GitLab

fixes #2539

ref #2302

Allow containers modify their /proc/sys/net without needing sys_admin
This is so they can enable ip_forward for their namespace

Atleast those was enabled as modules:
AMD frequency sensitivity feedback powersave bias (X86_AMD_FREQ_SENSITIVITY)
ME Enabled Intel Chipsets (INTEL_MEI_ME)
Block device as cache (BCACHE)
Random mode support (NET_TEAM_MODE_RANDOM)
Qualcomm Atheros AR816x/AR817x support (ALX)
Realtek RTL8152 Based USB 2.0 Ethernet Adapters (USB_RTL8152)
rt2800usb - Include support for rt55xx devices (EXPERIMENTAL) (RT2800USB_RT55XX)
Realtek RTL8188EE Wireless Network Adapter (RTL8188EE)
Analog Devices ADT7310/ADT7320 (SENSORS_ADT7310)
National Semiconductor LM95234 (SENSORS_LM95234)
Nuvoton NCT6775F and compatibles (SENSORS_NCT6775)
QXL virtual GPU (DRM_QXL)
Microsoft Hyper-V Synthetic Video support (FB_HYPERV)
ILI Technology ILI9221/ILI9222 support (LCD_ILI922X)
LED Support for TI LP5562 LED driver chip (LEDS_LP5562)
LED Camera Flash/Torch Trigger (LEDS_TRIGGER_CAMERA)
iSCSI Extentions for RDMA (iSER) target support (INFINIBAND_ISERT)
pvpanic device support (PVPANIC)
CMAC support (CRYPTO_CMAC)
VHOST_SCSI TCM fabric driver (VHOST_SCSI)

we also remove the requirement for CAP_SYS_ADMIN for /proc/sys so we
can set ip_forward in a lxcontainer

Got the following build error (musl libc):

arch/x86/boot/header.S:425: Error: can't resolve `VO__end' {*UND* section}
  - `VO__text' {*UND* section}

Internet says this is fixed by using GNU sed, and so it was.

This brings the kernel up to 3.10.4/3.4.55 level

ref #2139 (CVE-2013-4125)
ref #2144 (CVE-2013-4127)