I noticed a new set of patches were out, so I gave it usual bashing.
Maybe this will be useful to someone else:
1) as before fp-state does not apply.
2) os-main gave me a reject on arch/um/kernel/main.c
fixed by simply removing the file.

Built ok (no tweaks needed this time!).
Runs ok, but it is still loosing memory fast.

Then I tried adding some more experimental features...
Attached is a stacktrace I encountered (pcap related):
Seems like the pcap patch is causing some problems when running in a
chroot which does not have the libraries required by pcap (nss?)
Some processes were still running when I got back to the shell.
Btw, how do I figure out which libs I need to copy to the chroot?

But apart from that slight problem, when running outside the chroot it
works exactly as expected. I vote for including it in the next release
with appropriate warnings about runtime libraries issues.
Now, if someone could have a look at hppfs I could resurect my
honeypots.

Also, is anyone interested in some SELinux policies for UML? They need a
little bit of tidying up but seem to work. See below (I extracted the
generic part - unfortunately some parts are specific to my setup).

Antoine

type um_t, domain, privowner;
type um_kernel_t, domain, privowner;

type um_admin_t, file_type, sysadmfile;
type um_exec_t, file_type, exec_type;
type um_kernel_exec_t, file_type, sysadmfile, exec_type;
type um_home_t, file_type;
type um_fs_t, file_type;
type um_tmp_t, file_type, tmpfile;
type um_proc_t, file_type;
type um_tundev_t, device_type, dev_fs;


file_type_auto_trans(um_t, tmp_t, um_tmp_t)
file_type_auto_trans(um_kernel_t, tmp_t, um_tmp_t)

domain_auto_trans(initrc_t, um_exec_t, um_t)
domain_auto_trans(sysadm_t, um_exec_t, um_t)
domain_auto_trans(um_t, um_kernel_exec_t, um_kernel_t)


# network
allow um_kernel_t netif_t:netif { tcp_recv tcp_send };
allow um_kernel_t node_t:node { tcp_recv tcp_send };
allow um_kernel_t port_t:socket { recv_msg send_msg };
# sockets
allow um_kernel_t self:packet_socket create;
allow um_kernel_t self:unix_dgram_socket { bind create ioctl };
allow um_kernel_t self:unix_stream_socket { create ioctl read write };
# process
allow um_kernel_t self:process { execmem fork ptrace sigchld sigkill signal sigstop };
# devices
allow um_kernel_t device_t:dir search;
allow um_kernel_t null_device_t:chr_file { ioctl read write };
allow um_kernel_t um_tundev_t:chr_file { ioctl read write };
allow um_kernel_t random_device_t:chr_file read;
# files
allow um_kernel_t um_tmp_t:file execute;
allow um_kernel_t um_fs_t:file { getattr lock read write };
allow um_kernel_t um_fs_t:lnk_file read;
# proc
allow um_kernel_t um_proc_t:file read;
allow um_kernel_t um_proc_t:dir search;
# home
allow um_kernel_t um_home_t:dir { add_name create getattr read remove_name rmdir write search};
allow um_kernel_t um_home_t:file { create getattr lock read unlink write };
allow um_kernel_t um_home_t:sock_file { create unlink };
# all other dirs:
allow um_kernel_t um_admin_t:dir search;