From patchwork Mon May 15 20:42:35 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Jurgens X-Patchwork-Id: 9727961 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E1DE76028A for ; Mon, 15 May 2017 20:44:12 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B97C52899F for ; Mon, 15 May 2017 20:44:12 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id AD454289A3; Mon, 15 May 2017 20:44:12 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from emsm-gh1-uea11.nsa.gov (emsm-gh1-uea11.nsa.gov [8.44.101.9]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BE0DC2899F for ; Mon, 15 May 2017 20:44:10 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.38,346,1491264000"; d="scan'208";a="5797419" IronPort-PHdr: =?us-ascii?q?9a23=3A8nfzzxenDIVvRVyJhw/mxxIrlGMj4u6mDksu8pMi?= =?us-ascii?q?zoh2WeGdxcq7ZhyN2/xhgRfzUJnB7Loc0qyN4v+mADdLuMvb+Fk5M7V0Hycfjs?= =?us-ascii?q?sXmwFySOWkMmbcaMDQUiohAc5ZX0Vk9XzoeWJcGcL5ekGA6ibqtW1aFRrwLxd6?= =?us-ascii?q?KfroEYDOkcu3y/qy+5rOaAlUmTaxe71/IRG0oAnLq8Ubj4RuJrsxxxfXv3BFZ/?= =?us-ascii?q?lYyWR0KFyJgh3y/N2w/Jlt8yRRv/Iu6ctNWrjkcqo7ULJVEi0oP3g668P3uxbD?= =?us-ascii?q?SxCP5mYHXWUNjhVIGQnF4wrkUZr3ryD3q/By2CiePc3xULA0RTGv5LplRRP0lC?= =?us-ascii?q?sKMSMy/2/Nisx0kalVvhSvqRJiyILQeY2ZKeZycqbbcNgHR2ROQ9xRWjRBDI2i?= =?us-ascii?q?coUBAekPM+FaoInzv1sDrwayCAeyC+P00TJEmmP60Lcm3+k7DQ3KwAotFM8Ovn?= =?us-ascii?q?TOq9X1Mb8fX+6vw6nO0D7Na+5W2S3y6IfWdBAhuuyHULVtfsXLz0kvFh3KjlGS?= =?us-ascii?q?qYH+OjOayOANs2yB4OpmUuKuhHQrpB12ojiq38ohjJTCiIENyl3c6Cl0z4k4Kc?= =?us-ascii?q?e4RUJme9KoDpRduz+AO4drWs8uXmVltSggxrAJu5O3ZjUGxZUnyhLFdvCLbYyF?= =?us-ascii?q?7xT+X+iLOzh4nmhqeLeniha39kiv1/PzW9Gv0FZPsipFit7Mtm0R1xDL6siIVP?= =?us-ascii?q?99/kC51DaTzQ/T8OBEIV0vlabBN54gwqI/lpoUsUjZGC/5hF72g7OMekUh++io?= =?us-ascii?q?7/zrYrTgppCCK495khzyP6shl8ClAek0LxICU3aU9OiizrHv4FX1QLBQgf03lq?= =?us-ascii?q?nZvoraJcMepqOhGA9azIIj6xe5Dze739UUhGIILFVYeBKBk4fmJUrOLevkDfa/?= =?us-ascii?q?n1uskDBry+rAPr36GJrBNHfDkLD/fbpl8U5T1BIzzcxD55JTErwBIvXzWknru9?= =?us-ascii?q?zEDh82KQq0zv3lCNV60IMeXHiAArSFMKzMq1+I/fgjI+6WZI8aoDz9MeQq5+by?= =?us-ascii?q?jX8lnl8QZaup3ZkNZ3+kHfRmOEKZYXztgtcfCmoKsA4+TPHliVKZTD5TYWqyX7?= =?us-ascii?q?8m6jE8EoKmAp/JRpqxj7yZwCe7AppWa3hIC1CNFXfocpuLW+0XZSKcPMBujzsE?= =?us-ascii?q?VaK7RI85zxGusw36xKR7IerI4CEYsojj1Ndt7e3JiR4y7SB0D9ia02yVUm57gm?= =?us-ascii?q?YIRzgw3KBjvEBw0UmD3rZig/xZFN1T4PVJXh08NZHC0+xwE8ryVR7ZfteVVFam?= =?us-ascii?q?Rc2rDiwtTt0r2d8DeFpyG9Knjh/fxSWqGKMVm6aNBJMq7qLWx2LxKNply3bayK?= =?us-ascii?q?khiEErQ8tONG2hgK5y7A3TB4rQn0WYkaamb6Ic0zTX9GeAzGqOol9XXBR2Uarb?= =?us-ascii?q?QXAVflHWosjh5kPeU7+uDqwqPRBaxsKFLqtKa8bpjUldRPv5I9TRfX6+l32rBR?= =?us-ascii?q?mWwrOMbYzqe3gS3SjGFEcFkxoT/WudNQQkCCauuX7eDCdpFVLpeU/s9vN+qHyj?= =?us-ascii?q?RE8u0w6Kd1Fh16ay+hMNm/OcU+kc3qgFuCc6sDh0BEyy38jXC9qbvwpheL9Tbs?= =?us-ascii?q?8j71td0mLZrQN9NIS6L69+nl4ebxh3v0T22hV5EIVPi84qo28rzAppMq+Y1UtB?= =?us-ascii?q?dzKB0ZDrNLzXMXP+/Be1a67ZwlveysqZ+r8T6PQkrFXupAKpGVAh83VgztlYyH?= =?us-ascii?q?ic6Y/JDAoVTJL9SEE39wJ1p7vCeCky+5vU1WFwMamzqjLNwc8mBPEkyhm+ZddS?= =?us-ascii?q?K7mLGxP3E8EAAMiuMuMqkUCzbh0YJOBS6LI0P8S+evud1q6rJuFgnCm6jWlc+4?= =?us-ascii?q?B91EWM9iR5SuHS2ZYJ2feY0RWbVz3klleurtj3mZxYZTEVBme+xzLrBIpNZqJs?= =?us-ascii?q?Z4YLEnyjI9OpydVknJHtRntY+ESkB1Mc18+jYQCSYEDl3Q1MyUQXpmSqmTelwD?= =?us-ascii?q?NpkjEmtK6f0TfSzOTlcRoIJnRERHJ+jVv2J4i7kcwaVlCybwc1jBul+Vr6x69D?= =?us-ascii?q?qaR5LmnTRUNIcDbtL2x5SKS/qKCCY8lV5JMvqyVXX/y2YUqGRb7lvxsazyTjEn?= =?us-ascii?q?NAxDA6az6qppL5nwZghG2BLHZzq3zZec5ryBfb5dzcQ+Re3iABRCVijjnXHFe8?= =?us-ascii?q?NcGz/dqIj5fDrvy+V2W5W51XcCnr1p+AuDKg5WJ0BR2/nvazmsDoEAUhyi/7z9?= =?us-ascii?q?hqVSPJrBngeYnnzaK6Pvx7fkNwHl/z99J6Gp1ikos3nJwQw38ahpGR/XUZi2f8?= =?us-ascii?q?LdJb2KzlYXoWWD4E38XV7BLi2E15IXKD35j5WWmFwst9e9m6ZXsb2jon4MBXDK?= =?us-ascii?q?eY9qZLkTFurVq/qQLRff99njEGxPsr9HIaheYJtxY3wiWbHL8SAVFSPTbwmBSQ?= =?us-ascii?q?89C+sKJXaX6scbeu0kp+hsusDLKcrQFaQ3b5fIktHTNq4sV4KlLM32X56pv4d9?= =?us-ascii?q?nIcdITqhqUng/ej+hTNZ08jeQKhSx6NmL9p3ElzfA0jQB215GgoIeHM3lt/L6+?= =?us-ascii?q?AhNALj36fd4T+jX2gKlCn8aWw4CuEoxvGjoRWpvkV/WoECgdtf7/LQaBDCU8qm?= =?us-ascii?q?uHGbrYBQKf8lppoG/UHpCkMnGWK2MVzdN8SxmBPEZfmhwbXC0mnp4lEQCn3NTh?= =?us-ascii?q?f11k5jAV+FH4sgFDyuR0NxbhSGfSvxqoaiwqR5iFNxpa9BpC50DIMcyE8u18AS?= =?us-ascii?q?9Y/pq7rAyCNGOXfQJIAn8VWkacHVDsIqGu5cXc8+ifHue+IeHBYbOSqexZUveF?= =?us-ascii?q?3pyv3ZV78DaLLMWAJGFiD+c82kpBQ392B9jZly8ISywNmCLHd9Sbqwuk+i1rss?= =?us-ascii?q?C/9+zmWAf16ouLD7tdL8lv+wysjqiZLOOQgjh2KSpD1pwQ33DI0KYQ0EQUiy5w?= =?us-ascii?q?azmnCa4AujLVTKLMhq9XCAYWazlpOMpG9a482xNCOcrcitL1zbN3lOI6C1JfWV?= =?us-ascii?q?zmgMGpatQAI3uhO1PfGEaLKLOGKCXFw8Htf6yzVKZQg/9Stx2svjabCFTuMS6f?= =?us-ascii?q?mDnsTRyvNvtMjC6DNhxEpI69agptCXTkTN/+bB27KsV4jSUuwbAviHPKNHQcMS?= =?us-ascii?q?Ngc0NDr72Q6zlXgvNjFGxA9HVlKfOImyGD7+nXMpwWq+dkAjxol+JG53Q306NV?= =?us-ascii?q?4z9fS/NrnivSr8Juo1a9n+mO1DVoTgRBpixMhIKRskVoIb/Z+YVYWXbY4BIN6n?= =?us-ascii?q?2dBAkRp9R7ENLvtLpQxcLRlK/oMzdN6dHU/dYGB8fOMs6HNGchMRzzFz7OFQcF?= =?us-ascii?q?UTmrNWLfhkxaiv2S8GOaroQioJj2hJUOUqNbVEAyFv4CEURqBsICL414Xjw6ir?= =?us-ascii?q?6Wl9UI6mCgrBbLS8VVoIvHWuiUAfrxNDaTlaNEaAcQwbPkMYQTMZX21Fdjall1?= =?us-ascii?q?m4TKHVHdUs1TrSJ6bw87ukNN/GJ5Tm0p1ELvchmt72MLFf6ogh42jRNzbv4i9D?= =?us-ascii?q?j2/Vc4OEHHpCwokEYvn9XlhCqecD/1LKirWoFXBDD4t08rMpP0Wwx1dxG9nVR4?= =?us-ascii?q?NDfYQLJcl6dgdWduiAPGo5tPHv9dQrNCYBAL3/GXYOsn0VdHpyq7wk9H4PfKBo?= =?us-ascii?q?F5lAs2a5KsqWxP2x57Zt4vOaPQPLZJzkRXhq+WvS+p1uQxzxEFKkYI92OSdiAI?= =?us-ascii?q?t1IUNrk6Jyqo+els5hKYlztFZmcMS+Igouh2+UMlJ+SA0yXg3qZFKk+vLeOfK7?= =?us-ascii?q?iUu2vHlc6TXlM/zEUIl1JG/bh3y8sjdVSbV1w3xruLCxsJLdbCKR1Sb8dK7njc?= =?us-ascii?q?Yz2OvvvXzpJvI4q9FvvlQvSPtKYOn02kGwgpH5wW7ssfHpigykfYItn7LLQd0x?= =?us-ascii?q?Ui+BzrJEmZDPROYB+EjTAHo8e5zJBqw4ZdIjAdDH5nPiqp/LbXoRUmgP2ZXNc5?= =?us-ascii?q?en0aRJcLNmoqWM2mnC5Up2lPAyOp0uIY1QeC9CTxqT7KDDnmaNpiauyUag1wB9?= =?us-ascii?q?Gr4zU/8rS2iF7N/pXYOW76KcxousXT5uMCu5aHF/RUQKF5s0fbgYlXWXqqUm/I?= =?us-ascii?q?EdOuKJjwbZQsYcbzCnagXVy1kyg1QNvpPNaxMqiIhhnlRZ1Kv4mf3TAjM9K9Fz?= =?us-ascii?q?4FFhhsoOED4b5zahcYY5onexLosRoxN7CnKgeCztquW3qtKSdRT/RHzuW6fbxW?= =?us-ascii?q?wDAqbu+myHstVZ46z+6v8UERXp0KiA/Rxeq7bYlETSfzAmBdexnIpSchi2hhN+?= =?us-ascii?q?MywuAjwBPIsVgRKC2EdO1paWNepN4wH1WSLmtqCmAgXV+TkZLD4hKw37AV5yZS?= =?us-ascii?q?hdJU0exZv3fgppDfZTKtWKqsqZXTqSUtdsMpo6xrPozlO8eGuo7ekibZTJbOrg?= =?us-ascii?q?2PSDS6GOZCmthMPCJYR+FFlno7NswAoodO81c+VtkgKLxVE6kjvKqqaDp+AS4V?= =?us-ascii?q?1y8ZWJuK3CYejeekx7vaihCQfYwtMBwZsZVCht8dXDBzYi4FuaCsSZ7Zl26eRW?= =?us-ascii?q?gNOgsT6h5M5A0YnI9qYu/l+JbITINLyzNOufJ0VCrLGYVo91v8TmGWmkD2Ruy8?= =?us-ascii?q?neKzwQ9cy+nh3cUcWB56FUdS3f1WllcyJLFxNaYQopbAsiWUekPioGLt1OymKU?= =?us-ascii?q?FLycLObV34C5HKuHHgUi0G43IUW5FAyHXeFZQUnAp5bKcrpFpMIIC6dEbx/SYk?= =?us-ascii?q?x4FzE7m+S8+r204vrWwaSCeyD9pBF+ZmvUrZWTF/f5+rqJTlO5BTQmBK+52QsF?= =?us-ascii?q?ZZn1tzPCGn05ZcLNtN4jEUVjhVvTqdpMeySNFE2cJuFZAMOMp/u3HnFKNHI5WR?= =?us-ascii?q?onw2ur3zynDC4Tw8tkm1xCmrEa+iU+1Z53EeGhkuJ2mGq0kvCfcs/XnW8l/Tt1?= =?us-ascii?q?B74ftbBqKPjEhqpzZ9Bo5BBjBM1X+/LlRzSGJJs+JVKajPdMxcWfYybwe1OxMi?= =?us-ascii?q?Df4mw1CJ/UZskHf2eSx9rA1a+zzGUgk1UikUjLHtmSEeqs65OD8aTY5IYis7by?= =?us-ascii?q?vfLQKUhzxXtg5Fa052Q5AZHspF+7YD0ItI+crCTF2hKT0ZUBxnLQ00y/xfmlBf?= =?us-ascii?q?sE+AYyDSERKoderTsh1wZcqRrNSmLO7j8wdDl4zqq/03+LsbR32+hwKtRc7Rr5?= =?us-ascii?q?Xmut2NrEuOe7/yM/egbn/ZUDjMkRewiK8mD5nN4SfeKxdUJIdhyXU6e5jhFXDE?= =?us-ascii?q?MglcK6IdOUVbSbhwac9areBCe89kZKEJ9Ld2CRKJWhzjBI6ioORII1vIWTveKC?= =?us-ascii?q?CB/fClroLI8bzRU+7gadKQx3zfWaJ4Io966SXnG7ftyYJe4FT51ept9kxgVVjL?= =?us-ascii?q?KCSBrNP/JgwV+sWtakzisYA3Ej/MBpd/jmbtzFlad8ULWy2q7IgYyJRB5XboUu?= =?us-ascii?q?J4zlL8v/BO97R/8ok35K1pyd2oKqjML/RarVVnDQKQBglw8ZUtGmd/TXhLYuAN?= =?us-ascii?q?MPfRYbgZjcf2puDrDawY9gOa9PFCZNvaI0HBhtO/BSuCSRxFmwcBrSAVLheG2/?= =?us-ascii?q?6Cga90Rt6vpfLl1UI1/1i+MhkGwahv5Yie4KqIo/TXbx/LwrgaQaXqQ97zrrAw?= =?us-ascii?q?u0OT+fIklaQBempuYwG9F+gdTMEdzH/6za821SIsD9/DH7X49f5BTX05mDzgm4?= =?us-ascii?q?p6H1oLBPwZBqaL8p5YnmcjnOzVLNsWfb5emmyXDx6rDqcCyWK36yuQOGRlhBXO?= =?us-ascii?q?3grxQWO16V/6ty54QS3Cz9f5iEVVTaW3BV1PXyW1JU94rSmPMxTyuNrwo6Q141?= =?us-ascii?q?k8Mnb4u9KViGuhJLRXEtX5JNydPSY0o1YXg4cqRtC12IAbHt29IMwK8Hxla/vT?= =?us-ascii?q?5GyqnzVGo6ddiIrU+tuV9enPHXm8k62arK2AyyxCxXg8o14/8cygN/HJ59CRWP?= =?us-ascii?q?Sny2cRQDl5uwvdXh66sKbXr1YKNkyXyE3LgpAFPslF3Xkk0UHr/OwjQMk29Ahe?= =?us-ascii?q?DYvAae0Nqi30ODvu21mfe8g3Vi6c0zRJAl31DUN0GK8m2GL/pMjJj2vf+0U0Ro?= =?us-ascii?q?lscEzqnR53D4Q9KU827VgY3CoCHhYXaRCaCrGoCl7pLY0aWkgfcR6HxqS1er8r?= =?us-ascii?q?3U1vxbOi/O7TbO1mCKUXKvlQlRWOk0ZHGp0IraISWrV8e0VS9KTPvAjtF5DnX+?= =?us-ascii?q?T6lXo3LfC6WcFa8dsXtnQ44Aa/Rgag6Y9Z4LYGjJCFbbJLYZ/Rs89i9Uhn+CQP?= =?us-ascii?q?ditXgBdllR+5VvocpO/76NjBrJWo8vquVLoqR+gP7xg7HXh+gIfwgFEtptHXze?= =?us-ascii?q?RcRpTOiYvh9ABNIniKuJvV0hRnMeoBMZ6rc6pg93QJICgePXEOMcCVa/Yi+S9t?= =?us-ascii?q?Nivc51hYDsMLf9MYM9LHmRpIhU3xRLFT6s3bF0eEC4dpac8o63D4yDYr/pYnT+?= =?us-ascii?q?ng6TC2JZHD715XJPNMlj9slM/YqOgT3/XSFDAd4WOFZBht3iOC156NBu7//eqW?= =?us-ascii?q?0tHbSU8GHi4tXodZJTqC5RKoRuqvm5X0SQOY8Mnzj4widEiIXHy+gLwFsrpQEe?= =?us-ascii?q?5Hkij70SZRFobph/KStNqg73BXuUNDEIZy6x3FBapeM45/ORvmjMmqRlJzCjH5?= =?us-ascii?q?eM7KahokoPCWyfsU4+ViK0v+YpcWLQ4Gy73g9XVYVRdhSLnyvladXOIeesFmSO?= =?us-ascii?q?/aoX9J6YJsMagPPEKSpJbytDdHtEg2ABM1aL83tjFac07OnAtJW6b7prENkQ4c?= =?us-ascii?q?Ud9jtk9KB22wJGw/5z3dVaRWl6mdEvoV/SuPTqYWSUVnLjt+Qw+p2JVpY7apku?= =?us-ascii?q?xIsnhdni9kvfYk3DpoRBq6uS3xqKMAwj0g+LSiuzUHp3NJVOKekz3HCV9b1vQF?= =?us-ascii?q?kb8cC2r+6Vy7eHQDbozy4LlhJcj66YYh43A/YQg+cCwHXOSgDTrwj6CJAoGUrt?= =?us-ascii?q?JchQCNt9/KbbCuLCgeLLI9xgz/R3JlyAjRgA5o8HcXQjWn9NIkJZu9Ntwjxiez?= =?us-ascii?q?HWjbaUsD4qJOsMvqr1ILS/E2aVx5ymV5zseHXjENRNDIG2stjAgrd2tEcJxH6R?= =?us-ascii?q?IBGagnmDCIsbda/g0OZjfbDJil8JHKncjUwXk9UctqxmXOq62KgpMq13NklM1w?= =?us-ascii?q?7i6Ko3kSbOvYU8ltAnfvzItfz/LxZ+m1uOAdVIRm0KihUOMFMsS7+2u22JVrWl?= =?us-ascii?q?eixrQaHlq5LPEMy6zeUyekVW2YQ/qEf3KLnzYjPU74/QOoIUEvaMdWs089NfPP?= =?us-ascii?q?hoJdlw3kSr50WiSQqkPYzGM9NeMWbQQ2t5m7ewYSVu4ee/CcJfQywP05EFYMan?= =?us-ascii?q?7JHSh1C++xqlOtnpJ0O3Zn4UX8f+vt9BrqMN2MFRkYCYTatIJ++eSmRmKdPn9t?= =?us-ascii?q?1AZ9M1dy9+fDDFkxretcc5GNndjMmdR0z/MKe+1qMS0ntd4Zgphj5pWM0MeWbR?= =?us-ascii?q?HRyY7/JcnSovicGfLf1UoremZeUroXeg714oI6PtkiW7LNAbRZpxMcBbMhQJwg?= =?us-ascii?q?MWfx+7t4LARpcg7efL60mNXlpvqXZptIoH/b9lwwIznYux0C0vy7Uxd2bpGrh3?= =?us-ascii?q?X3JZA/WChBr9lzBRd8G4tPAcwApRK9A5GIgKG7l8Ox+0Ritu4EqarwEPHK28in?= =?us-ascii?q?0IhqWpha5FCLPCzPC6VxhURllOuyiO/a0pbtEcPiZc8EVO9jT27Cbr/JAJ6yKi?= =?us-ascii?q?qKOs3mYE5G77+c365lUhWLei/2QbCKtCu6O/V4+U870JB3fPLPzDwx6LHWwN/y?= =?us-ascii?q?Z2Bdpie+on+FLZ9f7F3RBezCRBJZUvuF/3xjHa0Qd4f08/0OMdM6ytiG/wZz9C?= =?us-ascii?q?hC0NeCI6W5tU/DxEZ7dZPdLEv01Cc1XoYEIAi/MUQym2/WtGzdDm5HI8inN8Zt?= =?us-ascii?q?mtCVAQLp50ZqhGEtaXRNGm3yRdeeIWIbwd6xZBWW9AJXCNYOh+u3dlQkua2ySO?= =?us-ascii?q?loPJJFlP60tLUGl9ZmNSXPRMlcPyHNI756JD1RDv/ApFIweB4Lr6A1WpspZZiJ?= =?us-ascii?q?OE4HMl2PySD1zQTZykD0atqs1LqJICYR73VHwLLF0SRWqwm/p/mZntXpUKrFY5?= =?us-ascii?q?HuQP7SLC0lWymVRTsoCkmp41aktOQAvPeDP2cfpkobYjmTCA4OvKxvq8bfDnPL?= =?us-ascii?q?k+15YJIKnOyaWzz3SCBglqoyAyFLtVqWQ/oCDgnbdHnhj3BZuAO8J/9A53Xlb6?= =?us-ascii?q?eXxqBNQewZHpNMcuGFQ9vfYf1ePDkoljAFN+u9fNDRtKg53UzSTWsYEqjI81ue?= =?us-ascii?q?QFSQQvOC2zK4FbkS6pM5visu58L4gj58E6OOOa2W4TGp7N2WliGd7MHXUCEPfl?= =?us-ascii?q?Y6jeQZSD2NyR9BJWUGI9QYvEXkRKmQIU1L0SR62qpVxxYQdVErATVV2XpMkaP4?= =?us-ascii?q?Q5VU?= X-IPAS-Result: =?us-ascii?q?A2HUAwCREhpZ/wHyM5BcHAEBBAEBCgEBFgEBAQMBAQEJAQE?= =?us-ascii?q?BgwEpgW6OdpBtcpcPJIs7VwEBAQEBAQEBAgECaAUjgjMkgkIGAQIXDVUDCQEBF?= =?us-ascii?q?wgpCAMBUxkFiFCBTgSuUjomAosEiD2CZ4RmhiMFkCKBAYxnkx2LF4ZSlENYWTF?= =?us-ascii?q?PIRWEbQsBAQFCHIFmc4Yvgj0BAQE?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea11.nsa.gov with ESMTP; 15 May 2017 20:44:09 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v4FKi8g6021676; Mon, 15 May 2017 16:44:09 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id v4FKhjFd276877 for ; Mon, 15 May 2017 16:43:45 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v4FKhjS0021297 for ; Mon, 15 May 2017 16:43:45 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1B0AgCREhpZf4GlL8FcHAEBBAEBCgEBgyyCF452kG1ylxKGJAKGDQECAQEBAQECEwEBIV2FGQMDGg1SEBgIMVcZiFWBUq5SOop6Mog9gmeEZoYjBZAigQGMZ5MdkWmUQ1ZaMU8hFYU9HIFmPTaGL4I9AQEB X-IPAS-Result: A1B0AgCREhpZf4GlL8FcHAEBBAEBCgEBgyyCF452kG1ylxKGJAKGDQECAQEBAQECEwEBIV2FGQMDGg1SEBgIMVcZiFWBUq5SOop6Mog9gmeEZoYjBZAigQGMZ5MdkWmUQ1ZaMU8hFYU9HIFmPTaGL4I9AQEB X-IronPort-AV: E=Sophos;i="5.38,346,1491278400"; d="scan'208";a="6053070" Received: from emsm-gh1-uea10.corp.nsa.gov (HELO emsm-gh1-uea10.nsa.gov) ([10.208.41.36]) by goalie.tycho.ncsc.mil with ESMTP; 15 May 2017 16:43:44 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3A5/Lc8BeOSXGvtp9peZU2RSuMlGMj4u6mDksu8pMi?= =?us-ascii?q?zoh2WeGdxcu4Yx7h7PlgxGXEQZ/co6odzbGH7Oa5AidZvMzJmUtBWaQEbwUCh8?= =?us-ascii?q?QSkl5oK+++Imq/EsTXaTcnFt9JTl5v8iLzG0FUHMHjew+a+SXqvnYdFRrlKAV6?= =?us-ascii?q?OPn+FJLMgMSrzeCy/IDYbxlViDanb75/KBe7oR/MusQYjoduN6Y8xgXUqXZUZu?= =?us-ascii?q?pawn9lK0iOlBjm/Mew+5Bj8yVUu/0/8sNLTLv3caclQ7FGFToqK2866tHluhnF?= =?us-ascii?q?VguP+2ATUn4KnRpSAgjK9w/1U5HsuSbnrOV92S2aPcrrTbAoXDmp8qlmRAP0hC?= =?us-ascii?q?oBKjU063/chNBug61HoRKhvx1/zJDSYIGJL/p1Y6fRccoHSWZdQspdUipMCZ6+?= =?us-ascii?q?YYQSFeoMJeZWoZfgqVUArhWwAgujBO30xzNUmnP7x7E23v49HQ3a2gErAtIAsG?= =?us-ascii?q?7TrNXwLKocX/q6zK/VxjvHcvNWwzj955bOchA6vPqBWq9/ftDXyUkuCQzFileQ?= =?us-ascii?q?pJfgPzyL0uQNt3KU7+xnVeOgkWIotwZxoj22y8oql4LHhZoVx0jZ+Sh9zos5P9?= =?us-ascii?q?K1RUxhbdK5EZZdtzuWO5ZoTs4mRWxjpTw0xaccuZGheSgH0JQnyADba/yAa4WI?= =?us-ascii?q?5wzsVOKVIThignJlf72+iwyu/kin0OH8V8203E5LripDjNbMqmgA2wHX58WJUP?= =?us-ascii?q?dw8UWs1SyS2w3S6uxIO104mbTfJpI5x74/jJsTsUDNHi/sn0X2ibebeVg+9eiu?= =?us-ascii?q?6uTofLHmpp2HOo9xlA7+NqAulda5AeQ/PQkCRXSU+eO51LH75032XK1KjuEqkq?= =?us-ascii?q?neqJ3aPtoUpqq4Aw9Tz4Yi5A2yDyum0dsEnXkHK0hJeBScj4fzIV3OL/f4Dens?= =?us-ascii?q?y2irxSxmw/HAI63JHoTGLn+FlqzoO7l69R1y0g02mPxW4dp2F6sOLfToEhv9vd?= =?us-ascii?q?rZAxs7Gwm5x+LuDtJtkIgZXDTcUeeiLKrOvArQtaoUKO6WadpQ4W6lJg=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0HsAQCREhpZf4GlL8FcHAEBBAEBCgEBF?= =?us-ascii?q?wEBBAEBCgEBgwGCF452kG1ylxKGJAKGDQEBAQEBAQEBAgECEAEBIV2CMyQBgkE?= =?us-ascii?q?DAxoNUhAYCDFXGYhVgVKuUjqKejKIPYJnhGaGIwWQIoEBjGeTHZFplENWWzFPI?= =?us-ascii?q?RWFPRyBZj02hi+CPQEBAQ?= X-IPAS-Result: =?us-ascii?q?A0HsAQCREhpZf4GlL8FcHAEBBAEBCgEBFwEBBAEBCgEBgwG?= =?us-ascii?q?CF452kG1ylxKGJAKGDQEBAQEBAQEBAgECEAEBIV2CMyQBgkEDAxoNUhAYCDFXG?= =?us-ascii?q?YhVgVKuUjqKejKIPYJnhGaGIwWQIoEBjGeTHZFplENWWzFPIRWFPRyBZj02hi+?= =?us-ascii?q?CPQEBAQ?= X-IronPort-AV: E=Sophos;i="5.38,346,1491264000"; d="scan'208";a="7074948" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from mail-il-dmz.mellanox.com (HELO mellanox.co.il) ([193.47.165.129]) by emsm-gh1-uea10.nsa.gov with ESMTP; 15 May 2017 20:43:23 +0000 Received: from Internal Mail-Server by MTLPINE1 (envelope-from danielj@mellanox.com) with ESMTPS (AES256-SHA encrypted); 15 May 2017 23:43:18 +0300 Received: from x-vnc01.mtx.labs.mlnx. (x-vnc01.mtx.labs.mlnx [10.12.150.16]) by labmailer.mlnx (8.13.8/8.13.8) with ESMTP id v4FKglb2005032; Mon, 15 May 2017 23:43:17 +0300 From: Dan Jurgens To: selinux@tycho.nsa.gov Subject: [PATCH v1 3/9] libsepol: Add Infiniband Pkey handling to CIL Date: Mon, 15 May 2017 23:42:35 +0300 Message-Id: <1494880961-73481-4-git-send-email-danielj@mellanox.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1494880961-73481-1-git-send-email-danielj@mellanox.com> References: <1494880961-73481-1-git-send-email-danielj@mellanox.com> X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP From: Daniel Jurgens Add Infiniband pkey parsing, symbol table management, and policy generation to CIL. Signed-off-by: Daniel Jurgens --- libsepol/cil/src/cil.c | 19 +++++++++ libsepol/cil/src/cil_binary.c | 39 +++++++++++++++++ libsepol/cil/src/cil_binary.h | 12 ++++++ libsepol/cil/src/cil_build_ast.c | 86 ++++++++++++++++++++++++++++++++++++++ libsepol/cil/src/cil_build_ast.h | 2 + libsepol/cil/src/cil_copy_ast.c | 26 ++++++++++++ libsepol/cil/src/cil_copy_ast.h | 1 + libsepol/cil/src/cil_flavor.h | 1 + libsepol/cil/src/cil_internal.h | 11 +++++ libsepol/cil/src/cil_policy.c | 16 +++++++ libsepol/cil/src/cil_post.c | 45 ++++++++++++++++++++ libsepol/cil/src/cil_post.h | 1 + libsepol/cil/src/cil_reset_ast.c | 9 ++++ libsepol/cil/src/cil_resolve_ast.c | 27 ++++++++++++ libsepol/cil/src/cil_resolve_ast.h | 1 + libsepol/cil/src/cil_tree.c | 16 ++++++- libsepol/cil/src/cil_verify.c | 23 ++++++++++ 17 files changed, 334 insertions(+), 1 deletion(-) diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c index 9b9ccc3..3df670a 100644 --- a/libsepol/cil/src/cil.c +++ b/libsepol/cil/src/cil.c @@ -188,6 +188,7 @@ static void cil_init_keys(void) CIL_KEY_MLSVALIDATETRANS = cil_strpool_add("mlsvalidatetrans"); CIL_KEY_CONTEXT = cil_strpool_add("context"); CIL_KEY_FILECON = cil_strpool_add("filecon"); + CIL_KEY_IBPKEYCON = cil_strpool_add("ibpkeycon"); CIL_KEY_PORTCON = cil_strpool_add("portcon"); CIL_KEY_NODECON = cil_strpool_add("nodecon"); CIL_KEY_GENFSCON = cil_strpool_add("genfscon"); @@ -257,6 +258,7 @@ void cil_db_init(struct cil_db **db) cil_sort_init(&(*db)->genfscon); cil_sort_init(&(*db)->filecon); cil_sort_init(&(*db)->nodecon); + cil_sort_init(&(*db)->ibpkeycon); cil_sort_init(&(*db)->portcon); cil_sort_init(&(*db)->pirqcon); cil_sort_init(&(*db)->iomemcon); @@ -308,6 +310,7 @@ void cil_db_destroy(struct cil_db **db) cil_sort_destroy(&(*db)->genfscon); cil_sort_destroy(&(*db)->filecon); cil_sort_destroy(&(*db)->nodecon); + cil_sort_destroy(&(*db)->ibpkeycon); cil_sort_destroy(&(*db)->portcon); cil_sort_destroy(&(*db)->pirqcon); cil_sort_destroy(&(*db)->iomemcon); @@ -728,6 +731,9 @@ void cil_destroy_data(void **data, enum cil_flavor flavor) case CIL_FILECON: cil_destroy_filecon(*data); break; + case CIL_IBPKEYCON: + cil_destroy_ibpkeycon(*data); + break; case CIL_PORTCON: cil_destroy_portcon(*data); break; @@ -1097,6 +1103,8 @@ const char * cil_node_to_string(struct cil_tree_node *node) return CIL_KEY_FSUSE; case CIL_FILECON: return CIL_KEY_FILECON; + case CIL_IBPKEYCON: + return CIL_KEY_IBPKEYCON; case CIL_PORTCON: return CIL_KEY_PORTCON; case CIL_NODECON: @@ -2255,6 +2263,17 @@ void cil_filecon_init(struct cil_filecon **filecon) (*filecon)->context = NULL; } +void cil_ibpkeycon_init(struct cil_ibpkeycon **ibpkeycon) +{ + *ibpkeycon = cil_malloc(sizeof(**ibpkeycon)); + + (*ibpkeycon)->subnet_prefix_str = NULL; + (*ibpkeycon)->pkey_low = 0; + (*ibpkeycon)->pkey_high = 0; + (*ibpkeycon)->context_str = NULL; + (*ibpkeycon)->context = NULL; +} + void cil_portcon_init(struct cil_portcon **portcon) { *portcon = cil_malloc(sizeof(**portcon)); diff --git a/libsepol/cil/src/cil_binary.c b/libsepol/cil/src/cil_binary.c index e1481a4..75398ff 100644 --- a/libsepol/cil/src/cil_binary.c +++ b/libsepol/cil/src/cil_binary.c @@ -3218,6 +3218,40 @@ exit: return rc; } +int cil_ibpkeycon_to_policydb(policydb_t *pdb, struct cil_sort *ibpkeycons) +{ + int rc = SEPOL_ERR; + uint32_t i = 0; + ocontext_t *tail = NULL; + struct in6_addr subnet_prefix; + + for (i = 0; i < ibpkeycons->count; i++) { + struct cil_ibpkeycon *cil_ibpkeycon = ibpkeycons->array[i]; + ocontext_t *new_ocon = cil_add_ocontext(&pdb->ocontexts[OCON_IBPKEY], &tail); + + rc = inet_pton(AF_INET6, cil_ibpkeycon->subnet_prefix_str, &subnet_prefix); + if (rc != 1) { + cil_log(CIL_ERR, "ibpkeycon subnet prefix not in valid IPV6 format\n"); + rc = SEPOL_ERR; + goto exit; + } + + memcpy(new_ocon->u.ibpkey.subnet_prefix, &subnet_prefix.s6_addr[0], + sizeof(*new_ocon->u.ibpkey.subnet_prefix)); + new_ocon->u.ibpkey.low_pkey = cil_ibpkeycon->pkey_low; + new_ocon->u.ibpkey.high_pkey = cil_ibpkeycon->pkey_high; + + rc = __cil_context_to_sepol_context(pdb, cil_ibpkeycon->context, &new_ocon->context[0]); + if (rc != SEPOL_OK) + goto exit; + } + + return SEPOL_OK; + +exit: + return rc; +} + int cil_portcon_to_policydb(policydb_t *pdb, struct cil_sort *portcons) { int rc = SEPOL_ERR; @@ -3848,6 +3882,11 @@ int __cil_contexts_to_policydb(policydb_t *pdb, const struct cil_db *db) goto exit; } + rc = cil_ibpkeycon_to_policydb(pdb, db->ibpkeycon); + if (rc != SEPOL_OK) { + goto exit; + } + if (db->target_platform == SEPOL_TARGET_XEN) { rc = cil_pirqcon_to_policydb(pdb, db->pirqcon); if (rc != SEPOL_OK) { diff --git a/libsepol/cil/src/cil_binary.h b/libsepol/cil/src/cil_binary.h index c59b1e3..a03d250 100644 --- a/libsepol/cil/src/cil_binary.h +++ b/libsepol/cil/src/cil_binary.h @@ -330,6 +330,18 @@ int cil_sepol_level_define(policydb_t *pdb, struct cil_sens *cil_sens); int cil_rangetransition_to_policydb(policydb_t *pdb, const struct cil_db *db, struct cil_rangetransition *rangetrans, hashtab_t range_trans_table); /** + * Insert cil ibpkeycon structure into sepol policydb. + * The function is given a structure containing the sorted ibpkeycons and + * loops over this structure inserting them into the policy database. + * + * @param[in] pdb The policy database to insert the ibpkeycon into. + * @param[in] node The cil_sort structure that contains the sorted ibpkeycons. + * + * @return SEPOL_OK upon success or an error otherwise. + */ +int cil_ibpkeycon_to_policydb(policydb_t *pdb, struct cil_sort *ibpkeycons); + +/** * Insert cil portcon structure into sepol policydb. * The function is given a structure containing the sorted portcons and * loops over this structure inserting them into the policy database. diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c index 36cc673..1121574 100644 --- a/libsepol/cil/src/cil_build_ast.c +++ b/libsepol/cil/src/cil_build_ast.c @@ -4256,6 +4256,89 @@ void cil_destroy_filecon(struct cil_filecon *filecon) free(filecon); } +int cil_gen_ibpkeycon(__attribute__((unused)) struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node) +{ + enum cil_syntax syntax[] = { + CIL_SYN_STRING, + CIL_SYN_STRING, + CIL_SYN_STRING | CIL_SYN_LIST, + CIL_SYN_STRING | CIL_SYN_LIST, + CIL_SYN_END + }; + int syntax_len = sizeof(syntax) / sizeof(*syntax); + int rc = SEPOL_ERR; + struct cil_ibpkeycon *ibpkeycon = NULL; + + if (!db || !parse_current || !ast_node) + goto exit; + + rc = __cil_verify_syntax(parse_current, syntax, syntax_len); + if (rc != SEPOL_OK) + goto exit; + + cil_ibpkeycon_init(&ibpkeycon); + + ibpkeycon->subnet_prefix_str = parse_current->next->data; + + if (parse_current->next->next->cl_head) { + if (parse_current->next->next->cl_head->next && + !parse_current->next->next->cl_head->next->next) { + rc = cil_fill_integer(parse_current->next->next->cl_head, &ibpkeycon->pkey_low, 0); + if (rc != SEPOL_OK) { + cil_log(CIL_ERR, "Improper ibpkey specified\n"); + goto exit; + } + rc = cil_fill_integer(parse_current->next->next->cl_head->next, &ibpkeycon->pkey_high, 0); + if (rc != SEPOL_OK) { + cil_log(CIL_ERR, "Improper ibpkey specified\n"); + goto exit; + } + } else { + cil_log(CIL_ERR, "Improper ibpkey range specified\n"); + rc = SEPOL_ERR; + goto exit; + } + } else { + rc = cil_fill_integer(parse_current->next->next, &ibpkeycon->pkey_low, 0); + if (rc != SEPOL_OK) { + cil_log(CIL_ERR, "Improper ibpkey specified\n"); + goto exit; + } + ibpkeycon->pkey_high = ibpkeycon->pkey_low; + } + + if (!parse_current->next->next->next->cl_head) { + ibpkeycon->context_str = parse_current->next->next->next->data; + } else { + cil_context_init(&ibpkeycon->context); + + rc = cil_fill_context(parse_current->next->next->next->cl_head, ibpkeycon->context); + if (rc != SEPOL_OK) + goto exit; + } + + ast_node->data = ibpkeycon; + ast_node->flavor = CIL_IBPKEYCON; + return SEPOL_OK; + +exit: + cil_tree_log(parse_current, CIL_ERR, "Bad ibpkeycon declaration"); + cil_destroy_ibpkeycon(ibpkeycon); + + return rc; +} + +void cil_destroy_ibpkeycon(struct cil_ibpkeycon *ibpkeycon) +{ + if (!ibpkeycon) + return; + + if (!ibpkeycon->context_str && ibpkeycon->context) + cil_destroy_context(ibpkeycon->context); + + free(ibpkeycon); +} + int cil_gen_portcon(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node) { enum cil_syntax syntax[] = { @@ -6215,6 +6298,9 @@ int __cil_build_ast_node_helper(struct cil_tree_node *parse_current, uint32_t *f } else if (parse_current->data == CIL_KEY_FILECON) { rc = cil_gen_filecon(db, parse_current, ast_node); *finished = CIL_TREE_SKIP_NEXT; + } else if (parse_current->data == CIL_KEY_IBPKEYCON) { + rc = cil_gen_ibpkeycon(db, parse_current, ast_node); + *finished = CIL_TREE_SKIP_NEXT; } else if (parse_current->data == CIL_KEY_PORTCON) { rc = cil_gen_portcon(db, parse_current, ast_node); *finished = CIL_TREE_SKIP_NEXT; diff --git a/libsepol/cil/src/cil_build_ast.h b/libsepol/cil/src/cil_build_ast.h index 33bae99..c2d7b31 100644 --- a/libsepol/cil/src/cil_build_ast.h +++ b/libsepol/cil/src/cil_build_ast.h @@ -175,6 +175,8 @@ int cil_gen_context(struct cil_db *db, struct cil_tree_node *parse_current, stru void cil_destroy_context(struct cil_context *context); int cil_gen_filecon(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node); void cil_destroy_filecon(struct cil_filecon *filecon); +int cil_gen_ibpkeycon(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node); +void cil_destroy_ibpkeycon(struct cil_ibpkeycon *ibpkeycon); int cil_gen_portcon(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node); void cil_destroy_portcon(struct cil_portcon *portcon); int cil_gen_nodecon(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node); diff --git a/libsepol/cil/src/cil_copy_ast.c b/libsepol/cil/src/cil_copy_ast.c index d668505..7307b08 100644 --- a/libsepol/cil/src/cil_copy_ast.c +++ b/libsepol/cil/src/cil_copy_ast.c @@ -1204,6 +1204,29 @@ int cil_copy_nodecon(struct cil_db *db, void *data, void **copy, __attribute__(( return SEPOL_OK; } +int cil_copy_ibpkeycon(struct cil_db *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab) +{ + struct cil_ibpkeycon *orig = data; + struct cil_ibpkeycon *new = NULL; + + cil_ibpkeycon_init(&new); + + new->subnet_prefix_str = orig->subnet_prefix_str; + new->pkey_low = orig->pkey_low; + new->pkey_high = orig->pkey_high; + + if (orig->context_str) { + new->context_str = orig->context_str; + } else { + cil_context_init(&new->context); + cil_copy_fill_context(db, orig->context, new->context); + } + + *copy = new; + + return SEPOL_OK; +} + int cil_copy_portcon(struct cil_db *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab) { struct cil_portcon *orig = data; @@ -1916,6 +1939,9 @@ int __cil_copy_node_helper(struct cil_tree_node *orig, __attribute__((unused)) u case CIL_NODECON: copy_func = &cil_copy_nodecon; break; + case CIL_IBPKEYCON: + copy_func = &cil_copy_ibpkeycon; + break; case CIL_PORTCON: copy_func = &cil_copy_portcon; break; diff --git a/libsepol/cil/src/cil_copy_ast.h b/libsepol/cil/src/cil_copy_ast.h index 78c34b8..a50c370 100644 --- a/libsepol/cil/src/cil_copy_ast.h +++ b/libsepol/cil/src/cil_copy_ast.h @@ -99,6 +99,7 @@ int cil_copy_netifcon(struct cil_db *db, void *data, void **copy, symtab_t *symt int cil_copy_genfscon(struct cil_db *db, void *data, void **copy, symtab_t *symtab); int cil_copy_filecon(struct cil_db *db, void *data, void **copy, symtab_t *symtab); int cil_copy_nodecon(struct cil_db *db, void *data, void **copy, symtab_t *symtab); +int cil_copy_ibpkeycon(struct cil_db *db, void *data, void **copy, symtab_t *symtab); int cil_copy_portcon(struct cil_db *db, void *data, void **copy, symtab_t *symtab); int cil_copy_pirqcon(struct cil_db *db, void *data, void **copy, symtab_t *symtab); int cil_copy_iomemcon(struct cil_db *db, void *data, void **copy, symtab_t *symtab); diff --git a/libsepol/cil/src/cil_flavor.h b/libsepol/cil/src/cil_flavor.h index c01f967..4505b8b 100644 --- a/libsepol/cil/src/cil_flavor.h +++ b/libsepol/cil/src/cil_flavor.h @@ -113,6 +113,7 @@ enum cil_flavor { CIL_HANDLEUNKNOWN, CIL_MLS, CIL_SRC_INFO, + CIL_IBPKEYCON, /* * boolean constraint set catset diff --git a/libsepol/cil/src/cil_internal.h b/libsepol/cil/src/cil_internal.h index aee3f00..2add97b 100644 --- a/libsepol/cil/src/cil_internal.h +++ b/libsepol/cil/src/cil_internal.h @@ -203,6 +203,7 @@ char *CIL_KEY_VALIDATETRANS; char *CIL_KEY_MLSVALIDATETRANS; char *CIL_KEY_CONTEXT; char *CIL_KEY_FILECON; +char *CIL_KEY_IBPKEYCON; char *CIL_KEY_PORTCON; char *CIL_KEY_NODECON; char *CIL_KEY_GENFSCON; @@ -286,6 +287,7 @@ struct cil_db { struct cil_sort *genfscon; struct cil_sort *filecon; struct cil_sort *nodecon; + struct cil_sort *ibpkeycon; struct cil_sort *portcon; struct cil_sort *pirqcon; struct cil_sort *iomemcon; @@ -737,6 +739,14 @@ enum cil_protocol { CIL_PROTOCOL_DCCP }; +struct cil_ibpkeycon { + char *subnet_prefix_str; + uint32_t pkey_low; + uint32_t pkey_high; + char *context_str; + struct cil_context *context; +}; + struct cil_portcon { enum cil_protocol proto; uint32_t port_low; @@ -1007,6 +1017,7 @@ void cil_catset_init(struct cil_catset **catset); void cil_cats_init(struct cil_cats **cats); void cil_senscat_init(struct cil_senscat **senscat); void cil_filecon_init(struct cil_filecon **filecon); +void cil_ibpkeycon_init(struct cil_ibpkeycon **ibpkeycon); void cil_portcon_init(struct cil_portcon **portcon); void cil_nodecon_init(struct cil_nodecon **nodecon); void cil_genfscon_init(struct cil_genfscon **genfscon); diff --git a/libsepol/cil/src/cil_policy.c b/libsepol/cil/src/cil_policy.c index 77179e6..35a0a29 100644 --- a/libsepol/cil/src/cil_policy.c +++ b/libsepol/cil/src/cil_policy.c @@ -1714,6 +1714,21 @@ static void cil_genfscons_to_policy(FILE *out, struct cil_sort *genfscons, int m } } +static void cil_ibpkeycons_to_policy(FILE *out, struct cil_sort *ibpkeycons, int mls) +{ + uint32_t i = 0; + + for (i = 0; i < ibpkeycons->count; i++) { + struct cil_ibpkeycon *ibpkeycon = (struct cil_ibpkeycon *)ibpkeycons->array[i]; + + fprintf(out, "ibpkeycon %s ", ibpkeycon->subnet_prefix_str); + fprintf(out, "%d ", ibpkeycon->pkey_low); + fprintf(out, "%d ", ibpkeycon->pkey_high); + cil_context_to_policy(out, ibpkeycon->context, mls); + fprintf(out, "\n"); + } +} + static void cil_portcons_to_policy(FILE *out, struct cil_sort *portcons, int mls) { unsigned i; @@ -1942,6 +1957,7 @@ void cil_gen_policy(FILE *out, struct cil_db *db) cil_genfscons_to_policy(out, db->genfscon, db->mls); cil_portcons_to_policy(out, db->portcon, db->mls); cil_netifcons_to_policy(out, db->netifcon, db->mls); + cil_ibpkeycons_to_policy(out, db->ibpkeycon, db->mls); cil_nodecons_to_policy(out, db->nodecon, db->mls); cil_pirqcons_to_policy(out, db->pirqcon, db->mls); cil_iomemcons_to_policy(out, db->iomemcon, db->mls); diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c index 1941fab..893860d 100644 --- a/libsepol/cil/src/cil_post.c +++ b/libsepol/cil/src/cil_post.c @@ -154,6 +154,28 @@ int cil_post_filecon_compare(const void *a, const void *b) return rc; } +int cil_post_ibpkeycon_compare(const void *a, const void *b) +{ + int rc = SEPOL_ERR; + struct cil_ibpkeycon *aibpkeycon = *(struct cil_ibpkeycon **)a; + struct cil_ibpkeycon *bibpkeycon = *(struct cil_ibpkeycon **)b; + + rc = strcmp(aibpkeycon->subnet_prefix_str, bibpkeycon->subnet_prefix_str); + if (rc) + return rc; + + rc = (aibpkeycon->pkey_high - aibpkeycon->pkey_low) + - (bibpkeycon->pkey_high - bibpkeycon->pkey_low); + if (rc == 0) { + if (aibpkeycon->pkey_low < bibpkeycon->pkey_low) + rc = -1; + else if (bibpkeycon->pkey_low < aibpkeycon->pkey_low) + rc = 1; + } + + return rc; +} + int cil_post_portcon_compare(const void *a, const void *b) { int rc = SEPOL_ERR; @@ -401,6 +423,9 @@ static int __cil_post_db_count_helper(struct cil_tree_node *node, uint32_t *fini case CIL_NODECON: db->nodecon->count++; break; + case CIL_IBPKEYCON: + db->ibpkeycon->count++; + break; case CIL_PORTCON: db->portcon->count++; break; @@ -535,6 +560,17 @@ static int __cil_post_db_array_helper(struct cil_tree_node *node, uint32_t *fini sort->index++; break; } + case CIL_IBPKEYCON: { + struct cil_sort *sort = db->ibpkeycon; + uint32_t count = sort->count; + uint32_t i = sort->index; + + if (!sort->array) + sort->array = cil_malloc(sizeof(*sort->array) * count); + sort->array[i] = node->data; + sort->index++; + break; + } case CIL_PORTCON: { struct cil_sort *sort = db->portcon; uint32_t count = sort->count; @@ -1618,6 +1654,14 @@ static int __cil_post_db_cat_helper(struct cil_tree_node *node, uint32_t *finish } break; } + case CIL_IBPKEYCON: { + struct cil_ibpkeycon *ibpkeycon = node->data; + + rc = __evaluate_levelrange_expression(ibpkeycon->context->range, db); + if (rc != SEPOL_OK) + goto exit; + break; + } case CIL_PORTCON: { struct cil_portcon *portcon = node->data; rc = __evaluate_levelrange_expression(portcon->context->range, db); @@ -1977,6 +2021,7 @@ static int cil_post_db(struct cil_db *db) qsort(db->netifcon->array, db->netifcon->count, sizeof(db->netifcon->array), cil_post_netifcon_compare); qsort(db->genfscon->array, db->genfscon->count, sizeof(db->genfscon->array), cil_post_genfscon_compare); + qsort(db->ibpkeycon->array, db->ibpkeycon->count, sizeof(db->ibpkeycon->array), cil_post_ibpkeycon_compare); qsort(db->portcon->array, db->portcon->count, sizeof(db->portcon->array), cil_post_portcon_compare); qsort(db->nodecon->array, db->nodecon->count, sizeof(db->nodecon->array), cil_post_nodecon_compare); qsort(db->fsuse->array, db->fsuse->count, sizeof(db->fsuse->array), cil_post_fsuse_compare); diff --git a/libsepol/cil/src/cil_post.h b/libsepol/cil/src/cil_post.h index 74393cc..fe7f3a5 100644 --- a/libsepol/cil/src/cil_post.h +++ b/libsepol/cil/src/cil_post.h @@ -38,6 +38,7 @@ struct fc_data { void cil_post_fc_fill_data(struct fc_data *fc, char *path); int cil_post_filecon_compare(const void *a, const void *b); +int cil_post_ibpkeycon_compare(const void *a, const void *b); int cil_post_portcon_compare(const void *a, const void *b); int cil_post_genfscon_compare(const void *a, const void *b); int cil_post_netifcon_compare(const void *a, const void *b); diff --git a/libsepol/cil/src/cil_reset_ast.c b/libsepol/cil/src/cil_reset_ast.c index 676e156..fc23a2c 100644 --- a/libsepol/cil/src/cil_reset_ast.c +++ b/libsepol/cil/src/cil_reset_ast.c @@ -288,6 +288,12 @@ static void cil_reset_filecon(struct cil_filecon *filecon) } } +static void cil_reset_ibpkeycon(struct cil_ibpkeycon *ibpkeycon) +{ + if (!ibpkeycon->context) + cil_reset_context(ibpkeycon->context); +} + static void cil_reset_portcon(struct cil_portcon *portcon) { if (portcon->context_str == NULL) { @@ -489,6 +495,9 @@ int __cil_reset_node(struct cil_tree_node *node, __attribute__((unused)) uint32 case CIL_FILECON: cil_reset_filecon(node->data); break; + case CIL_IBPKEYCON: + cil_reset_ibpkeycon(node->data); + break; case CIL_PORTCON: cil_reset_portcon(node->data); break; diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c index 8925b27..9e3cb2b 100644 --- a/libsepol/cil/src/cil_resolve_ast.c +++ b/libsepol/cil/src/cil_resolve_ast.c @@ -1923,6 +1923,30 @@ int cil_resolve_filecon(struct cil_tree_node *current, void *extra_args) return SEPOL_OK; } +int cil_resolve_ibpkeycon(struct cil_tree_node *current, void *extra_args) +{ + struct cil_ibpkeycon *ibpkeycon = current->data; + struct cil_symtab_datum *context_datum = NULL; + int rc = SEPOL_ERR; + + if (ibpkeycon->context_str) { + rc = cil_resolve_name(current, ibpkeycon->context_str, CIL_SYM_CONTEXTS, extra_args, &context_datum); + if (rc != SEPOL_OK) + goto exit; + + ibpkeycon->context = (struct cil_context *)context_datum; + } else { + rc = cil_resolve_context(current, ibpkeycon->context, extra_args); + if (rc != SEPOL_OK) + goto exit; + } + + return SEPOL_OK; + +exit: + return rc; +} + int cil_resolve_portcon(struct cil_tree_node *current, void *extra_args) { struct cil_portcon *portcon = current->data; @@ -3567,6 +3591,9 @@ int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args) case CIL_FILECON: rc = cil_resolve_filecon(node, args); break; + case CIL_IBPKEYCON: + rc = cil_resolve_ibpkeycon(node, args); + break; case CIL_PORTCON: rc = cil_resolve_portcon(node, args); break; diff --git a/libsepol/cil/src/cil_resolve_ast.h b/libsepol/cil/src/cil_resolve_ast.h index 1175f97..0506a3d 100644 --- a/libsepol/cil/src/cil_resolve_ast.h +++ b/libsepol/cil/src/cil_resolve_ast.h @@ -74,6 +74,7 @@ int cil_resolve_constrain(struct cil_tree_node *current, void *extra_args); int cil_resolve_validatetrans(struct cil_tree_node *current, void *extra_args); int cil_resolve_context(struct cil_tree_node *current, struct cil_context *context, void *extra_args); int cil_resolve_filecon(struct cil_tree_node *current, void *extra_args); +int cil_resolve_ibpkeycon(struct cil_tree_node *current, void *extra_args); int cil_resolve_portcon(struct cil_tree_node *current, void *extra_args); int cil_resolve_genfscon(struct cil_tree_node *current, void *extra_args); int cil_resolve_nodecon(struct cil_tree_node *current, void *extra_args); diff --git a/libsepol/cil/src/cil_tree.c b/libsepol/cil/src/cil_tree.c index 2cc2744..89706d0 100644 --- a/libsepol/cil/src/cil_tree.c +++ b/libsepol/cil/src/cil_tree.c @@ -1,6 +1,6 @@ /* * Copyright 2011 Tresys Technology, LLC. All rights reserved. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * @@ -1409,6 +1409,20 @@ void cil_tree_print_node(struct cil_tree_node *node) return; } + case CIL_IBPKEYCON: { + struct cil_ibpkeycon *ibpkeycon = node->data; + + cil_log(CIL_INFO, "IBPKEYCON: %s", ibpkeycon->subnet_prefix_str); + cil_log(CIL_INFO, " (%d %d) ", ibpkeycon->pkey_low, ibpkeycon->pkey_high); + + if (ibpkeycon->context) + cil_tree_print_context(ibpkeycon->context); + else if (ibpkeycon->context_str) + cil_log(CIL_INFO, " %s", ibpkeycon->context_str); + + cil_log(CIL_INFO, "\n"); + return; + } case CIL_PORTCON: { struct cil_portcon *portcon = node->data; cil_log(CIL_INFO, "PORTCON:"); diff --git a/libsepol/cil/src/cil_verify.c b/libsepol/cil/src/cil_verify.c index 47dcfaa..108da33 100644 --- a/libsepol/cil/src/cil_verify.c +++ b/libsepol/cil/src/cil_verify.c @@ -1080,6 +1080,26 @@ exit: return rc; } +int __cil_verify_ibpkeycon(struct cil_db *db, struct cil_tree_node *node) +{ + int rc = SEPOL_ERR; + struct cil_ibpkeycon *pkey = node->data; + struct cil_context *ctx = pkey->context; + + /* Verify only when anonymous */ + if (!ctx->datum.name) { + rc = __cil_verify_context(db, ctx); + if (rc != SEPOL_OK) + goto exit; + } + + return SEPOL_OK; + +exit: + cil_tree_log(node, CIL_ERR, "Invalid ibpkeycon"); + return rc; +} + int __cil_verify_portcon(struct cil_db *db, struct cil_tree_node *node) { int rc = SEPOL_ERR; @@ -1452,6 +1472,9 @@ int __cil_verify_helper(struct cil_tree_node *node, uint32_t *finished, void *ex case CIL_NODECON: rc = __cil_verify_nodecon(db, node); break; + case CIL_IBPKEYCON: + rc = __cil_verify_ibpkeycon(db, node); + break; case CIL_PORTCON: rc = __cil_verify_portcon(db, node); break;