diff -NurpP --minimal linux-2.4.26-vs1.27/Makefile linux-2.4.26-vs1.28/Makefile
--- linux-2.4.26-vs1.27/Makefile	2004-04-14 17:02:44.000000000 +0200
+++ linux-2.4.26-vs1.28/Makefile	2004-07-03 23:10:08.000000000 +0200
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 4
 SUBLEVEL = 26
-EXTRAVERSION = -vs1.27
+EXTRAVERSION = -vs1.28
 
 KERNELRELEASE=$(VERSION).$(PATCHLEVEL).$(SUBLEVEL)$(EXTRAVERSION)
 
diff -NurpP --minimal linux-2.4.26-vs1.27/fs/attr.c linux-2.4.26-vs1.28/fs/attr.c
--- linux-2.4.26-vs1.27/fs/attr.c	2002-02-25 20:38:07.000000000 +0100
+++ linux-2.4.26-vs1.28/fs/attr.c	2004-07-03 23:10:08.000000000 +0200
@@ -12,6 +12,8 @@
 #include <linux/dnotify.h>
 #include <linux/fcntl.h>
 #include <linux/quotaops.h>
+#include <linux/proc_fs.h>
+#include <linux/vcontext.h>
 
 /* Taken over from the old code... */
 
@@ -52,6 +54,24 @@ int inode_change_ok(struct inode *inode,
 		if (current->fsuid != inode->i_uid && !capable(CAP_FOWNER))
 			goto error;
 	}
+
+	/* Check evil vserver activity */
+	if (!vx_check(0, VX_ADMIN)) {
+		if ((inode->i_mode & 0777) == 0 && S_ISDIR(inode->i_mode)
+			&& IS_IMMUTABLE_LINK(inode)) {
+			printk(KERN_WARNING
+				"VSW: xid=%d messing with the barrier.",
+				current->vx_id);
+			goto error;
+		}
+		if (inode->i_sb->s_magic == PROC_SUPER_MAGIC) {
+			printk(KERN_WARNING
+				"VSW: xid=%d messing with the procfs.",
+				current->vx_id);
+			goto error;
+		}
+	}
+
 fine:
 	retval = 0;
 error:
diff -NurpP --minimal linux-2.4.26-vs1.27/fs/ext2/ioctl.c linux-2.4.26-vs1.28/fs/ext2/ioctl.c
--- linux-2.4.26-vs1.27/fs/ext2/ioctl.c	2004-04-14 17:02:47.000000000 +0200
+++ linux-2.4.26-vs1.28/fs/ext2/ioctl.c	2004-07-03 23:10:09.000000000 +0200
@@ -44,7 +44,9 @@ int ext2_ioctl (struct inode * inode, st
 		 *
 		 * This test looks nicer. Thanks to Pauline Middelink
 		 */
-		if ((flags ^ oldflags) & (EXT2_APPEND_FL | EXT2_IMMUTABLE_FILE_FL | EXT2_IMMUTABLE_LINK_FL)) {
+		if ((oldflags & EXT2_IMMUTABLE_FILE_FL) ||
+			((flags ^ oldflags) & (EXT2_APPEND_FL |
+			EXT2_IMMUTABLE_FILE_FL | EXT2_IMMUTABLE_LINK_FL))) {
 			if (!capable(CAP_LINUX_IMMUTABLE))
 				return -EPERM;
 		}
diff -NurpP --minimal linux-2.4.26-vs1.27/fs/ext3/ioctl.c linux-2.4.26-vs1.28/fs/ext3/ioctl.c
--- linux-2.4.26-vs1.27/fs/ext3/ioctl.c	2004-04-14 17:02:47.000000000 +0200
+++ linux-2.4.26-vs1.28/fs/ext3/ioctl.c	2004-07-03 23:10:09.000000000 +0200
@@ -53,7 +53,9 @@ int ext3_ioctl (struct inode * inode, st
 		 *
 		 * This test looks nicer. Thanks to Pauline Middelink
 		 */
-		if ((flags ^ oldflags) & (EXT3_APPEND_FL | EXT3_IMMUTABLE_FILE_FL | EXT3_IMMUTABLE_LINK_FL)) {
+		if ((oldflags & EXT3_IMMUTABLE_FILE_FL) ||
+			((flags ^ oldflags) & (EXT3_APPEND_FL |
+			EXT3_IMMUTABLE_FILE_FL | EXT3_IMMUTABLE_LINK_FL))) {
 			if (!capable(CAP_LINUX_IMMUTABLE))
 				return -EPERM;
 		}
diff -NurpP --minimal linux-2.4.26-vs1.27/fs/open.c linux-2.4.26-vs1.28/fs/open.c
--- linux-2.4.26-vs1.27/fs/open.c	2004-04-14 17:02:47.000000000 +0200
+++ linux-2.4.26-vs1.28/fs/open.c	2004-07-03 23:10:09.000000000 +0200
@@ -489,10 +489,6 @@ asmlinkage long sys_fchmod(unsigned int 
 	dentry = file->f_dentry;
 	inode = dentry->d_inode;
 
-	err = -EPERM;
-        if ((inode->i_mode & 0777) == 0 && S_ISDIR(inode->i_mode)
-                && IS_IMMUTABLE_LINK(inode) && !vx_check(0, VX_ADMIN))
-		goto out_putf;	
 	err = -EROFS;
 	if (IS_RDONLY(inode))
 		goto out_putf;
@@ -523,11 +519,6 @@ asmlinkage long sys_chmod(const char * f
 		goto out;
 	inode = nd.dentry->d_inode;
 
-	error = -EPERM;
-        if ((inode->i_mode & 0777) == 0 && S_ISDIR(inode->i_mode)
-                && IS_IMMUTABLE_LINK(inode) && !vx_check(0, VX_ADMIN))
-		goto dput_and_out;	
-
 	error = -EROFS;
 	if (IS_RDONLY(inode))
 		goto dput_and_out;
diff -NurpP --minimal linux-2.4.26-vs1.27/fs/reiserfs/ioctl.c linux-2.4.26-vs1.28/fs/reiserfs/ioctl.c
--- linux-2.4.26-vs1.27/fs/reiserfs/ioctl.c	2004-04-14 17:02:47.000000000 +0200
+++ linux-2.4.26-vs1.28/fs/reiserfs/ioctl.c	2004-07-03 23:10:09.000000000 +0200
@@ -51,9 +51,11 @@ int reiserfs_ioctl (struct inode * inode
 		if (get_user(flags, (int *) arg))
 			return -EFAULT;
 
-		if ( ( ( flags ^ inode->u.reiserfs_i.i_attrs) &
-		     ( REISERFS_IMMUTABLE_FILE_FL | REISERFS_IMMUTABLE_LINK_FL | REISERFS_APPEND_FL )) &&
-		     !capable( CAP_LINUX_IMMUTABLE ) )
+		if ( (inode->u.reiserfs_i.i_attrs & REISERFS_IMMUTABLE_FILE_FL) ||
+		     ( ( ( flags ^ inode->u.reiserfs_i.i_attrs) &
+		     ( REISERFS_IMMUTABLE_FILE_FL |
+		       REISERFS_IMMUTABLE_LINK_FL | REISERFS_APPEND_FL ) ) &&
+		     !capable( CAP_LINUX_IMMUTABLE ) ) )
 			return -EPERM;
 			
 		if( ( flags & REISERFS_NOTAIL_FL ) &&
