diff -uNr 4-1-ac8/include/linux/shm.h c1/include/linux/shm.h
--- 4-1-ac8/include/linux/shm.h	Mon Jun  5 11:20:23 2000
+++ c1/include/linux/shm.h	Tue Jun  6 10:41:23 2000
@@ -2,7 +2,7 @@
 #define _LINUX_SHM_H_
 
 #include <linux/ipc.h>
-#include <linux/mm.h>
+#include <asm/page.h>
 
 /*
  * SHMMAX, SHMMNI and SHMALL are upper limits are defaults which can
diff -uNr 4-1-ac8/ipc/shm.c c1/ipc/shm.c
--- 4-1-ac8/ipc/shm.c	Mon Jun  5 11:12:29 2000
+++ c1/ipc/shm.c	Mon Jun  5 19:39:14 2000
@@ -1198,6 +1198,7 @@
  */
 asmlinkage long sys_shmat (int shmid, char *shmaddr, int shmflg, ulong *raddr)
 {
+	struct shmid_kernel *shp;
 	unsigned long addr;
 	struct file * file;
 	int    err;
@@ -1225,13 +1226,25 @@
 	if (shmflg & SHM_RDONLY) {
 		prot = PROT_READ;
 		o_flags = O_RDONLY;
-		acc_mode = MAY_READ;
+		acc_mode = S_IRUGO;
 	} else {
 		prot = PROT_READ | PROT_WRITE;
 		o_flags = O_RDWR;
-		acc_mode = MAY_READ | MAY_WRITE;
+		acc_mode = S_IRUGO | S_IWUGO;
 	}
 
+	/*
+	 * We cannot rely on the fs check since SYSV IPC does have an
+	 * aditional creator id...
+	 */
+	shp = shm_lock(shmid);
+	if(shp==NULL)
+		return -EINVAL;
+	err = ipcperms(&shp->shm_perm, acc_mode);
+	shm_unlock(shmid);
+	if (err)
+		return -EACCES;
+
 	sprintf (name, SHM_FMT, shmid);
 
 	lock_kernel();
@@ -1244,9 +1257,6 @@
 	err = -ENOENT;
 	if (!dentry->d_inode)
 		goto bad_file;
-	err = permission(dentry->d_inode, acc_mode);
-	if (err)
-		goto bad_file1;
 	file = dentry_open(dentry, shm_fs_type.kern_mnt, o_flags);
 	err = PTR_ERR(file);
 	if (IS_ERR (file))