From patchwork Thu Dec 1 15:07:41 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Smalley X-Patchwork-Id: 9456343 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5BED560585 for ; Thu, 1 Dec 2016 15:06:10 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4C65028458 for ; Thu, 1 Dec 2016 15:06:10 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4045F284EC; Thu, 1 Dec 2016 15:06:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from emsm-gh1-uea10.nsa.gov (emsm-gh1-uea10.nsa.gov [8.44.101.8]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 9672028458 for ; Thu, 1 Dec 2016 15:06:04 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.33,282,1477958400"; d="scan'208";a="1484978" IronPort-PHdr: =?us-ascii?q?9a23=3A5jf2ZhO+SoEjIeeN5Psl6mtUPXoX/o7sNwtQ0KIM?= =?us-ascii?q?zox0LP/6o8bcNUDSrc9gkEXOFd2CrakV0KyK6uu7ByQp2tWoiDg6aptCVhsI24?= =?us-ascii?q?09vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6nK94iQPFRrhKAF7?= =?us-ascii?q?Ovr6GpLIj8Swyuu+54Dfbx9GiTe5b75+Nhq7oRjeusQYgIZpN7o8xAbOrnZUYe?= =?us-ascii?q?pd2HlmJUiUnxby58ew+IBs/iFNsP8/9MBOTLv3cb0gQbNXEDopPWY15Nb2tRbY?= =?us-ascii?q?VguA+mEcUmQNnRVWBQXO8Qz3UY3wsiv+sep9xTWaMMjrRr06RTiu86FmQwLmhy?= =?us-ascii?q?cdMz4y7X/ZhMp+gqlGpB6tvgJzz5LRbIyTKfFwfL7SfckCSGRBQMhfSiJPDIC7?= =?us-ascii?q?YYsXDecNIOhVoIbhqFUBsxS+HhKhBP/txzJSmnP7x7E23/onHArb3AIgBdUOsH?= =?us-ascii?q?HModvoKKcdT/i1zKnWwjXFcvhYxDL955LMchAlv/6NXa97fM3KyUYyDAPIlUmQ?= =?us-ascii?q?qIz5MDOV0eQBqW6b7/F6Wu61hG4nrB9xryGpy8wxiYfJnpoYxk3L+Ch22oo4Jc?= =?us-ascii?q?C0RFRlbdOrDpdcrTyWOo1rSc04WW5oojw1yrgetJ6+eygF1YooygbEa/yCb4iI?= =?us-ascii?q?+hXjVPuNITtghHJqZra/hxGq/Ei80OL8TMi00EtRriZfjtnNtmwC1xzU6sSdTP?= =?us-ascii?q?ty4lyh1iqV2wDW6+FEJVg4lavdK5E/3r49jocfvEvMEyPsmEj6kbWaelsr9+S2?= =?us-ascii?q?8ejrf63qppqGOI91jgH+PL4umsu6AekgKQgBQWyb+eW61L3+8kz1Wa5Fjvorkq?= =?us-ascii?q?nfrJ/VO98bq7WlAw5Vzokj6xG/Ay2g0NQDh3YLNl1FeBWZj4TxIVHBPOj4Deuj?= =?us-ascii?q?g1SriDpryerGMafnAprRL3jDi6zsfbNl605d0QYz1t5e54lOBrEGOvLzVVf7tM?= =?us-ascii?q?bEAR8hLwy03+HnBc1+1owEWmKPBbKZPbjRsVCS5eIvJPSMaJUSuDbnJPgv/+Tu?= =?us-ascii?q?gmMhmV8BYamp2oMaZ2qlEfR8IkWWf2Dsj8wbHmgWuwoyVuvqiEeNUTRLfXa9Q7?= =?us-ascii?q?o85i0nCIKhFYrDRp6igLiF3Ce8BZBWYn1GCkyLEXftbYqIQfAMaDidIsV5iDwL?= =?us-ascii?q?SaChS5M91RGprAL60LRnLvDT+i0DqZLuz8N15+vUlRA88Dx7FcKd33uLT25qgm?= =?us-ascii?q?MCXyU207xnoUxh1leD1rB1gvJCGtxX+/NGTB06NYXHwuxkFd/yQBnOfsqMSFq8?= =?us-ascii?q?RdWmGz4xRMorw9ASe0Z9B8mijhfb0iq2HrAair2LC4Yw8q/Hw3fxIMN9xGrc26?= =?us-ascii?q?k6k1kqWM1POnO6hqRn7QjcG5bJk1mFl6atbakc2i/N9GOHzWWQp0FVSxR/Xrvf?= =?us-ascii?q?XXAYfEfWqs755kzaRb+0FbsnKhdBydKFKqZSd9Lml0lGS+39N9TQbGO8gHu/BR?= =?us-ascii?q?aSybOWcIrlZX8d0D/bCEcajwAZ5WyGOhQmBie9v2LeCyRjFUzuY0zw7el+r2m7?= =?us-ascii?q?QlUowAGKaE1h0bW19wURhfydTfMcxKgEuCA7pzVzBla90MrcC8CcqAp5YKVcfd?= =?us-ascii?q?Q97U9D1WLYrAx9IoWsL7t8iV4acgR3uV7u1hpsB4VbicgqrXUqzAtuJqKDyl9B?= =?us-ascii?q?cS2X3YzoML3NNmby5Ayva7LR2lzGytaW/aMP6PAmpFX5oA6pEUQj/m5809lIz3?= =?us-ascii?q?Sc/Y/GDA0IUZL+Skw37QR1p6nGYikh4IPZzWVsPrOpsj/Gwd4mHvEpxQ2nf9db?= =?us-ascii?q?LKOEEwnyHtYfB8SyLuwqnESmYggCPO9M6K4+J9mmeOee2K63IOZgmyqrjWFD4I?= =?us-ascii?q?xkzE2M8TFxSvDW0JYBx/GXwBGHWy36jFi/rsD9gZpEai0KHmqj1SjkA5ZcZq5s?= =?us-ascii?q?coYNEmejOM63yct4h572XX5X6kKjC0kB2M+zdhqYd0b90hFI1UQLvXynnjO1zy?= =?us-ascii?q?Jykz40taefwirOzPnidBYdPG5EWnVih0/2IYeol9AaQFSobw8xmRu9/0n62qxb?= =?us-ascii?q?qb9jIGnSXUdJfzH6L294Xau2rLaCZNRP6JwwuyVNTOu8eUyaSqL6oxYCyyPsBX?= =?us-ascii?q?ZexDQleDGyoJr5mQB6h3yHLHtosXrZYt9/xQ3E5NDGXv5R2ScGRDNkhjbJCFi8?= =?us-ascii?q?OMOp/dqKmJvZtOCxSX6hXIVJcSb31YOAqDe75WpyDB2xhf+znMHnEQ8/0SLg2d?= =?us-ascii?q?llSzjHrBHmYobxz6S6K+Vnfkt2C1Dg98p2AIZ+kpE/hJsIw3gVmo2V/WYbkWf0?= =?us-ascii?q?Kdhb1qL+Y2YXRT8L297V/A/l1VZlLn2X24L5TWmSzdF5Z9akeG8W3Dwy79xSAq?= =?us-ascii?q?eO8LNEhTd1oka/rQ/JZPhyhDMdyf8w534Gn+EGohAiwz6bAr8MAUlYJjDjmA6Q?= =?us-ascii?q?79+gtqlXYnigcaSo3kpkgd+hFK2Coh1bWHvhYJcuByFx4t96MF3W1H3z7YHldc?= =?us-ascii?q?LKYt0Psx2YiRDAj/JaKJgpjPoFmTJnOX7hvX0i0+M7iwZu0ouivIifMGht8qO5?= =?us-ascii?q?AgRDNj3pacMT+zftgrxYnsmK3oCgBJFhFi8MXJvyQvKiCCgSuuj/NwaSDD08rW?= =?us-ascii?q?+WGaLBEgCE9khmqXPPE4ysN3yMJXkW08ttSweHKExYmgAUUy0wnoQlGQCy2Mzh?= =?us-ascii?q?bEB56ygK6VHjrRdMzuNoNwLjUmfEvguocSk7R4SFIBpN8A5C40bVMcqD7uN8BC?= =?us-ascii?q?xX4p2grBaQKmyAfQhJA3sGWlCfB1DkOLmi/97A8/KXBuCmNfvBfa2OqfBCV/eP?= =?us-ascii?q?3Z+vyZFp/yiWOcWAIHZiFOY22lFZUnBnAcvZlCsASzcNmyLLccGbuA+2+jdroc?= =?us-ascii?q?Cn7PTrRAXv6JOUBLtTPtVv/Ba2jLyeOOGOnyl5KCxX1pUWyX/P0rgf00YYizty?= =?us-ascii?q?eDm1DbQAqSnNQbrKla9YFREbdT18OdBP76IkwAZNP8vbhcn01r58lfE1DFhEWU?= =?us-ascii?q?bmmsGzaswAO3u9O0/fBEaXKLSGIiXGw93wYaO5U7FQluJUthyutjadCEDjJDOD?= =?us-ascii?q?mCfqVx20Le5MiySbMwBEt4GmbhZhE27jQ8z6ahejKt94kSU2waEohnPNLWMcMj?= =?us-ascii?q?h9c0dTobCL6CNYhft/G2Jf4Xp5MemEmyGZ7+zGJZoMt/tkHDh0nfpA4Hsm07tV?= =?us-ascii?q?8D1ERPttlSvTqN5uv0+pku2RxTpiThVOtixLhYKQsEVlIaXW6J9AWXPe8xIM6W?= =?us-ascii?q?WfEBMKptR/Bt3ooaBQxcDFlLjvJzda79LU4cwcCtDSKM2ZKnUhNQHkGD3TDAse?= =?us-ascii?q?UT6kL2ffh1dekPGT7HGVqIY1qoT0kpoUVrBbTEA1Fu8dCkl9BtwNPox3US0+nr?= =?us-ascii?q?6BkMEI5WGzowLQRMVAo5/HUfySAe31KDmHjbhIfR0Izq3kLY4LLI30x1RiakVm?= =?us-ascii?q?nITNA0ffQNdNoitnbgApvkpN9Hl+Q3Yp1E37cAOt52UfFfmunh45kgF+e/gi9C?= =?us-ascii?q?/w41crIVrHvDY/n1MvmdXknD+RayX8I72qXYFMDCr1uVMxPY3nTAZodw2ynFBk?= =?us-ascii?q?NTfeS7JXkbRgaXhhiBXAtptXBf5cUapEbQcNyvGMefony1tcqj+9yk9Z/ubFEo?= =?us-ascii?q?FtlAg3cZ62tX1MwQZjbMMzJaPKPqpF10RQhqWNvi6o0eA92gkeKFgR8GmKYi4H?= =?us-ascii?q?pFQINqU6Jyqv5uFs5xaClCVed2gXTfUqpO5q9kQmO+mb1S3vz7tDJlq2N+yFIK?= =?us-ascii?q?OTo3LAmtKQQlMsykMIkFFI/bxx0cc5bUWUUUEuzLyKGhQGM8rCNBtZb81I9Hjc?= =?us-ascii?q?ZSyOq/nCwYppP4WhEeDlVfSOu7gQgkKlGgYpAosN498dEZmr1UHXMd3oLKUZyR?= =?us-ascii?q?k34gTkOkmFBuxTeB2XiDcHv92/zJhv0IlePDEcAX9yMSOr5rbXvQIqj/2DXM8q?= =?us-ascii?q?bXsAWIsLKG42UtWgmyFFp3RAECW30uUBxQie7j/8oyPQDCX8b9tjf/qbeBJsCd?= =?us-ascii?q?Gs9jok6aS2j0DY8onGLWHgKdtiosPP6f8dp5ufC/NUSqdys0nClIlCXHGqUnDA?= =?us-ascii?q?HsCrKJTqbIksd9P0AG6gUlOjkzI1U9vxPNG1I6eShQHoRJpbv5eD0zAmNc69ED?= =?us-ascii?q?YeGxFqqOwY/618ZBcMY5wibR7mqgQyLaq/LxmE0t+2WWaiNSNWT+VDzeW9f7FY?= =?us-ascii?q?1DQjbumhxXQ6U5460fe48VQWRJ4QlBHfxeyvZ45EUSj8AnZdYRnApTIll2h9Me?= =?us-ascii?q?Y/2ug/wA7JsVkYNzCEaulpZXdZsN4iHlySIG95CmwiS1+bl4rD7Ram36oO8CtF?= =?us-ascii?q?g9ZUzepFvWDkvp/ZYTKjRKyrqZLRsyo7ddYourB/P5b/L8WBr57RgjvfTJzMvQ?= =?us-ascii?q?KfSy66C+BWmt5OLyJEWPNIg30qOdQauYpd7ko8Tt0+KKFSB6Q3qbCqbDVlATQU?= =?us-ascii?q?zSAHS4OKxCYCjfuk27vGiheQd4wvPwAGsJpYntQQSDJ5YiQapK+nVoXZiXWESn?= =?us-ascii?q?QVLwgP7QRA/gUAlpV/fur9+orHUIdMyyJKo/JzSibLDINn90H8Sm6NmlX4VO+h?= =?us-ascii?q?nPa33Q1MyPLs098bWBF7CUhcyOZWllcoKL9tJKkKu47GqDmIel3mvGj10uupOE?= =?us-ascii?q?FRydHId13/FIfEtXDzUjYG9n0RRI9PzmrSFZUOkwVjc6YkuE9DLJqgekng+zwu?= =?us-ascii?q?355pEKWgVcC321Ylqm4LRimwH9VdC+FmsVfXWDx/bJCos5jlOotdTXFO95GHrF?= =?us-ascii?q?dZikptOTajyZVAM8FN/iIMXD9XrDqHptuyVctD1dV1D5IXI9d/unb9GL9fN5SL?= =?us-ascii?q?pX05pKDvwGfD+z8gqFe62CmzG6igQuJW5W0RAAMpJ3iFp0kuCOst/GHS8kzNsl?= =?us-ascii?q?9q/udbAKSPgltroDpnGJBBGCpJ32i/L1tvVHlGr/laKKPNfsxARPkyYASiOwAi?= =?us-ascii?q?Gf4jxEOF50d0kmnlYyZqrAtV5zjdXxUoVSkSmrrtmScRqtu9Nj8eVp1FdiguYD?= =?us-ascii?q?ndKwKDhy9XuAhQa1twV5AeGNZF9KkR3ZFI8craVUasNSYFUQRgNgI/z/VSjlNM?= =?us-ascii?q?v1uDeS/DFwqoaejAvQBtcceXssGpMOzz/B1bhYP/rOA466IDSmW9lg2jXd/Ss4?= =?us-ascii?q?3xusCEu0aVaKj4NOi8bmPbQzjXkRC8n7EkAIfW/yLLKgpUN4F6yWY4YZjmEWPL?= =?us-ascii?q?JwpJKL8bJ0VBSaB3ctFGoudEZ8B6ZqoG5ahtCQ+ZSR/1HoygsuVGJE7JRTvCNy?= =?us-ascii?q?WB7vC/oYXL4LzFUujgetaDyGvbQ69sJZd67iT7G6323oBA/Er2xu1t+Vl+SVTc?= =?us-ascii?q?NCCBttvhLBsR5Ma+bkviooEpHTTODZdsinri2F9PeNcMTi239JQY1IlZ52zuSe?= =?us-ascii?q?J51UjztPNd96V+5Ykw+bBpxt++Jb3OJvRCrU9nHh+UCx13+ZUrGmdyXH1eYukL?= =?us-ascii?q?J/vLeqQZl8/uofjtF6ML8B2V5/BZadzfKkHDgMa/DD+cSQZDnAgctzEXNRec2O?= =?us-ascii?q?SDm69vTsapv+751Vwx41KmNB4J0Kht5ZuY+qqPvOLXbQHezaIDWqjxQsP8tKos?= =?us-ascii?q?tliX5f05kL4OZm11bBGmEOcHUM4d3X3szacwzSIjC8nDBa7v+OZfV3IlmTLtg5?= =?us-ascii?q?Z9H1ENF/MVG7qL+J5SnmY+m+zXLN0ZaLtCmnqVFR65DrAC1WOr6zGJL2V/hRHO?= =?us-ascii?q?yR7wS3up7FDqtS94XTfMz9D7n0pTV7m4GUBSXy6zNk9jqj+PPQ3otN3suaQu90?= =?us-ascii?q?w2N2Pptd2XmGumIrNXENX1JMaALiksuFIXkJoxS8Sz1o8BHdqyPswR8G1+b/vZ?= =?us-ascii?q?8G6riDNOo6ZZiIrY/sGV++/YEWOmj6KEt7WH3CpYxWQgvVEj9tCgMenD59mRQ/?= =?us-ascii?q?St12scVCl/tBXcUB6ysLzUtUgUOVaM0EfJhoMFIs1Z0WM/1kH86+gpWMgz+xlG?= =?us-ascii?q?Fobce/MCoij+OD7wwVmBZtI3UTeR0z9ME1L6D1Z4H7M82Hrqs8LVlHff4VkoRo?= =?us-ascii?q?h2d0z7mxN3C4E4KUMi6FcJxCoMDRYCZQqdDL62GUTvNZEEWlQbaRSbwLi6fb86?= =?us-ascii?q?3U9ywrOq/+LTaPJzBqoTOfZHjw6OmldbFogQsaIAXLJ2Y0Vd+7LPpgj+F4jnWO?= =?us-ascii?q?DrlXsxNPKvWM9V7dsUt2A87QajWRWv9Y1P77EBiJCHbqREe4TDvNhg70d74j4C?= =?us-ascii?q?bjdCgBlkjxK3S+8cpuHj4sTDsJWy9+auUL0gSPkQ9xcpGWtxlYbwgEokodHNze?= =?us-ascii?q?hQUIrViZ7w8ApVOX6FpJ7a0wVgKeoJM4+rZKxv92kbKCgeKXMOOsCWa/ol7y92?= =?us-ascii?q?LjrT411CAsURZdIXJ8fNgRpbilH1V7FT+MvbHUWYC4Rpe8Ar8WX30jY1/oU4Uu?= =?us-ascii?q?r67z+2P5/f5UlXP/xflCVsiM7CpO8NzPrOEigY/32ZZAJzwiyc0JSCFvfw/eqN?= =?us-ascii?q?yNHITVwGBTQ5U51AJDaY/wyoWPa1no3zUgyI8s/znI4+dEWIS3y+hqsFqLhDEf?= =?us-ascii?q?JAiijg2jheF5z1iOyVs9W29WtXrUdLEIBt4h3ZAK9fJIl0OQzklsm3QUhxHiT/?= =?us-ascii?q?d9/Sdhoyv+qWweAA4/5gOEv6ZI8bJA8Eyr3h5HpRUARuUr73sUyDUeIXetRmVO?= =?us-ascii?q?vOrmpJ5oJ4N68PIF+dqYTvrjdPrlA2HAApZ6Erozxfd0nBhgtVVLjouL8OjQsc?= =?us-ascii?q?S915uVRWFWK2Jm0++yLNVb5Jg6mJFPwV7jKTQ7QBU0p0KSN+WAq51ohhdbWvnP?= =?us-ascii?q?BHtH5Gnyxmrfgl1jxpXh28tjP2q6IKwzIg96mytC8dtnxdUuWejyDIBE1BzPQN?= =?us-ascii?q?jaccDWzu5kC8YHkHcYv9/bhmJcXm9Yk64HQ/YA4ufzMHXeS+ES7wi76HAo2VvN?= =?us-ascii?q?JamhGNpN3EbaWvIigKKrQ91RXjSmB80gjAhhlo9nAGQjG97NA5JYW9Pt0lyjCv?= =?us-ascii?q?GWjBe1YG+rlJv9fptV4XUOs2bktswGd93ciJSC0NQNfCGmgvgQgid2pEbIhP6R?= =?us-ascii?q?kEGKk0mjyIpLVJ/hkIYDfIFYSo4obQncPP2XgzU9hqwmbWq7aehpMt1n1lms97?= =?us-ascii?q?4jSIuHsMa+zSS9VsDWTr1odD1ez+YO2gsuIHSIpm0LShV/sCMsi/+WSow5hqX0?= =?us-ascii?q?6lxqgEH1WnKuMDwa3bUyi9Q22CReuLa3SMnyo+MkPq+RmoL1g3ZdxWr088LuTC?= =?us-ascii?q?hYBTlwn7XbNyWCqQuUfRzHY/PuMCawI2pICndhQPTO4QZOicJu8uzeY8CFQWbH?= =?us-ascii?q?/JGi12BPGwsVK3moh0JWlg613gYevx6gDmLMeSGh4cHIHBsJFx/+C6S3maOX9k?= =?us-ascii?q?yx1yIFV09/nBGFssrONcdIyRndfIjdRhzeEFb+ttMTE6utMLgoJj7o2U392QcR?= =?us-ascii?q?DfyZbyId/Vr+OdA/3YyEQqYX9VXaYDYQPy/IU6Jd85W7vcHbdDuhQcH6c6SoQ7?= =?us-ascii?q?N2jt7KF0MB9zcgnJabS6nMbqouOLZoNKqHLN71MwLSLcuxgdxfyuSQx0cYqmh3?= =?us-ascii?q?LoIJA/XjhBtcFiCgN6HItTHMMNtwqnA4KUmKG8jt++4Vh6tvQPsarxFvDKzsq2?= =?us-ascii?q?0592X5hA6kyBJCzRC7VzgkR5kuSyhe/N05fpCcP4eNMLSPZ0T3XAar/HAoW/MC?= =?us-ascii?q?yBNtj7e05c/L6WyKh5XQmJZCDlQ6qGszWpNPJg4Uol0YF4ZO7TwyY277HH2dv9?= =?us-ascii?q?e31bpj29onGXLpdf6kLFBfDGVRJOVfWF6HplHbEQbYbs8OcOMNoiwMWT4gVq6D?= =?us-ascii?q?RC0dCFI7S6rkLX20J0b5TbLEzz1yY+Q4kKLwy1MVEwjm/BtnTdHXNcI9C/KcZz?= =?us-ascii?q?hNaVDxrt51R+mG0qaWBBBmroSsmLOWcFw8KxfhaH9AFVANYZme64Z0o4ubavSe?= =?us-ascii?q?lnIJlFnv+qtLofm9ZzNy7PXNRaPz3XLLJuOjpRD/7PpEQzbx8Fqrg1XJ06aYKI?= =?us-ascii?q?IEwZLEeK0Tnywhfa0U3oa9ys076EICMM/Xpbz7LF0D5Mpw6itPaHg83jVq7WbJ?= =?us-ascii?q?X3XP7ULSokWSuWRTMoEUam4V2koeYLvOKEIWcDpVAZeiCSBxQQpqBottfdFXLT?= =?us-ascii?q?met/fJ0Kg/CaRi/wSC1klKYoACZEq1yMSeIZFQbKd3/hnHZcuAu6K/9D533qdK?= =?us-ascii?q?eYxqtLVOwSGYZMbPmZTMHDefBfOjckjDMZN/igf9fEtbY2zkrITXcFE6nP7FCe?= =?us-ascii?q?TkuWQvuGxzLxXIUVpJM5uiwy9dLVgCB3Er7EP7GFpz6h6oS4ljqXufXCVmkxZE?= =?us-ascii?q?w4mPwNAGuGwBlALmEEENYVuEf2T66PfUZMyWwphvx02xMWfgR8TGFu2GVMnPmh?= =?us-ascii?q?As1ZVUIUjGS2Tf0dYlB3CS8/8E6J7wDpf9wPp9rTR25f97sLT4oRNv8o55fLOK?= =?us-ascii?q?EI2vYmwCpmoDAmsyWaF15djAWF86zUHK9nw71N+3Q3//9xXkGVXzzQbHLLyoy4?= =?us-ascii?q?BMJTlm9SpiX/2s7VuP19HKdLrIF+RlERCGR5Ic6O0ypGVDTPxAaqvxu9VA+bKT?= =?us-ascii?q?Yd7SdDcTcJbc5p3uR7t1DObd+H5kSO4fFy4HC3ABqGX+LnkKdADdvkgEDiMSQ?= =?us-ascii?q?=3D?= X-IPAS-Result: =?us-ascii?q?A2HZBAAhO0BY/wHyM5BdHAEBBAEBCgEBFwEBBAEBCgEBgw0?= =?us-ascii?q?BAQEBAR+BThC7RiWIDlMBAQEBAQEBAQIBAl8ogjMagiMCNxQgCwMDCQIXKQgIA?= =?us-ascii?q?wEtFR8LBRgEiEytYyoCizEljzQRAYJoC4MKBY91immREAKBcIR7gzWGEgKHXYo?= =?us-ascii?q?pVWEXAhEOI4M5HIF7VIcVgi4BAQE?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea10.nsa.gov with ESMTP; 01 Dec 2016 15:05:58 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id uB1F4mgh031618; Thu, 1 Dec 2016 10:05:00 -0500 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id uB1F4l7a159570 for ; Thu, 1 Dec 2016 10:04:47 -0500 Received: from moss-pluto.infosec.tycho.ncsc.mil (moss-pluto [192.168.25.131]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id uB1F4ijQ031612; Thu, 1 Dec 2016 10:04:44 -0500 From: Stephen Smalley To: selinux@tycho.nsa.gov Subject: [RFC][PATCH] selinux: support distinctions among all network address families Date: Thu, 1 Dec 2016 10:07:41 -0500 Message-Id: <1480604861-13982-1-git-send-email-sds@tycho.nsa.gov> X-Mailer: git-send-email 2.7.4 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: guido@trentalancia.net, Stephen Smalley MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP Extend SELinux to support distinctions among all network address families implemented by the kernel by defining new socket security classes and mapping to them. Otherwise, many sockets are mapped to the generic socket class and are indistinguishable in policy. This has come up previously with regard to selectively allowing access to bluetooth sockets, and more recently with regard to selectively allowing access to AF_ALG sockets. Guido Trentalancia submitted a patch that took a similar approach to add only support for distinguishing AF_ALG sockets, but this generalizes his approach to handle all address families implemented by the kernel. Socket security classes were not defined for AF_* values that are reserved but unimplemented in the kernel, e.g. AF_NETBEUI, AF_SECURITY, AF_ECONET, AF_SNA, AF_WANPIPE. Backward compatibility is provided by only enabling the finer-grained socket classes if a new policy capability is set in the policy; older policies will behave as before. The legacy redhat1 policy capability that was only ever used in testing within Fedora for ptrace_child is reclaimed for this purpose; as far as I can tell, this policy capability is not enabled in any supported distro policy. Add a pair of conditional compilation guards to detect when new AF_* values are added so that we can update SELinux accordingly rather than having to belatedly update it long after new address families are introduced. Signed-off-by: Stephen Smalley --- security/selinux/hooks.c | 67 +++++++++++++++++++++++++++++++++++++ security/selinux/include/classmap.h | 62 ++++++++++++++++++++++++++++++++++ security/selinux/include/security.h | 3 +- security/selinux/selinuxfs.c | 2 +- security/selinux/ss/services.c | 3 ++ 5 files changed, 135 insertions(+), 2 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 98a2e92..1ee2172 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1342,6 +1342,73 @@ static inline u16 socket_type_to_security_class(int family, int type, int protoc return SECCLASS_APPLETALK_SOCKET; } + if (!selinux_policycap_extsockclass) + return SECCLASS_SOCKET; + + switch (family) { + case PF_AX25: + return SECCLASS_AX25_SOCKET; + case PF_IPX: + return SECCLASS_IPX_SOCKET; + case PF_NETROM: + return SECCLASS_NETROM_SOCKET; + case PF_BRIDGE: + return SECCLASS_BRIDGE_SOCKET; + case PF_ATMPVC: + return SECCLASS_ATMPVC_SOCKET; + case PF_X25: + return SECCLASS_X25_SOCKET; + case PF_ROSE: + return SECCLASS_ROSE_SOCKET; + case PF_DECnet: + return SECCLASS_DECNET_SOCKET; + case PF_ATMSVC: + return SECCLASS_ATMSVC_SOCKET; + case PF_RDS: + return SECCLASS_RDS_SOCKET; + case PF_IRDA: + return SECCLASS_IRDA_SOCKET; + case PF_PPPOX: + return SECCLASS_PPPOX_SOCKET; + case PF_LLC: + return SECCLASS_LLC_SOCKET; + case PF_IB: + return SECCLASS_IB_SOCKET; + case PF_MPLS: + return SECCLASS_MPLS_SOCKET; + case PF_CAN: + return SECCLASS_CAN_SOCKET; + case PF_TIPC: + return SECCLASS_TIPC_SOCKET; + case PF_BLUETOOTH: + return SECCLASS_BLUETOOTH_SOCKET; + case PF_IUCV: + return SECCLASS_IUCV_SOCKET; + case PF_RXRPC: + return SECCLASS_RXRPC_SOCKET; + case PF_ISDN: + return SECCLASS_ISDN_SOCKET; + case PF_PHONET: + return SECCLASS_PHONET_SOCKET; + case PF_IEEE802154: + return SECCLASS_IEEE802154_SOCKET; + case PF_CAIF: + return SECCLASS_CAIF_SOCKET; + case PF_ALG: + return SECCLASS_ALG_SOCKET; + case PF_NFC: + return SECCLASS_NFC_SOCKET; + case PF_VSOCK: + return SECCLASS_VSOCK_SOCKET; + case PF_KCM: + return SECCLASS_KCM_SOCKET; + case PF_QIPCRTR: + return SECCLASS_QIPCRTR_SOCKET; +#if PF_MAX > 43 +#error New address family defined, please update this function. +#endif + } + return SECCLASS_SOCKET; } diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index e2d4ad3a..a11be76 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -169,5 +169,67 @@ struct security_class_mapping secclass_map[] = { { COMMON_CAP_PERMS, NULL } }, { "cap2_userns", { COMMON_CAP2_PERMS, NULL } }, + { "ax25_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "ipx_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "netrom_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "bridge_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "atmpvc_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "x25_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "rose_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "decnet_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "atmsvc_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "rds_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "irda_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "pppox_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "llc_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "ib_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "mpls_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "can_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "tipc_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "bluetooth_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "iucv_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "rxrpc_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "isdn_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "phonet_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "ieee802154_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "caif_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "alg_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "nfc_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "vsock_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "kcm_socket", + { COMMON_SOCK_PERMS, NULL } }, + { "qipcrtr_socket", + { COMMON_SOCK_PERMS, NULL } }, { NULL } }; + +#if PF_MAX > 43 +#error New address family defined, please update secclass_map. +#endif diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h index 308a286..beaa14b 100644 --- a/security/selinux/include/security.h +++ b/security/selinux/include/security.h @@ -69,7 +69,7 @@ extern int selinux_enabled; enum { POLICYDB_CAPABILITY_NETPEER, POLICYDB_CAPABILITY_OPENPERM, - POLICYDB_CAPABILITY_REDHAT1, + POLICYDB_CAPABILITY_EXTSOCKCLASS, POLICYDB_CAPABILITY_ALWAYSNETWORK, __POLICYDB_CAPABILITY_MAX }; @@ -77,6 +77,7 @@ enum { extern int selinux_policycap_netpeer; extern int selinux_policycap_openperm; +extern int selinux_policycap_extsockclass; extern int selinux_policycap_alwaysnetwork; /* diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index cf9293e..0aac402 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -45,7 +45,7 @@ static char *policycap_names[] = { "network_peer_controls", "open_perms", - "redhat1", + "extended_socket_class", "always_check_network" }; diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 082b20c..a70fcee 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -72,6 +72,7 @@ int selinux_policycap_netpeer; int selinux_policycap_openperm; +int selinux_policycap_extsockclass; int selinux_policycap_alwaysnetwork; static DEFINE_RWLOCK(policy_rwlock); @@ -1988,6 +1989,8 @@ static void security_load_policycaps(void) POLICYDB_CAPABILITY_NETPEER); selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps, POLICYDB_CAPABILITY_OPENPERM); + selinux_policycap_extsockclass = ebitmap_get_bit(&policydb.policycaps, + POLICYDB_CAPABILITY_EXTSOCKCLASS); selinux_policycap_alwaysnetwork = ebitmap_get_bit(&policydb.policycaps, POLICYDB_CAPABILITY_ALWAYSNETWORK); }