--- trunk/1.5.x/ccs-patch/README.ccs	2007/12/05 05:29:11	776
+++ trunk/1.5.x/ccs-patch/README.ccs	2008/01/15 01:30:33	893
@@ -769,7 +769,7 @@
 
     @ Allow reuse of memory allocated for domain policy.
 
-      As with domain policy, unlike other policies, didn't have
+      Regarding domain policy, unlike other policies, didn't have
       "is_deleted" flag and new memory were allocated
       if the deleted entries are given again.
       But to allow administrators switch domain policy periodically,
@@ -1087,3 +1087,51 @@
     @ Add missing semaphore in GetEXE().
 
       mm->mmap_sem was missing.
+
+Fix 2007/12/17
+
+    @ Remove unused EXPORT_SYMBOL().
+
+      Mark some functions static.
+
+Fix 2007/12/18
+
+    @ Fix AddMountACL() rejection bug.
+
+      To my surprise, "mount --bind source dest" accepts
+      not only "both source and dest are directory"
+      but also "both source and dest are non-directory".
+      I was rejecting if dest is not a derectory in AddMountACL().
+
+    @ Change log format.
+
+      Profile number and mode is added in audit logs.
+
+Fix 2008/01/03
+
+    @ Change directive for file's read/write/execute permission.
+
+      Directives for file's read/write/execute permissions were
+      4/2/1 respectively. But for easier understanding, they are now
+      replaced by read/write/execute (e.g. "allow_read" instead of "4").
+      But for easier inputting, 4/2/1 are still accepted instead of
+      allow_read/allow_write/allow_execute respectively.
+
+    @ Change internal data structure.
+
+      Since I don't have more than 16 types of file permissions,
+      I combined them using bit-fields.
+
+      Each entry had a field for conditional permission support.
+      But since this field is unlikely used, I separated the field from
+      common part.
+
+      These changes will reduce memory used by policy.
+
+Fix 2008/01/15
+
+    @ Add ptrace() hook.
+
+      To prevent attackers from controlling important processes using
+      ptrace(), I added a hook for ptrace().
+      Most programs (except strace(1) and gdb(1)) won't use ptrace(2).