\*\-.\*"
+
+    @ Don't return -EAGAIN at ccs_socket_recvmsg_permission().
+
+      It turned out that it is not permitted for accept() and recvmsg() to
+      return -EAGAIN if poll() said connections/datagrams are ready. However,
+      recvmsg() may return -EAGAIN and potentially confuse some applications
+      because ccs_socket_recvmsg_permission() is returning -EAGAIN.
+
+      Thus, I modified ccs_socket_recvmsg_permission() to return -ENOMEM
+      rather than -EAGAIN.
+
+Fix 2009/05/19
+
+    @ Don't call get_fs_type() with a mutex held.
+
+      Until now, when ccs_update_mount_acl() is called with unsupported
+      filesystem, /sbin/modprobe is executed from get_fs_type() to load
+      filesystem module. And get_fs_type() does not return until /sbin/modprobe
+      finishes.
+
+      This means that it will cause deadlock if /sbin/modprobe (which is
+      executed via get_fs_type() in ccs_update_mount_acl()) calls
+      ccs_update_mount_acl(); although it won't happen unless an administrator
+      inserts execute_handler to call mount() requests in learning mode or to
+      add "allow_mount" entries to /proc/ccs/system_policy .
+
+      I modified to unlock the mutex before calling get_fs_type().
+
+Fix 2009/05/20
+
+    @ Update recvmsg() hooks.
+
+      Since 1.5.0, I was doing network access control for incoming UDP and RAW
+      packets inside skb_recv_datagram(). But to synchronize with LSM version,
+      I moved ccs_recv_datagram_permission() hook from skb_recv_datagram() to
+      udp_recvmsg()/udpv6_recvmsg()/raw_recvmsg()/rawv6_recvmsg() with name
+      change to ccs_recvmsg_permission().
+
+Version 1.6.8 2009/05/28   Feature enhancement release.
+
+Fix 2009/07/03
+
+    @ Fix buffer overrun when used with CONFIG_SLOB=y .
+
+      Since 1.6.7 , ccs_allocate_execve_entry() was requesting for only 4000
+      bytes while the comment says it is 4096 bytes. This may lead to buffer
+      overrun when slob allocator is used, for slob allocator allocates exactly
+      4000 bytes whereas slab and slub allocators allocate 4096 bytes.