From patchwork Wed Jul 26 20:02:55 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jann Horn via Selinux X-Patchwork-Id: 9865769 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A4D3E602B1 for ; Wed, 26 Jul 2017 20:04:22 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 979C3287BA for ; Wed, 26 Jul 2017 20:04:22 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8B772287AD; Wed, 26 Jul 2017 20:04:22 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.7 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RCVD_IN_SORBS_SPAM autolearn=ham version=3.3.1 Received: from ucol19pa13.eemsg.mail.mil (ucol19pa13.eemsg.mail.mil [214.24.24.86]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 71A95287AD for ; Wed, 26 Jul 2017 20:04:21 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.40,416,1496102400"; d="scan'208";a="498146575" Received: from emsm-gh1-uea10.ncsc.mil ([214.29.60.2]) by ucol19pa13.eemsg.mail.mil with ESMTP; 26 Jul 2017 20:04:19 +0000 X-IronPort-AV: E=Sophos;i="5.40,416,1496102400"; d="scan'208";a="469752" IronPort-PHdr: =?us-ascii?q?9a23=3A76du2xGDVE79TOy4DngdRZ1GYnF86YWxBRYc798d?= =?us-ascii?q?s5kLTJ79psS4bnLW6fgltlLVR4KTs6sC0LuG9f2/EjVcv96oizMrSNR0TRgLiM?= =?us-ascii?q?EbzUQLIfWuLgnFFsPsdDEwB89YVVVorDmROElRH9viNRWJ+iXhpTEdFQ/iOgVr?= =?us-ascii?q?O+/7BpDdj9it1+C15pbffxhEiCCzbL52Lxi6twXcu8sZjYd/Jas8ywbCr2dVde?= =?us-ascii?q?hR2W5mP0+YkQzm5se38p5j8iBQtOwk+sVdT6j0fLk2QKJBAjg+PG87+MPktR/Y?= =?us-ascii?q?TQuS/XQcSXkZkgBJAwfe8h73WIr6vzbguep83CmaOtD2TawxVD+/4apnVAPkhS?= =?us-ascii?q?EaPDE36mHXjtF7grxdrhyvuhdzx5fYbJyJOPZ7eK7Ses8XSGRdUspMTiBNHp6w?= =?us-ascii?q?ZJYLA+YcPetUqo/wrEYMoxSjHwmhHP3hxDFLiHHx36I63esuHw7b0gw4Hd8CrX?= =?us-ascii?q?rZotXvNKgMSuC417XEzSzZYv9Kwzrx9JTEfxY8qv+MR7Jwds/RxFExGQPCi1Wb?= =?us-ascii?q?tJLoPzOL2eQXqWia7/drVfyui2E9tgp/vyagxsMtionPm4IUxU3P+CJiwIkrId?= =?us-ascii?q?24SUh7YcOrEZZLqyGbN5d5QsMlQ21yviY60acJtYS0fCgN1pQq3hjSYOGEfYiQ?= =?us-ascii?q?+h/vSemcLDhiiH9lZb6znQi+/Ee+xuHmS8W4yFRHoyVfntXRqHwA1wbf58uJR/?= =?us-ascii?q?dn8UqtxzCC3B3J5O5eO0A7j6/bJoYkwr43i5Ucr1zOHjTzmEXqlK+WcVgk+vSw?= =?us-ascii?q?5+TnfLrmopicOpdoig7kKKQum9G/Af8iPggSX2mU5eS81Lr58U3/XLpKleE5nr?= =?us-ascii?q?PcsJDbIcQXvq+5AwlL3YY/8xuzEjir3dsCkXQHMV5JYgyLgof3N13UPfz0FfK/?= =?us-ascii?q?jE6tkDdvyfDGJLrhApDVI3jYjrjhebd960hByAs81NxQ/JVUCqwHIP3vREDxr8?= =?us-ascii?q?fVDgM5MgOow+bnD89x1oUFWW2VGKOZP6TSsUGQ6uI1P+aMfJMVuCr6K/U95f7u?= =?us-ascii?q?ink5lkUBfampx5QXbmu1HvZhI0WfZHrjmMwBEXsUsQokV+zmklqCUSRcZ3yqRa?= =?us-ascii?q?Iz+ik7CJ66DYfEXo2tgr6B0z2nEZ1VfWBGDVaMEXb2d4ifVfcMbD+SI8B6nTwZ?= =?us-ascii?q?U7ihV5Ih2QuptA/gxLptNvDU9TEAtZL/yNh14PXelB8z9TxwCsSSzXuNQnp6nm?= =?us-ascii?q?wWWjA227p/rlZlyleZ1qh4geJXGsBP5/9TVQc6L5HcxfRgC9/uQgLBYsuJSFG+?= =?us-ascii?q?T9q7HT4xS9Uxw9kSY0pgANiikA7M3zCrA74UkLyLAoY48qTC0HjtP8x90WrJ1L?= =?us-ascii?q?E9j1k6RctCLXCphrJl+AjJHIPGj0KZl6O2eqsGxy7N6H2PzWyQs0FESARwS7nK?= =?us-ascii?q?XWgDZkvKqtT0/kPDTr6pCbQhKQZBzMqCJrJLat3vl1lGQu3sOM7dY2KwhWe/Gw?= =?us-ascii?q?yExrWSY4r2Y28dxjnSCFAYkwAP+naLLRYxBj+7rGLEDTxuDkniY1v2/ulkqXO7?= =?us-ascii?q?VVc0zwWQYEJ9ybW54BkVheaTS/kLxLILpD8hqyloHFa6x9/WBcCAqBBnfKpAYN?= =?us-ascii?q?M9+0xK1WfBtwx8J5CgNK5jhkUEfwRwpUPu2A19Cp9cnsgysHMq0A1yJLqb0Fxb?= =?us-ascii?q?dDOY2o3wN6bUKmbo/xCvbLPW1kvZ0NaM9acF8O44pEn7vAG1Ckoi9G1q3MNI3H?= =?us-ascii?q?uG55XFEhASXInrXUkr8hh2vbbaYjMy54nMz31jLbG0siPe29IuHOYl0AuvcMpE?= =?us-ascii?q?PaOLEQ/zHNcWB86wJ+w2g1KpdA4LPPhO9K4oOMOrb+CG2KCxPOZnhzKmkX9K4J?= =?us-ascii?q?t70kKL+St8T/TH35Afz/GewASHSy/2jE29vcDvhYBEeTYSE3KxyCf+AI5RerN9?= =?us-ascii?q?fZwQCWq1Pc242M9+iIXwW35d7lKjAEkG2MCxcxqIc1P9xRFQ1VgQoXG/hSu30i?= =?us-ascii?q?F7kzAzoaqbxyHB3+PidB8bNWFRX2likU3gIY6qgNAGREKodRQmlAO55UbmwKhW?= =?us-ascii?q?vKJ/L2jXQUdMYSf2NHpvXbGuubqYZM5D8pQosT9YUO6ke1CVVqb9owcG0yPkB2?= =?us-ascii?q?Ze2jE7eC22upX+hRx2kn6SLHZ0rHrfdsF93hPf5N3aRfFLxDoGQzN0iT7NBliz?= =?us-ascii?q?J9Op58mbl4/fsuCiUGKsTplTcSjwzYOcrSe7/nNlARm+n/C1h93mHhM30TTj19?= =?us-ascii?q?lrUyXIrQrzYpLx26S8L+1nYlFiBEXg5MpiBoF+jowwiYkK2XgdgpWV+WQIkX3v?= =?us-ascii?q?PtVc16Pzd2ENRSMXzN7O+gTl31djLn2RzYLjSnqd2tdhZ8W9Ym4OwiIy9d1KCK?= =?us-ascii?q?OO4LNehyd6uV24rQbNYfh6mDcQ0v4u5GIcg+EOpAUh1COdDa4OHUNAJyzjiwyI?= =?us-ascii?q?78yirKVQfGuvcqa/1Exlnd26D7GNvAdcWG3/epg8AS989MJ/MEjD0Hfr8IHrZM?= =?us-ascii?q?HQbc4Pth2TixrAl/JaKI81lvUUnSpoI2T9vWE7xO4hlhFuwIq6s5adK2V25q65?= =?us-ascii?q?GRlYNiDvZ8wP5D7tg6FentyZ34+xBJlhHCsEXIfwR/KyDD0SrejnNxqJEDAktH?= =?us-ascii?q?ebH6fQEBSB6Edgsn3PE4qnN3eJK3kF1d9iXgWSJFRDgAAIWzU3hoY5GRq3xMzl?= =?us-ascii?q?a0p2+jER5kL4qxdVxOJnLR//Xn3YpAeyZTc+UIKfIwZO7gFe+0fVNtST7uxpEC?= =?us-ascii?q?Fe4p2hqwmNJ3eVZwtWEG4JXVaECEr7Prm04tnA8faXCfaiL/fUZrWOs+NeXe+S?= =?us-ascii?q?xZ2zyotm4yqMNsKXM3lnFfI73k5DUm5lG8TFgToAUTcalyTTYM6Hvxez5jd4rt?= =?us-ascii?q?ih//jxXgLg+5ePAaNIMdpz4xC2nbuDN+mIiSZjMzpZ2IkAxXrSx7gb214Tizpj?= =?us-ascii?q?eCOxHrQFryLNS7jQmqBPBR4BdyxzLNdI77473gRVN87bkM362aNjjvEvDVdFSV?= =?us-ascii?q?vhmtqyaMMQP269MUnLBEGRNLSJPTfL2d34YbugSb1Mi+VZrxuwuSyBHE/7JjSO?= =?us-ascii?q?jDfpVxG1MeFXkCGbMh1euIenfRZrFWfjTcjpahmhPN9wlz02zqU+hmnWOm4ELT?= =?us-ascii?q?h8b0RNo6WI7SxGmfpwBWpB7nt5LemDgCuZ7vfXJYgIvvdxBSR0je1a6mwgy7RJ?= =?us-ascii?q?9CFEWOB1mCzKo9FzuFGpjPOAyjV9UBVUtDZGn5mLsl9hOaXE7JlPQ2zI/BYQ7W?= =?us-ascii?q?WWERsKvcJpCsHou6BTytnPk7j/KDFc/NLI5cEcHdTbKNqbMHo9NhrkACXUAxEb?= =?us-ascii?q?TTGxOmHQmVddneqJ9nKPsJg1sJfsl4QVSrNBUlw6CO8aAFx/HNMeOJd3Qi8kkb?= =?us-ascii?q?mDgcET5Hq+ox7RRMNBs5/aSP2dGvTvJyyfjbVeYBsI27z4J5wJNoLnw0xidkV6?= =?us-ascii?q?nIPSFkXKUtBCuDNhYREvrUVK6HhxUGsz20f/ZQOs5H8cDvm0nxEshgt5e+Qt+y?= =?us-ascii?q?/m400rKVrSuCswjE4xlM35gTCWdT79Nr2wXYZXCiXqsUg+KYn7QwFrYg2xhkFr?= =?us-ascii?q?KDDER7dNgLR6bmBrlBXQuZ1RFv5AVadEegMfxemLZ/U01lRRsianxE9D5eTbEp?= =?us-ascii?q?ZikQwqcZCir31exwJjcN41JavVJKVX1FRQgLyBvjOw3OAr3AAeP1oN8H+VeCMQ?= =?us-ascii?q?vkwHKKMpJy6z8+xv7gyCgCdDd3IKV/oxofJq91kxO+KewCL8y7RDMFy+N/SDL6?= =?us-ascii?q?OFvGjNjdSITU0r1kwWjUZF56R50cc4fkWPVkAv1qaeFxMHNcraMwFaccpT+GLV?= =?us-ascii?q?fSmQreXH2Yh1MJmlFuD0Ue+Os74ZjV+jHAYvGYQD89oOHp2t0EzDN8joMqQFyR?= =?us-ascii?q?I36ATsPlWFA+xDeAiXnzcfv8G/0Jh30JFAKT4HH2V9MDi45q3MqwAwmvqDRtA2?= =?us-ascii?q?Y3kBXoQaKn02Rde6my9Fv3VAFjW31PwWyBSa5T/muivQFCX8b8ZkZPqMYRNsD8?= =?us-ascii?q?u29is586m3jl7a6ZreJ2fnNdh4vd/P8+warY6dC/xIVbl9r1vcm45ASnyxTWHP?= =?us-ascii?q?Fd+1J57ta4gjdtH7FnG6UlmjhD0vVMfxIMyhLq6WjgH0XYxUqpWU3Cg/Nc+hET?= =?us-ascii?q?ETAxRwp/sD5a1mYw0Df5o7bAXntwQ5L6ywPB2U0tOwTGaxMTFWVeVQzf2mZ7xL?= =?us-ascii?q?yCohdvO6yHolTpE90+m38U4MSYoXgRHfxfesfZJRXTL1GnNDZwXFvTA5mHR5Nu?= =?us-ascii?q?Yu3uc/xwvFvkMYMzCKaONmdnRLv9Q8BFOUJnV2DHA3SkSHgorC+AGs2ake/yVA?= =?us-ascii?q?n9pO1+1KrmT+tIfFYD2wQKyrtYnVsy04YNc9vaJxN5fuLdGbu5PAgDPfVoLQvR?= =?us-ascii?q?efUC+6DfZancJQIC1ASvlShW4lIdAGuZZG6UcpWcc+Or1PCK0opr+0bDppFjMd?= =?us-ascii?q?wjECWIOBxjMChP2w27zAlhefaJ4iKgALsI1egtsBVC57ejkepKmiV4rKl2+ETW?= =?us-ascii?q?wLIBwL4wpV+QwOjJN9cOf+7YXUS59MziJZrOhvUivXDJVo8UX0Sn2Oi1jiVPqh?= =?us-ascii?q?i/Cp3R5VzP/0yNkUQgR/CU9GyOtNiksoMqt4K7cOsY7Osz+Ic0z6vGbsyOupJF?= =?us-ascii?q?lR1cPUeEfiDIrAr2b8VDMT+WEMT49V1H7fDYgSkxZ+aKszqlRAOpypekb/5zwh?= =?us-ascii?q?xoRmBbq4WNuqx1k7s3kJWT2mE91bC+FpqFjXQiFqY4i3qJX5PJVfWnVf+IeAq1?= =?us-ascii?q?dfikltMDW0yZtdK8FM/j4DRyJDoTODs9uuUMdDw9N5D4cQItdjvHfwAKJEOJ6N?= =?us-ascii?q?o3Iovrzg1HrZ9C4gsFegxDS+AKi4T/pH8G0YHwUmPWWeqk00AOsr/Wbe6FfNsk?= =?us-ascii?q?p7/+1DHLiAkV1xoCphHpBJHjtJ2mqlIE51THlaqOhaKaPVcsJaQ/kuZR+gJR0+?= =?us-ascii?q?Ffg630OX50F4h3H5bDJutgFC4SDSQxE0VTUJgrfqgTAetsanOToBRpJUcTkhaj?= =?us-ascii?q?zKJxidmS9JoBZVc1tqVIwBAtZZ57Eb2pNZ/srYRka2My4FWAFtOxkl3vVBjU5D?= =?us-ascii?q?qFuXeSTDAgqyb/rPtQd3fciJps6zMPv55BtHip/gsO0g9aUDQGOplBawTt/AtI?= =?us-ascii?q?/zqMeKtleQe6jlKeG8Z2HOTCTUhxCqmbgkF4XK/zTUMAdDMJZ6x2YrbYTjBGLW?= =?us-ascii?q?MxlLPL4UJ01eVa9mc9pGufxaa9VieKkX5a9nHgiHSQ/3GIyzsPlGKU7eRS7AIC?= =?us-ascii?q?qc8uywu57T4KfZSejneMyD2WjLTL5wPphn9zb3AbHq3pFC+kDuwPdi6lt6SUTa?= =?us-ascii?q?MyCGtNnhPhgL5NW4eUT/op0kBijWAJBtkHr32k5PacwXQzGw8JsCzJNV8nHwSf?= =?us-ascii?q?h30kLrqu1d66Fk6ZUr47Bu0cq0Ob3SJupEvkB6GRWUGwFq9ok3AGdlWWBRY+gR?= =?us-ascii?q?KPPPcqQFl8zurPr3F6MP4h2P5+NZccfHJ13GmsSnCDGTUwZEnAAaqT4eNAScye?= =?us-ascii?q?WIm6ppScahuej5214i41mkIR4A17Bh/4CE+rCHpOXPdRve0aAEWrT2RsP0trks?= =?us-ascii?q?uVmd5fsqlL4UfWx6fhOoHfMBVsEHwGfg1qcqwTgqE8zdA7Lq4ORDWG4hnjL8h5?= =?us-ascii?q?B9GE0bGvUQHbeQ/IRemGI4l/bYNt0QfKBCgHyAFQW4Er8Y1H6k9zeXIHR/gh7Q?= =?us-ascii?q?yR3wRnmz7FDupy9iXSTM18vjklZSVrSvA0dSXjamOUh8sDyVJwrkrtv3uaMy7E?= =?us-ascii?q?EtKWzpr9eNmWSuOb9NGM3/PtOcKzEupF0LlJ0xWsCv2YcDFNWhOtgR9G9xbuDC?= =?us-ascii?q?62KrlC9MuLxHiJbf4s6L/PXXAXiggLeAp7WL2j9Y1mAyvUsj5dC4KvHO+9qKTu?= =?us-ascii?q?ys12YKSidyuxDMXxCrpbPGqFAUI1aE0F/RmIwNPNFWw2U31l386OgkWtIz+x1U?= =?us-ascii?q?FpzcaPMauTDzJDz0zE6dY9I2UymTyD5XEUz1EFZmAqg82WTwvM3TmXfW5VIoWp?= =?us-ascii?q?F6d1b7ihxvE4U4NUUt5UAWwisCCwcCcwyUAaqzBUv7MYsLS1QMZQ6A3Ligdac9?= =?us-ascii?q?xVdzza+35O/Pcex8ALIAOe1cjg6VkllUAJAWsawCQLJkYVBd6arXqxP+BIjgQv?= =?us-ascii?q?fpi2A/NeCvQsBd68AWrWEu4gGlRxqv8Z1D9aoUiIiUdq5YZpjBpNh84F175TET?= =?us-ascii?q?dixMjh9/jwm6UewFv+Ds/NzbsJuu6uazW6cgXP0X+AIoB2tij5vxjlcjocvU1+?= =?us-ascii?q?tGSY3al57/8AZTLH6Ooora1AN8KeUWIYKxYLlg72kHJzQZJ38WIdqWcecz4yt3?= =?us-ascii?q?PzXV+VNPGd4DZdIXPMrMhQBbkFbpV6tJ9srGAFOYDZl8d9ww5Wrt1D816Yc8Uv?= =?us-ascii?q?rn6DKuKpDQ9UtNMO1fjCVsj9/CoOkVwebMBygX+3aZdgN1zjmEy5aTF/b65f+M?= =?us-ascii?q?x83MV1MaAi42VJ9QJDWc9gyhWuq1k5LpXgSP6sDthJI+dUSQRmG+naketqZDD/?= =?us-ascii?q?RAiyXh0TREEID6me6VucK26GRLrl1HDJpz7RrdFapDPJV0Iwj3m9K3SUh7Aiv/?= =?us-ascii?q?fMDUeQQ0uOqK2OgD/+V+O1H5ZY8BLRIO06j65mZNTgtyVL72uU6UXecWZNtgVP?= =?us-ascii?q?PEoW5a5JllK68OJledooLlritGqVAxGg8pa6QwoiZcdkbQgA1fQ7z0t6IYigsA?= =?us-ascii?q?Td55vldBGW2sN2Il/DrLTLlbgqaXBvwU9DWTU6MPXl5nMiN7WRy13othd6Gunf?= =?us-ascii?q?BdvWNMhjl9r+Qy0zx6WBu8vjXhp6AK2TIg/rG0rikOuXxBTuWDjijJCFRDzPIR?= =?us-ascii?q?jacfCnbv8kK8YHgdbITo5LloOMXg+ZMn43shfRUpZzcGUvi4CyHsk6OIBZSCsN?= =?us-ascii?q?NChBGXvsXDdruzLTUPObQ8zhLjXGJx0g/EnBZn6GELWCmv7Mc4JIWhPsYo3iio?= =?us-ascii?q?FnbVdFYC5qNEq8XwukQNTOQodVNt2mNj3dabRicVXszAB341jhQ4aWVDaJ9D5h?= =?us-ascii?q?saF64mgzmWuqlG+hoZYCzTEoSj+4nfgd3E2X8jQtd23mjWvLGKhos20H15nNN5?= =?us-ascii?q?9iyOuHQSduzAVM9sBnnz1ptBxuHlYvWts/wHSJF4x7i7V/8CKMaj83Os2Jp2Qk?= =?us-ascii?q?+l2qgeH12hPe8fx7fbVjyoSXGZWeuXcGiDgTI5PlT05Ra2Ml09cN1KoFMlMuve?= =?us-ascii?q?mp5ckBXsUbZ1RiWTpl/by3cuMeEAeAI1v4enfRIFTOgLa+iaO+cu3OU0CEEQYH?= =?us-ascii?q?/RASt2F+i2vEa2k4dlPXVg/V73Yf/p8gDhLNuSBgcEHpDHoZJr/vy6XG2BM2d6?= =?us-ascii?q?zBJuJEl06/vfF1Mpu+9EdJaRmcLfh8510O4Cc/dtPzYwutsUmoJk8ombztuFcQ?= =?us-ascii?q?vWzpbpPtHVo/6YA/LFw0QtYGFaXaITYRnp6IUiIt45R7rTEKNXvRsCAag6QYQh?= =?us-ascii?q?OHnq+aB1LQNzdwvRa6qugsnuuO2HfJxUp2XZ7lgoNifTpwUDyuCoTQx8d52riW?= =?us-ascii?q?3yIIoxRj1dsdJgER5mHIpTG8MasQWrGZmUmLu0i9Wp4UN1p/cKsbbsCvDNzNm5?= =?us-ascii?q?2IFxUIZB6EyTODbeHrJrglhkjuuunvfAyIf+Bt34ddMCSud7XnbPaqXaEYWnNj?= =?us-ascii?q?KOJsX8dlZC876d1rJ5TxqQaDn9X6qHry2kKO5k7F46yoNieurTyyYh77bB2Nv9?= =?us-ascii?q?f2tbvDusrWaVNJtD61zHHffeUAxQSfqE9mZlAKIWYYz7+ucSMdwt3sKc7Bdr7D?= =?us-ascii?q?tYy8aFILaurlXK2k1lcZLUN1bp2ykjVYkNOhS/PlMmgXXFpXTFHXRcMs+kJNFo?= =?us-ascii?q?gNmPEhPt50hxmWcqZmNaBGroRNGRNnYf28K/Yg2K6Q1KA8wEn+6tdk4yrreyRv?= =?us-ascii?q?VwOpVZheWqs60KkdRzJCHMQ8hVJDrdLKJwPjpNDuXPo0UoYhEEs7gpQIs1Y4aB?= =?us-ascii?q?IF8fOkea1Szy1RfC0VHzd9G0z6mGOyEa8nFGz7LezThMvBO1ue2HjcL/SrzZd4?= =?us-ascii?q?/5XPrTMCojSzGbSi8/Hlqp+Fe+pvoEp+CUIGkFrVAIeSKSDwgTqrpordjKAW/Z?= =?us-ascii?q?gfdjc4EShPCGRyDwTzV1lKg3BiZMr0CMWfsDFRLNYn/nmmVcvRKtJv5W8XLidb?= =?us-ascii?q?2YybJfW/YKDYtUbv2ZX9zYdOhFJzcmkzUWJOexct7HorYnzF3IV2oZEqjP9F2Y?= =?us-ascii?q?VkKWROKTxy64FbkS6pM5visu58L4gj58E6OOOa2W4TGp7N2CgT6cqNHZA1UqZg?= =?us-ascii?q?QegO8YGnjJlAVHLWoEBssPqWniRamPY0sK33Us37FAwRgJLTh0VzVF0nBMhuf1?= =?us-ascii?q?BMxQAWUZiGKoXe1OOEt6CDI24F+i/hz5YdtGv9vaAWBZ6O1fGsImMPA05dyPa+?= =?us-ascii?q?Mry/Ez0Wc7rQ=3D=3D?= X-IPAS-Result: =?us-ascii?q?A2APAgD99HhZ/wHyM5BdGQEBAQEBAQEBAQEBBwEBAQEBFAE?= =?us-ascii?q?BAQEBAQEBAQEBBwEBAQEBgwQrgVGPJqcPixJXAQEBAQEBAQECAWoogjMMgloDA?= =?us-ascii?q?wECJFUDCQEBEgUxCAMBMAEFARweiAkMAUKBUgOkfj+NdjoiAoRLhmMmEoMWhS6?= =?us-ascii?q?OCwWRcY1qixqIew2LICiGcAJIk2AzgRVXgQooDB8qD4FbGoNqHIIHiggDAQEB?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by EMSM-GH1-UEA10.NCSC.MIL with ESMTP; 26 Jul 2017 20:04:18 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v6QK3km8009512; Wed, 26 Jul 2017 16:03:53 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id v6QK3hI9025456 for ; Wed, 26 Jul 2017 16:03:43 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v6QK3g4l009510 for ; Wed, 26 Jul 2017 16:03:42 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A1AqAQBl9HhZfSMaGNZdGwEBAQMBAQEJA?= =?us-ascii?q?QEBgy8ogVQnjgxzpneBMwNchUcCg08/GAECAQEBAQEBARMBAQkWCIEZDgGESAM?= =?us-ascii?q?DJxkBATcBD1E0AQUBHIgzAUKBUgOkfz+LH4JXOoMIAQEFiDcBAQEBAQUBAQEBH?= =?us-ascii?q?AgSgxaBMoIbgWGILIVfkXaNaoVehTyIew2LIIcaSJNgM4EVH4FCUySFZQ8cGYF?= =?us-ascii?q?uVoEWiB8BAQE?= X-IPAS-Result: =?us-ascii?q?A1AqAQBl9HhZfSMaGNZdGwEBAQMBAQEJAQEBgy8ogVQnjgx?= =?us-ascii?q?zpneBMwNchUcCg08/GAECAQEBAQEBARMBAQkWCIEZDgGESAMDJxkBATcBD1E0A?= =?us-ascii?q?QUBHIgzAUKBUgOkfz+LH4JXOoMIAQEFiDcBAQEBAQUBAQEBHAgSgxaBMoIbgWG?= =?us-ascii?q?ILIVfkXaNaoVehTyIew2LIIcaSJNgM4EVH4FCUySFZQ8cGYFuVoEWiB8BAQE?= X-IronPort-AV: E=Sophos;i="5.40,416,1496116800"; d="scan'208";a="38282" Received: from emsm-gh1-uea10.ncsc.mil ([214.29.60.34]) by goalie.tycho.ncsc.mil with ESMTP; 26 Jul 2017 16:03:42 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3A1jeRNRELVgMYnW1Rk94bvJ1GYnF86YWxBRYc798d?= =?us-ascii?q?s5kLTJ78pcuwAkXT6L1XgUPTWs2DsrQf2rqQ7v+rADBeqb+681k6OKRWUBEEjc?= =?us-ascii?q?hE1ycBO+WiTXPBEfjxciYhF95DXlI2t1uyMExSBdqsLwaK+i764jEdAAjwOhRo?= =?us-ascii?q?LerpBIHSk9631+ev8JHPfglEnjSwbLdxIRmsrQjctMYajZZtJ6sw1xDEvmZGd+?= =?us-ascii?q?NKyG1yOFmdhQz85sC+/J5i9yRfpfcs/NNeXKv5Yqo1U6VWACwpPG4p6sLrswLD?= =?us-ascii?q?TRaU6XsHTmoWiBtIDBPb4xz8Q5z8rzH1tut52CmdIM32UbU5Uims4qt3VBPljj?= =?us-ascii?q?oMOjgk+2/Vl8NwlrpWrg+hqRJhzYDaY4abO/hwfqzSct0XXnZNXt9LWiBdGI6w?= =?us-ascii?q?c5cDAuwcNuhYtYn9oF4OoAOgCwmrAePk1yFFhn/o0q0gyeQgERzN0Qs8H9IJtX?= =?us-ascii?q?TbsNX1O7kIUeCvzKjF1jrDb/RR2Tfy7IjHbAotru2LXbJ1aMfcz1QkGQDdjliI?= =?us-ascii?q?t4DpIjyY2v4Tv2WU9eZsS+Oih3QppgxxujSixMghhpPUio4Lyl3I7yZ0zYgvKd?= =?us-ascii?q?C3VkJ2Z8OvHoFKuCGALYR2R9svQ2F2tyY+zb0LoZC0cjUKxpk62hLSb+aJfpSU?= =?us-ascii?q?7h/iTuqePyl3hHd+eLKwnRqy9FKvyuz4VsWu1VZKry5FnsHNtnALyRPT9tCKRu?= =?us-ascii?q?Vg8kquwzqDyQ/e5vtaLU01j6bWJZ4szqY1lpUJsETDGiH2mF/xjK+Tbkgk5u+o?= =?us-ascii?q?6+H7bbXmuJCcLZV0iwHlP6Qhncy/Bus4MgwQUGSB5eu807jj8VXjQLpWlv02jr?= =?us-ascii?q?XZsJfCKMQAuKG5Bw5V0oA+6xewFDqmzNQZkmUHLFJCYh6HiZPpNEvULPD3Cve/?= =?us-ascii?q?nQfkrDA+3P3CP7v8Er3RP3PDl/HnZr875ElCmyQpytUK25VRQpoBLejpSwelqN?= =?us-ascii?q?vdBR80KRal6+ngD9p528UVXmfZUfzRC7/brVLdvrFnGOKLfoJA4Ds=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DLAgD99HhZfSMaGNZdGwEBAQMBAQEJA?= =?us-ascii?q?QEBFgEBAQMBAQEJAQEBgwQogVQnjn+oKgNchUcChCYBAQEBAQEBAQIBEgEBCRY?= =?us-ascii?q?IV0IOAYFiIoJEAwMnGQEBNwEPUTQBBQEciDMBQoFSA6R+P4sfglc6gwgBAQWIN?= =?us-ascii?q?wEBAQEBBQEBAQEBGwgSgxaBMoIbgWGILIVfkXaNaoVehTyIew2LIIcaSJNgM4E?= =?us-ascii?q?VgWFTJIVlDxwZgW5WgRaIHwEBAQ?= X-IPAS-Result: =?us-ascii?q?A0DLAgD99HhZfSMaGNZdGwEBAQMBAQEJAQEBFgEBAQMBAQE?= =?us-ascii?q?JAQEBgwQogVQnjn+oKgNchUcChCYBAQEBAQEBAQIBEgEBCRYIV0IOAYFiIoJEA?= =?us-ascii?q?wMnGQEBNwEPUTQBBQEciDMBQoFSA6R+P4sfglc6gwgBAQWINwEBAQEBBQEBAQE?= =?us-ascii?q?BGwgSgxaBMoIbgWGILIVfkXaNaoVehTyIew2LIIcaSJNgM4EVgWFTJIVlDxwZg?= =?us-ascii?q?W5WgRaIHwEBAQ?= X-IronPort-AV: E=Sophos;i="5.40,416,1496102400"; d="scan'208";a="469712" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from uphb19pa03.eemsg.mail.mil (HELO USFB19PA06.eemsg.mail.mil) ([214.24.26.35]) by EMSM-GH1-UEA10.NCSC.MIL with ESMTP; 26 Jul 2017 20:03:40 +0000 X-EEMSG-check-005: 0 X-EEMSG-check-006: 000-001;db8d37c0-2036-4e97-be41-e3fb5d47b197 X-EEMSG-check-008: 384495608|USFB19PA02_EEMSG_MP18.csd.disa.mil X-EEMSG-SBRS: 2.7 X-EEMSG-ORIG-IP: 74.125.83.42 X-EEMSG-check-002: true X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0DgAAC88XhZfypTfUpeGwEBAQMBAQEJAQEBgy+CI44Mp2qBMwNchUcCg08/GAECAQEBAQEBARMBAQkLCwgmMUIOAYRIAwMnCwENAQE3AQ9RNAEFARyIMwFCgVKkdT+LH4JXOoMIAQEFiDcBAQEBAQUBAQEBARsICQEIgxaBMoIbgWGKbQyDEpF2jWqFXoU8iHsNiyCHGAJIk2AzgRUfgUJTJIVlDxyCByA2gRaIHwEBAQ X-IPAS-Result: A0DgAAC88XhZfypTfUpeGwEBAQMBAQEJAQEBgy+CI44Mp2qBMwNchUcCg08/GAECAQEBAQEBARMBAQkLCwgmMUIOAYRIAwMnCwENAQE3AQ9RNAEFARyIMwFCgVKkdT+LH4JXOoMIAQEFiDcBAQEBAQUBAQEBARsICQEIgxaBMoIbgWGKbQyDEpF2jWqFXoU8iHsNiyCHGAJIk2AzgRUfgUJTJIVlDxyCByA2gRaIHwEBAQ Received: from mail-pg0-f42.google.com ([74.125.83.42]) by USFB19PA02.eemsg.mail.mil with ESMTP; 26 Jul 2017 20:03:06 +0000 Received: by mail-pg0-f42.google.com with SMTP id 123so88461251pgj.1 for ; Wed, 26 Jul 2017 13:03:05 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=pdQBTlfugYnrc6cCfEd4n1ZkUaldelKhzLemN8gVpI4=; b=nY+bCME2lPT276ZJvMcj8pCslKCtZN/sfPeaoSAUIuEhM5GK0QPJddOatZxvsWUQZq X+qNanArmZ72xLCB4wwaIUsoead2qLBcpyDcnX3wAPJLUPOPv3scsYXVafm7N86aAuEO JrjUhZUtBBTBw6Xax5psI1xRvvPWXDdLVbmWu/pCQJNYqlhTuIsplMK4LZzHelmOMCcF 1a4JgPfcJQTgSM3li5VBhbrmk2QZ+O/ZIRi5LO9VM6rqnFmhAbXPHMSdr9Gh7AFfXNZx rFeb80YXqPd6xvVrb6hC10ruVJKEtQuNSJU0MbropbosJ8DBW2QuPfvSRleZTyHE5S8C S8Rg== X-Gm-Message-State: AIVw110AWOsX5faNNQX4liPhAGr252bI/rNOLa7ZarYNJlw4dOEFHZO/ q0lJ6n4sTeuVojD5Lg3QmQ== X-Received: by 10.84.209.227 with SMTP id y90mr2021579plh.446.1501099383086; Wed, 26 Jul 2017 13:03:03 -0700 (PDT) Received: from tomcherry-gbuntu.mtv.corp.google.com ([172.22.120.118]) by smtp.gmail.com with ESMTPSA id s14sm33450677pfj.124.2017.07.26.13.03.01 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 26 Jul 2017 13:03:02 -0700 (PDT) To: selinux@tycho.nsa.gov Date: Wed, 26 Jul 2017 13:02:55 -0700 Message-Id: <20170726200255.11640-1-tomcherry@google.com> X-Mailer: git-send-email 2.14.0.rc0.400.g1c36432dff-goog In-Reply-To: <1501075565.8507.4.camel@tycho.nsa.gov> References: <1501075565.8507.4.camel@tycho.nsa.gov> MIME-Version: 1.0 Subject: [PATCH] libselinux: fix thread safety issues with lookup_common() X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: From: Tom Cherry via Selinux Reply-To: Tom Cherry Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP There are two problems with lookup_common() and therefore selabel_lookup() and related functions that this patch fixes: 1) A race with the lazy compilation of regexes. Since the struct regex_data is allocated and assigned immediately to the parent struct spec, it's possible for a second thread to see that this pointer is non-NULL before the regex compilation has finished. This typically results in a -1 return from selabel_lookup() with ENOENT as errno. This is fixed by adding synchronization in compile_regex(). 2) A race with PCRE2 regex_match(). A struct pcre2_match_data is created once and used for all regex matches for a given regex. This is problematic if two threads are attempting to evaluate the same regex simultaneously. This typically results in a successful return from selabel_lookup() but with an erroneous selabel. This is fixed by adding a pthread_mutex within regex_match() for PCRE2. Note, on my system, creating new matchdata takes roughly an order of magnitude more time than locking a non-contended pthread_mutex. I don't believe programs will have enough contention on this lock to justify that cost. Bug: 63861738 Test: ueventd unit tests Change-Id: I13bf782d81d0a0b896d444e396f307ad0dbacb6a --- libselinux/src/label_file.c | 5 ++++- libselinux/src/label_file.h | 32 ++++++++++++++++++++++++++++++-- libselinux/src/regex.c | 27 +++++++++++++++++++++++---- libselinux/src/regex.h | 7 ++++++- libselinux/src/selinux_internal.h | 32 ++++++++++++++++++++++++++++++++ 5 files changed, 95 insertions(+), 8 deletions(-) diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c index f84d470b..560d8c3d 100644 --- a/libselinux/src/label_file.c +++ b/libselinux/src/label_file.c @@ -389,10 +389,12 @@ end_arch_check: spec->prefix_len = prefix_len; } - rc = regex_load_mmap(mmap_area, &spec->regex, reg_arch_matches); + rc = regex_load_mmap(mmap_area, &spec->regex, reg_arch_matches, + &spec->regex_compiled); if (rc < 0) goto out; + __pthread_mutex_init(&spec->regex_lock, NULL); data->nspec++; } @@ -810,6 +812,7 @@ static void closef(struct selabel_handle *rec) free(spec->lr.ctx_trans); free(spec->lr.ctx_raw); regex_data_free(spec->regex); + __pthread_mutex_destroy(&spec->regex_lock); if (spec->from_mmap) continue; free(spec->regex_str); diff --git a/libselinux/src/label_file.h b/libselinux/src/label_file.h index de804aed..aa576d8e 100644 --- a/libselinux/src/label_file.h +++ b/libselinux/src/label_file.h @@ -2,6 +2,7 @@ #define _SELABEL_FILE_H_ #include +#include #include #include @@ -16,6 +17,7 @@ #include "callbacks.h" #include "label_internal.h" +#include "selinux_internal.h" #define SELINUX_MAGIC_COMPILED_FCONTEXT 0xf97cff8a @@ -42,6 +44,8 @@ struct spec { char *regex_str; /* regular expession string for diagnostics */ char *type_str; /* type string for diagnostic messages */ struct regex_data * regex; /* backend dependent regular expression data */ + bool regex_compiled; /* bool to indicate if the regex is compiled */ + pthread_mutex_t regex_lock; /* lock for lazy compilation of regex */ mode_t mode; /* mode format value */ int matches; /* number of matching pathnames */ int stem_id; /* indicates which stem-compression item */ @@ -339,9 +343,27 @@ static inline int compile_regex(struct saved_data *data, struct spec *spec, struct stem *stem_arr = data->stem_arr; size_t len; int rc; - - if (spec->regex) + bool regex_compiled; + + /* We really want pthread_once() here, but since its + * init_routine does not take a parameter, it's not possible + * to use, so we generate the same effect with atomics and a + * mutex */ + regex_compiled = + __atomic_load_n(&spec->regex_compiled, __ATOMIC_ACQUIRE); + if (regex_compiled) { return 0; /* already done */ + } + + __pthread_mutex_lock(&spec->regex_lock); + /* Check if another thread compiled the regex while we waited + * on the mutex */ + regex_compiled = + __atomic_load_n(&spec->regex_compiled, __ATOMIC_ACQUIRE); + if (regex_compiled) { + __pthread_mutex_unlock(&spec->regex_lock); + return 0; + } /* Skip the fixed stem. */ reg_buf = spec->regex_str; @@ -354,6 +376,7 @@ static inline int compile_regex(struct saved_data *data, struct spec *spec, if (!anchored_regex) { if (errbuf) *errbuf = "out of memory"; + __pthread_mutex_unlock(&spec->regex_lock); return -1; } @@ -374,10 +397,13 @@ static inline int compile_regex(struct saved_data *data, struct spec *spec, sizeof(regex_error_format_buffer)); *errbuf = ®ex_error_format_buffer[0]; } + __pthread_mutex_unlock(&spec->regex_lock); return -1; } /* Done. */ + __atomic_store_n(&spec->regex_compiled, true, __ATOMIC_RELEASE); + __pthread_mutex_unlock(&spec->regex_lock); return 0; } @@ -439,6 +465,8 @@ static inline int process_line(struct selabel_handle *rec, /* process and store the specification in spec. */ spec_arr[nspec].stem_id = find_stem_from_spec(data, regex); spec_arr[nspec].regex_str = regex; + __pthread_mutex_init(&spec_arr[nspec].regex_lock, NULL); + spec_arr[nspec].regex_compiled = false; spec_arr[nspec].type_str = type; spec_arr[nspec].mode = 0; diff --git a/libselinux/src/regex.c b/libselinux/src/regex.c index ec1b0c4a..dfc15d63 100644 --- a/libselinux/src/regex.c +++ b/libselinux/src/regex.c @@ -1,10 +1,12 @@ #include +#include #include #include #include #include "regex.h" #include "label_file.h" +#include "selinux_internal.h" #ifdef USE_PCRE2 #define REGEX_ARCH_SIZE_T PCRE2_SIZE @@ -63,6 +65,7 @@ struct regex_data { * pattern in pcre2 */ pcre2_match_data *match_data; + pthread_mutex_t match_mutex; }; int regex_prepare_data(struct regex_data **regex, char const *pattern_string, @@ -106,11 +109,12 @@ char const *regex_version(void) } int regex_load_mmap(struct mmap_area *mmap_area, struct regex_data **regex, - int do_load_precompregex) + int do_load_precompregex, bool *regex_compiled) { int rc; uint32_t entry_len; + *regex_compiled = false; rc = next_entry(&entry_len, mmap_area, sizeof(uint32_t)); if (rc < 0) return -1; @@ -138,6 +142,8 @@ int regex_load_mmap(struct mmap_area *mmap_area, struct regex_data **regex, pcre2_match_data_create_from_pattern((*regex)->regex, NULL); if (!(*regex)->match_data) goto err; + + *regex_compiled = true; } /* and skip the decoded bit */ @@ -199,6 +205,7 @@ void regex_data_free(struct regex_data *regex) pcre2_code_free(regex->regex); if (regex->match_data) pcre2_match_data_free(regex->match_data); + __pthread_mutex_destroy(®ex->match_mutex); free(regex); } } @@ -206,9 +213,11 @@ void regex_data_free(struct regex_data *regex) int regex_match(struct regex_data *regex, char const *subject, int partial) { int rc; + __pthread_mutex_lock(®ex->match_mutex); rc = pcre2_match( regex->regex, (PCRE2_SPTR)subject, PCRE2_ZERO_TERMINATED, 0, partial ? PCRE2_PARTIAL_SOFT : 0, regex->match_data, NULL); + __pthread_mutex_unlock(®ex->match_mutex); if (rc > 0) return REGEX_MATCH; switch (rc) { @@ -244,6 +253,14 @@ int regex_cmp(struct regex_data *regex1, struct regex_data *regex2) return SELABEL_EQUAL; } +struct regex_data *regex_data_create(void) +{ + struct regex_data *regex_data = + (struct regex_data *)calloc(1, sizeof(struct regex_data)); + __pthread_mutex_init(®ex_data->match_mutex, NULL); + return regex_data; +} + #else // !USE_PCRE2 char const *regex_arch_string(void) { @@ -302,7 +319,7 @@ char const *regex_version(void) } int regex_load_mmap(struct mmap_area *mmap_area, struct regex_data **regex, - int unused __attribute__((unused))) + int unused __attribute__((unused)), bool *regex_compiled) { int rc; uint32_t entry_len; @@ -347,6 +364,8 @@ int regex_load_mmap(struct mmap_area *mmap_area, struct regex_data **regex, if (rc < 0 || info_len != entry_len) goto err; } + + *regex_compiled = true; return 0; err: @@ -472,13 +491,13 @@ int regex_cmp(struct regex_data *regex1, struct regex_data *regex2) return SELABEL_EQUAL; } -#endif - struct regex_data *regex_data_create(void) { return (struct regex_data *)calloc(1, sizeof(struct regex_data)); } +#endif + void regex_format_error(struct regex_error_data const *error_data, char *buffer, size_t buf_size) { diff --git a/libselinux/src/regex.h b/libselinux/src/regex.h index 186c5ecc..eb8ca501 100644 --- a/libselinux/src/regex.h +++ b/libselinux/src/regex.h @@ -1,6 +1,7 @@ #ifndef SRC_REGEX_H_ #define SRC_REGEX_H_ +#include #include #ifdef USE_PCRE2 @@ -98,13 +99,17 @@ int regex_prepare_data(struct regex_data **regex, char const *pattern_string, * with regex_data_create and must be freed with regex_data_free. * @arg do_load_precompregex If non-zero precompiled patterns get loaded from * the mmap region (ignored by PCRE1 back-end). + * @arg regex_compiled Set to true if a precompiled pattern was loaded + * into regex, otherwise set to false to indicate later + * compilation must occur * * @retval 0 on success * @retval -1 on error */ int regex_load_mmap(struct mmap_area *map_area, struct regex_data **regex, - int do_load_precompregex) hidden; + int do_load_precompregex, + bool *regex_compiled) hidden; /** * This function stores a precompiled regular expression to a file. * In the case of PCRE, it just dumps the binary representation of the diff --git a/libselinux/src/selinux_internal.h b/libselinux/src/selinux_internal.h index 54949c13..dfc421cc 100644 --- a/libselinux/src/selinux_internal.h +++ b/libselinux/src/selinux_internal.h @@ -144,6 +144,38 @@ extern int selinux_page_size hidden; pthread_setspecific(KEY, VALUE); \ } while (0) +/* selabel_lookup() is only thread safe if we're compiled with pthreads */ + +#pragma weak pthread_mutex_init +#pragma weak pthread_mutex_destroy +#pragma weak pthread_mutex_lock +#pragma weak pthread_mutex_unlock + +#define __pthread_mutex_init(LOCK, ATTR) \ + do { \ + if (pthread_mutex_init != NULL) \ + pthread_mutex_init(LOCK, ATTR); \ + } while (0) + +#define __pthread_mutex_destroy(LOCK) \ + do { \ + if (pthread_mutex_destroy != NULL) \ + pthread_mutex_destroy(LOCK); \ + } while (0) + +#define __pthread_mutex_lock(LOCK) \ + do { \ + if (pthread_mutex_lock != NULL) \ + pthread_mutex_lock(LOCK); \ + } while (0) + +#define __pthread_mutex_unlock(LOCK) \ + do { \ + if (pthread_mutex_unlock != NULL) \ + pthread_mutex_unlock(LOCK); \ + } while (0) + + #define SELINUXDIR "/etc/selinux/" #define SELINUXCONFIG SELINUXDIR "config"