From patchwork Thu Oct 19 23:14:33 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jann Horn via Selinux X-Patchwork-Id: 10020161 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id BECCD60211 for ; Fri, 20 Oct 2017 12:29:29 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B853828E7E for ; Fri, 20 Oct 2017 12:29:29 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id AB2B928E87; Fri, 20 Oct 2017 12:29:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from ucol19pa09.eemsg.mail.mil (ucol19pa09.eemsg.mail.mil [214.24.24.82]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5715728E7E for ; Fri, 20 Oct 2017 12:29:27 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.43,405,1503360000"; d="scan'208";a="552487361" Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.3]) by ucol19pa09.eemsg.mail.mil with ESMTP/TLS/AES256-SHA; 20 Oct 2017 12:29:25 +0000 X-IronPort-AV: E=Sophos;i="5.43,405,1503360000"; d="scan'208";a="4953079" IronPort-PHdr: =?us-ascii?q?9a23=3ANB2HCReBdLNPC1mttYHqLtAelGMj4u6mDksu8pMi?= =?us-ascii?q?zoh2WeGdxcmzZRGN2/xhgRfzUJnB7Loc0qyN4vCmATRIyK3CmUhKSIZLWR4BhJ?= =?us-ascii?q?detC0bK+nBN3fGKuX3ZTcxBsVIWQwt1Xi6NU9IBJS2PAWK8TW94jEIBxrwKxd+?= =?us-ascii?q?KPjrFY7OlcS30P2594HObwlSijewZbB/IA+qoQnNq8IbnZZsJqEtxxXTv3BGYf?= =?us-ascii?q?5WxWRmJVKSmxbz+MK994N9/ipTpvws6ddOXb31cKokQ7NYCi8mM30u683wqRbD?= =?us-ascii?q?VwqP6WACXWgQjxFFHhLK7BD+Xpf2ryv6qu9w0zSUMMHqUbw5Xymp4rx1QxH0li?= =?us-ascii?q?gIKz858HnWisNuiqJbvAmhrAF7z4LNfY2ZKOZycqbbcNwUX2pBWttaWTJHDI2y?= =?us-ascii?q?coADC/MNMftEo4X4oVYFsBmwChS2BO73xTBGiH3506400+omDw/JwBEuH8oMvX?= =?us-ascii?q?jJotj7NL0SXv6uzKTT0TXPc+lb1Svn5YTUcB0sp+yHU7JqccrWzEkiDwTLgU+M?= =?us-ascii?q?qYz5PzOayOoMuHWa4eV6T+KvkXAoqx1tojOy2Mcsi5PGjZ8IxF/a8SV5wYA1Jc?= =?us-ascii?q?C3SUVmZtOkC4VftyWbN4twX8MjTHpluDo6y7IauZ67ezIGyJI8xxHFcfCHfI+I?= =?us-ascii?q?4gz6WeuXPDx2h2pldaqiixu9/kWs0O3xWtSu3FpUoSdJjMPAum0V2xDN9sSKTu?= =?us-ascii?q?Fx80Sh1DqVyQzf9P1ILVoqmabHNZIsxKM7mIAJvkTZBCD2nV37jKqRdko55Oel?= =?us-ascii?q?8//nYrD6pp+EMI90lx3+PrwumsOhBeQ4NRADX3SB9uSm1b3j4Fb5TK9Wjvw2jq?= =?us-ascii?q?bZsJfaKd4dpqGlGA9azpwv6xO+DzeiyNgYnH8HI0xZeB+fkoTkNF7DLOr4APui?= =?us-ascii?q?mVigjjhmy+7cMrH8GpnNK2LMkLblfbZz8U5czw8zwMhE551KDrEBIfTzWlL+td?= =?us-ascii?q?DBFRA5NBG0w+D7B9pjzYMTQn6PA6+FP6PStl+E/OQvI/KWa4MPtzb9LOYl6+b0?= =?us-ascii?q?jXAlgV8dYbWp3ZwPZXC6GfRmJV+WYWbsgtgbF2cHpQg+TOvsiF2HSzFTfGqyUL?= =?us-ascii?q?wm5jEgEo6mCp3DRo+1irybwCi7BoFWZnxBCl2UE3fodZ+LVOsPaCKJJc9hlD0E?= =?us-ascii?q?Vaa6Ro8v0RGuqQD7xKF6LurS5i0YqIjv1N9v5+3cjRsy7yB7D9yB02GRSGF5hn?= =?us-ascii?q?sISCEt069hp0x9y0uD0a9jjvxZC9Nc+e1GXh09NZ7GwOxwE8ryVR7ZfteVVFam?= =?us-ascii?q?Rc2rDiw2TtI3xd8BflhyG9Gjjh3YxSWlHaUVl7uRCJwz6KLc0GD7J9xhxHbeyK?= =?us-ascii?q?khk14mT9NSOm26nKF/7RPeCJLOk0Wci6mlb78c3DLX+GeF02WOoFlSUBRsXqXd?= =?us-ascii?q?QXAfekzWoMz45kPEU7+hF7AnPRVEycGcNqtKcN3ogE5BRPf7JtveZWexlH2xBR?= =?us-ascii?q?aM3byMa4Xrd38a3CXHB0gOixoT8mqeNQgiGiehpHrTDTxvFFLoZUPh6ux+qHei?= =?us-ascii?q?Qk81yQGGdUth2KCv+h4WhPycVe0c0qgCuCg/tzV+BEy90M7OC9qcuwphe71RYN?= =?us-ascii?q?084FdD0GLWqRZ9M4euL698m1EedB53sFn21xVtDYVAk9Ylo282zAZoLqKYylxB?= =?us-ascii?q?fSuC3Z/sIr3XNnXy/Be3Zq7YwFHRytCW9bsO6PQjsFjjuRmpFks7/3V83dhVyG?= =?us-ascii?q?GQ5pLQDAodSZjxSFo49wBmp7HGZSkw/4DU2mdvMamzrz/PwNEpC/EmyhanYtdT?= =?us-ascii?q?KqSEFBX9E8cCHcihNPQqm0S1bhIDJO1d7rM7P9mnd/SYwq6mJ/xvky6jjWhd54?= =?us-ascii?q?B9yE2M/TJmSuHUx5YF3+2Y3gyfWjjgllihtt74mZtYZTASGWqy0jPkC5JQZqJs?= =?us-ascii?q?e4YLFWauLNetytV4mZHtR2ZS9ES/CFMexM+pZR2SYkTn3QJNyEsaunOnmS63zj?= =?us-ascii?q?BulTEmsLaf1jTUw+v+bBoHJnJLRG56gFf3L4i0ldcaXFO0bwUyjxul40H6xqZe?= =?us-ascii?q?pKtlKWnfW0FIcDbqL2t6SKu/qqKCY9JT6JMvqShWXv6zYVSGSrHjuRsayDjuH3?= =?us-ascii?q?VAyzAhbD6qp5D5kwZ9iGKHI3Z5tGDZdt1oxRfD+NzcQuZc3iYbSyZliDnYHFy8?= =?us-ascii?q?MsK18tWTkpfMrvqxV3m9VpFJdynk05+AvjOh5WJ2GR2/g+yzmtr/HAgk0C/0y8?= =?us-ascii?q?VqVSLSrBrmfobr16O6MeRofkRzAF/86sx6FZtkkos3np0Q3mIahpqN93odjWjz?= =?us-ascii?q?Kclb2b75bHcVQT4LwsXV4BT81E14MH2Jw4P5VnOAwspufNS6eXsW2iM778BLFK?= =?us-ascii?q?iU96ZInS1rrVqktQjRe+Ryni8Byfsy734Xm/sJuA0pziWZHL8SB1VXPSvilhmT?= =?us-ascii?q?9NC+sblYZH21fbi3zkp+ksirDKuerQFERHb5ZpAiEDdz7sphNlLMy2b+6oL6d9?= =?us-ascii?q?nWdtITsAObkwvag+hSMpIxmeIAhTB7NmLloX0l1+k7gAR23Z6goYiHL3ti/Lqj?= =?us-ascii?q?DR5eKj36edkT9yrwjaZFgMmWxZuvEo96GjUMQZvoV+6nHywctfTgLQaOHyMzpm?= =?us-ascii?q?2dGbXBAQ+V8F1moG7XE5C3K3GXI2EUzctkRBaAP0FfngYUUyg6npIjEACl2tDh?= =?us-ascii?q?el9j5j8N/l74tgdMyuVwOhnnSGjfuQOoZywoR5ieMBpX7hhO50nPPsyY9O5zGD?= =?us-ascii?q?tY/pK5pgyXNmObfxhIDX0OWkGcBFDiPr2u6sfb/uidAeq+IfXObquSqexCV/eI?= =?us-ascii?q?wpev3ZV88zaKKMqPImFoD+cn1UpbQXB5B8PZli0BSyMNkSLNc8mbpBKn9y15sM?= =?us-ascii?q?+w7fPrWBj16ouXEbtSNtdv9A6qjqefLeKQgzx5KTlA3JMW2XDI0KQf3EIViyx2?= =?us-ascii?q?bTmhC7oBuTTITK3Knq9XCB4aZjhpO8RU6qIwxA5NOdTUitntzL53kuY1C0tZVV?= =?us-ascii?q?zmgsypa9YKLH+gO1PcHkmLMqiGJTrQw8zse6yzVbhQgP9Ttx2qtjaRC1XjMSib?= =?us-ascii?q?lzn1SxCvNvlBjCeBPBNEoIG9ag1gCWbiTNL8cR27LNF3jTwwwbIugHPFKW8cPi?= =?us-ascii?q?J4c09Xqb2Q9yxYiO1lG2Nd9nplMfWEmyGB4ubDMZkatv9rAiVvl+JG+3Q20aBV?= =?us-ascii?q?4z9YS/BvgyvdsNpuo1CgkumSxTtqSwZBqzZRhIKWpkVuI6vY+YNcWXbf+xIN63?= =?us-ascii?q?+cCxMQp9tqEtfvobxfysDTlKLvLzdP69TU/coYB8jQNs2HK2EsPgD3Fz7OCwsJ?= =?us-ascii?q?VzmrNXvQh0ZFivGd6mWVroQmqpjrgJcBUb5bVFMyFvMcEUlqAcINL4x2Xjw+l7?= =?us-ascii?q?6XlskI5WCxrBPJXsVVoojHVu6OAfXoMDuWl7ZEaAEWwbzmNokTMZX71FJkall/?= =?us-ascii?q?hovKGk7QUstKoixudAM0p19N8HdmRG0px03lch+t4GMUFfOsgh42jQ5+bf439D?= =?us-ascii?q?fr4lY4OFzKqzAqkEk2h9rlgiucfyL2LKe1QY5ZETH0t1QrPpP9XQl1cRW4nVZ4?= =?us-ascii?q?OzfcW7JRk7xgeHhtiADCo5RPHeVRTa5DYB8L2fGYffMo0U9fqiWm30NH4/XKCY?= =?us-ascii?q?d6ngswbZGst25A2x5kbNMtP6zfOrFJwUZKiaKUoiCo1vs8zxQfJ0YX7WySfyAI?= =?us-ascii?q?uFQSNrY4Jyuk5Ops5hKemzFbYmgDS+Iqou529kM6I+mP0jjv06BCKk+sLOySNL?= =?us-ascii?q?mWu3Lalc6PTFIwzV0HmFVY/bhs0Mcjb0qVW1opzLSPCxQDLdDCJh1Nb8pO6HjT?= =?us-ascii?q?ej6DseHKwZJvIYq9EOHpTeiVuaYbhEKkARwlH4MW7sQOBpOsyl3XLd/7LL4Zzh?= =?us-ascii?q?Ug/B/rK0uBDPRIfhKLjTgGrtqjw59w2IlSOisSAX5hMSmt4LbYuBMqiuKZXNgq?= =?us-ascii?q?encaQpcENnUuVcKnhyFZunNADD+r0u4E0wWC8SHzpj7RDDj9aNpjYu2YZRVyB9?= =?us-ascii?q?Gq4T8/6bS5iUbL8pXCIGH3Lchiut7K6eMdu5aHC/NVQKJgvEfdm4hXXWelX3TJ?= =?us-ascii?q?EdGrO5j6c5MsYsDsCnamTly/jCo4T8jrPNm3KKiInRrlRYdTsIiV2jAjKc+9GS?= =?us-ascii?q?8fGxd2u+EM+rh8aRcFY5UlfR7irx4+OLCnIAeEztWuRH6gJiFST/le0eq1eaRY?= =?us-ascii?q?zy8sb++8z3sgSIs1wvKs/k4MXp4KiAjSxfi+Z4VEVyj8BGBdcR3VpSUlj2hhKv?= =?us-ascii?q?oywuAnzRzTr1YcNSuGe/Z0Z2xaod48H0iSLm9sCms4XVOcipDD4gG01bAI4yRd?= =?us-ascii?q?h8pU0fFCsHXmpJ/fZjOsV7CrqZXStyogdsAorbRsP4L5PsaIs4jTkSDYTJnVrg?= =?us-ascii?q?KKSjW6F+ZAlthWPi1YXOFCmXs5NswepYpB9U0xW98iKLxNEqYjuqunZiZjDS4W?= =?us-ascii?q?yS8ZVp2P3CYeguiix7Talg2ccJM4MBwLqJ9CmMcSUzZqYiMCo6+uT5/WmHWeSm?= =?us-ascii?q?gMOwge9hhM5BgamY9uYO/l5IvITJlDyz5SovJ0XSvLFoVm91ThUGGWhEL0SPO/?= =?us-ascii?q?nOy1xQhS1u7j0sEHWB5jDkhQ3+hXmlE0J7F3KqkQu4/KvSWLdU7hvWLi1vWpK0?= =?us-ascii?q?dLxc3TbV34A5LPtXDgXS0E5X0UWYhPxWnHFZQVlwp2crwrpVtLIICidEbz/Dkk?= =?us-ascii?q?x4NuH7mjS8+k20wlrXEdRyexEtpBDe5mvEjQWD1/bJChsI/lNIlKQm9M5J2drE?= =?us-ascii?q?9Un193My6kz5pQMcJN7yUNXDhOoDWdoMC9RNdF2cBoE58GOs1/tGvlGKNYJJiR?= =?us-ascii?q?pGU7uqDoyn/c4D08rEu2xDCoFKOiSeJW4XEeEB0zJ2uCskkvE/cs8mDK/1DNqF?= =?us-ascii?q?905f1UBrySgkhqvTlyAIhOBi5X2nChMVtzVmNKs+JAKKTaa8ZcWeU9ZQezOxwi?= =?us-ascii?q?Ev4rx06J/UZqknrifiN9qBBa9D7HXwkoSyYan63hmTsApcG7ITUaUY5HbS09by?= =?us-ascii?q?fZLAKWgTtYvBhDZE12WZ0VH9hI9qoH0otT+8rNVVyjKToZXBB4MAI3z+Zfn1ZZ?= =?us-ascii?q?sEqEYSDdERaodfHXvx1tY8iesc6pI+7l/ApcjoPnt/44+LsdS3K6ng2iXM7Ro5?= =?us-ascii?q?X6ttKUqkuEbL34PPGkYX/dUDjMigi9ha8/D5nW5SfcLRZbJoJhyXojfJjhE3LE?= =?us-ascii?q?MgpAJ6IHPUpUT6R6Zc9BouBAaM9uYLwJ9rN1BhKbWhPvH5SirOVcLlnNWzvRMj?= =?us-ascii?q?6M8vG7oYLP97zSU/bgZs2Lx3bDXa13Io126T7hG7flyYVe4Fb52u9x9kNmTljL?= =?us-ascii?q?KyWBo87lJgMP+saialfisYczEj7NBpd/jmbtxlpceMUNWy2l7o4UyJVH53bsUe?= =?us-ascii?q?h4yFT8sPVO97l47ok6+7Jpxt2uJafVMvRatVVoAgaPCwVv65UtBHR/R2FNbe8Q?= =?us-ascii?q?MvjRe78Zgdrpq+DtGKwd8AeV9PBBadvbO0HBndGyCjOGRhxCkgcBszkaIRaC2P?= =?us-ascii?q?Oeh697U8ClpfP+2k435VixMAIGxqh35YiY4qqIuPPXbxzJwLgLR6jqR8fzrrAy?= =?us-ascii?q?tEOX/vAriaABdXd0YwK9FugRTMkdxn3vzaoy1yIjD9vDH678+P5ET385mDbglo?= =?us-ascii?q?t8H1UQH/MYB7uL/YJQnmcigePZLcEWcrpfmmmTCR6kD6UCxmCx5yuQOmlljQnE?= =?us-ascii?q?0wvsTmOr8F/2sSh4TDPJz9fklEpVSra3CllJUiqsOE93qjWPMxT0tNv5vqQ19k?= =?us-ascii?q?I2Mnf+uNKLimShJKtdH9fjK9yEPSk0uFUXgYU1Rty03IAWGcGwINkP/35jafve?= =?us-ascii?q?8Xmkkzdbo6dAhYrR/N2a+unNEXmnla2apK2HxCpExXggoVE/9tegO+nM592LRv?= =?us-ascii?q?SlzGMRQDl/ugTfRR61q7rbr18ONUyNzkjLhJQAPstF0nkgykHm+O8jTcoy9ARf?= =?us-ascii?q?DInPfe8NqCvoODTq3VaQfc44WjOZ0ztNEVL/CUN4F7Qk2GLsoMLJkm/d9EYpRo?= =?us-ascii?q?lreU3onx53D4QkKUI18lcX3y4DHBMRZhCcEb6nG17qLZYeVUgEcxSIxqK2eqAt?= =?us-ascii?q?3U182rmv/vPcbfRgB6oRMfZQlhaOk0JHGp0Ksa0fTrV8e0Ve9KLOvQjtFYznX/?= =?us-ascii?q?nglXotOvy4Wdha/toFt3Q+4ga+SR2g6Y1A77oBi5CHaLREYZ7Ss8B49Utn4iQP?= =?us-ascii?q?diNVihhlkxy5SfwcpPzk4tXDrJqo8PihVKI3SOUR6Rc5HHlxj5r/gFAivdHYzf?= =?us-ascii?q?xcRZfPiYTi6gxNJWCFuJrC2RlmNeUOM56rfKpn93gfKCgRPWgOMsSKa/k8+CJt?= =?us-ascii?q?NDTT50BcDcMMf9wYIdHNlRpSikL3RLFZ7tDbFUOAC4dva8Ao6HL6yD8r/ps6Tu?= =?us-ascii?q?bg7zi2KZfE715TO/NDjSNslM/NpeUOxfrdFjIX4HmDZBRvxCON1YWNAe7q/eqQ?= =?us-ascii?q?0NHUS08GHikuXodbJTqN5QunRu6vm5XySA+U68jzgJUldEKLXXGxmasIs6lWHe?= =?us-ascii?q?5HkCX70SBUFprpiPKNr9qs9GxXu0VIEIlv9h3FA7xTMIh0Nxr+l8mrQFV8ByTk?= =?us-ascii?q?dcHbcxohouyWyfkW7+V5LUv+apcRIggYxLLi9XpVUgxuRab0vlaeXeIRYsFqR+?= =?us-ascii?q?/ErnBR9IJvNq4OPFmbpJzxrTdIqUs7ABEoaL8utDNaclTBnAxPV6byprEAlhMW?= =?us-ascii?q?UcRltk9UBWKwJGU+6iLGVaRLlqaRDucY8jGOTqMTUkVoNTh+Twmy2JV0dLujhe?= =?us-ascii?q?pHvX9eniNhvPgq1CRrRBmiti3iqaIN3Skt+b+iuzUHp3NFUv+SkyHWBlVf1P4K?= =?us-ascii?q?l7sTC27+6VygZ3kOdITy4L1gJcXu64Yh53A/bA44fy0BW+SgCj3/g7mOAoORrN?= =?us-ascii?q?JWnASNt9nWbb+vMSgSMawwyRDjR3l9ygjemxJo8GoXQjq+99IkIYS9Odo/xiW2?= =?us-ascii?q?A2Tbc0wM4qxRusvrqVELVPc2aU9mwGh7zsiHRygNSdfTG2Y0kgckantLcJZZ5R?= =?us-ascii?q?8cCaYoni6CvrNa8QEMfDfUDoOl95HVncfJ2nk9TtBqy3nUpqKfhZMq13tllM1y?= =?us-ascii?q?7iKUvnQdafDYWdd2Anfvzodf1fD+Z/K1v+8cVoRmzqihXeQZMsmn/mu2xIlqWl?= =?us-ascii?q?G7ybsDBVa5N/UDxrjDWSe/VWKYQfiLc3SLnzshPE79+x2oLlwvaMhUtEI8M+rC?= =?us-ascii?q?hptZlwL/S7N0QjufqUXczGw5PuMQbxg2t5u/ewwWUO4RYPCRJOY2wP0kCVsDc2?= =?us-ascii?q?HGEDBzC++3rV6thpZ0N29n4UXgbuTn6hrmP8eKGhkYDY7aqYZ8+fu+Rm2fInJg?= =?us-ascii?q?1BlyM1Nv9+fDFlQ+qvNcc4yPktfOndh71/AKd+t1Oy0nptETgp5j6ZWT0MqSdR?= =?us-ascii?q?HRz5DyJczao/SBB/3fzl8qen1BUrcCYAP6/YM6PtkjV73UB7tZsgwWBbImT5w5?= =?us-ascii?q?K2fx6KZ0IRtocgHPYLS0g8/qpv+EZ5dTqHHW8lIwIznGuxId0vy7Vxd2b5O0iH?= =?us-ascii?q?XoJpA/WDZBoMZwChtpBodPHNkArwW/CZ6OhK67k8Ox+199u+IStKr/EOzF1NS4?= =?us-ascii?q?34V3WJhX/lKLPDfXBKZ1hkRlj+KygurP05XrDsPiY9wEXvBhQmHZcr/GApm/Kj?= =?us-ascii?q?WWN8L+YUFG8Lmc36liXxWMYiD5Q6qGtCq5NPVr4UU71pZ0fOzNwzwx97vbwsf9?= =?us-ascii?q?Z3lHpie/qn6ELJlf7FnNBezERRJUSOGF/X1jHaINaIv76uYOPcYlwNiG7Al59C?= =?us-ascii?q?5C39edI6i9sk/M3Vp2dYnVLEvsxyk0WIoHLQ+hMUQym2/Zq3XcAXNaLsS+L8li?= =?us-ascii?q?nsqVXVTR4Bx1mGcwditAHHblSs2QJXkzxc2zfkuJ+RhNAtJFmPS4KnQ1rqmjde?= =?us-ascii?q?49H5xZheWnq/0omMxzJj3TDJxfPS6NfZd5OT1eCuiJr18tNE0qqb8wD6I8eYSO?= =?us-ascii?q?LVxPH06a0y7u0UPc0ES8TNGo1aCUMG5C6XhDzrTYwRBQtgK5vrCfmcSlX7fHOs?= =?us-ascii?q?KlFMXOOTYoA2nJDQ85FlykrBL94qIJ?= X-IPAS-Result: =?us-ascii?q?A2A+AgCZ6+lZ/wHyM5BcGwEBAQMBAQEJAQEBFgEBAQMBAQE?= =?us-ascii?q?JAQEBgwgsgVIng3qLE45LgnWHT41rGoEYA04wiV5BFgEBAQEBAQEBAQEBaiiCO?= =?us-ascii?q?CQBgkEDAwECIARSAwMJAQESEgIiBAICAwEdEwEFARwZBYgBggIDFQOdKkCMDIF?= =?us-ascii?q?tOoRwgkoNg1kMJhJ9gh+CBxCDKYJ1gxOFO4JhBZJfjkE8j3iEbA2FcY0rjQiIW?= =?us-ascii?q?jiBFSUBMU+BDCoKAh8IIw9JgS0agR2CXByCB1YBiBUsghYBAQE?= Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 20 Oct 2017 12:29:22 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v9KCT7BA022676; Fri, 20 Oct 2017 08:29:11 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id v9JNEm1P084499 for ; Thu, 19 Oct 2017 19:14:48 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id v9JNEml3005397 for ; Thu, 19 Oct 2017 19:14:48 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A1BiAQBIMelZfygaGNZcHAEBBAEBCgEBg?= =?us-ascii?q?1yBVSeDeoofdI5KQgEBAQaCKodOhTCIOoE1A3mKNT8YAQIBAQEBAQEBEwEBCxa?= =?us-ascii?q?FewYjBBkBATcBDyUCJgICIRMBBQEcGYoIAwgNA54tQIsha4FtOoMIAQEFhC0Ng?= =?us-ascii?q?R+COgELHggSfYIgggeBCYIygnmDE4U7gmEBgTEBAZEtjjsyCAEBhXCKBoRsDYV?= =?us-ascii?q?wjSmNBohaOIEVH4EHgQw0ISVegRGBU4JNDxyCB1YBiEssghYBAQE?= X-IPAS-Result: =?us-ascii?q?A1BiAQBIMelZfygaGNZcHAEBBAEBCgEBg1yBVSeDeoofdI5?= =?us-ascii?q?KQgEBAQaCKodOhTCIOoE1A3mKNT8YAQIBAQEBAQEBEwEBCxaFewYjBBkBATcBD?= =?us-ascii?q?yUCJgICIRMBBQEcGYoIAwgNA54tQIsha4FtOoMIAQEFhC0NgR+COgELHggSfYI?= =?us-ascii?q?gggeBCYIygnmDE4U7gmEBgTEBAZEtjjsyCAEBhXCKBoRsDYVwjSmNBohaOIEVH?= =?us-ascii?q?4EHgQw0ISVegRGBU4JNDxyCB1YBiEssghYBAQE?= X-IronPort-AV: E=Sophos;i="5.43,404,1503374400"; d="scan'208";a="90436" Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.35]) by goalie.tycho.ncsc.mil with ESMTP; 19 Oct 2017 19:14:47 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3Aex+l2RxCPEZnN8XXCy+O+j09IxM/srCxBDY+r6Qd?= =?us-ascii?q?2uoRIJqq85mqBkHD//Il1AaPBtSLraocw8Pt8InYEVQa5piAtH1QOLdtbDQizf?= =?us-ascii?q?ssogo7HcSeAlf6JvO5JwYzHcBFSUM3tyrjaRsdF8nxfUDdrWOv5jAOBBr/KRB1?= =?us-ascii?q?JuPoEYLOksi7ze6/9pnQbglSmDaxfa55IQmrownWqsQYm5ZpJLwryhvOrHtIeu?= =?us-ascii?q?BWyn1tKFmOgRvy5dq+8YB6/ShItP0v68BPUaPhf6QlVrNYFygpM3o05MLwqxbO?= =?us-ascii?q?SxaE62YGXWUXlhpIBBXF7A3/U5zsvCb2qvZx1S+HNsDtU7s6RSqt4LtqSB/wiS?= =?us-ascii?q?cIKTg58H3MisdtiK5XuQ+tqwBjz4LRZoyeKfhwcb7Hfd4CWGROUchfWC5CDIOy?= =?us-ascii?q?aIUBD/QPMvpDoonhu1cDtweyCBOwCO7tzDJDm3/43bc90+QkCQzI2xYvH84SsH?= =?us-ascii?q?TUstr0OroZX+Gvw6nS1zXMce9W2Svg44XPdxAho/6MULJ0fMfKxkkvEATFjlqU?= =?us-ascii?q?qYP7JT+ayuMNs22C4udmSOmhiHYnphlvrjSyycogkJfFi40Pxlza9Ch12ok4Kc?= =?us-ascii?q?GgREJlfdKpFIFcuiKaOodsXM8uXX1ktDwkxrEap5K2ejUBxo49yB7FcfOHdpCF?= =?us-ascii?q?4hL9W+aVJjd1nHxqdq+/iRuv7EStzvfyW9Wo3FpXtCZKjMfDtnUW1xzc8MSHT+?= =?us-ascii?q?Fy/kal2TqV0gDT6+VELVg1lardNZEh3qY9moQOvUnMBCP6hkr7gLWIekgl4OSl?= =?us-ascii?q?5Pjrbq3jppCGNo90jg/+Mr4pmsy6Gek1PAYDXmmZ9+Sk1LLt5kP2TrBXg/A0nK?= =?us-ascii?q?jZt5TaJcUZq6OkAg9Vy58j6xe5DzepytgXg2AHLFVYeBKIiYjpOEnOIf75DPeh?= =?us-ascii?q?n1ijjjVrx+ncMr35H5XCMmLPkLb4fbdy8ENcxg4zws5Q5p5NE70BJej8WlPttN?= =?us-ascii?q?zYEBA4PQO0zPz9CNVnyIweRX6PDrWCP6PVrF+I4P4gLPeXZIMPtzb9LP8l5/Hq?= =?us-ascii?q?jXAng1MSYa6p3Z4PZHCiAvtmO1mZYWbrgtoZCmcFoA4+TO3siF2fXj9efGqyXq?= =?us-ascii?q?Ig6TE7D4KqF4HDRpu3j7Cb0ye7GYNWNSh6DQWIEHH1Z8CFXesBZziTPt5JjDMJ?= =?us-ascii?q?T/6iRpUn2BXosxX1mJR9Ke+B3yQEqZLuy5Ba7vfJmA0uvWhxDcvAgkmCSGZ7mm?= =?us-ascii?q?5OTDgzivMs6Xdhw0uOhPAry8dTEsZesrYQCl83?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0D6AADEMOlZfygaGNZcHAEBBAEBCgEBF?= =?us-ascii?q?wEBBAEBCgEBgzGBVSeDeoofdI8MAQEBBoIqh06FMIg6gTUDeYp0GAEBAQEBAQE?= =?us-ascii?q?BAQEBEgEBCxZdgjgkAYJBBiMEGQEBNwEPJQImAgIhEwEFARwZiggDCA0Dni1Ai?= =?us-ascii?q?yFrgW06gwgBAQWELQ2BH4I6AQseCBJ9giCDEIIygnmDE4U7gmGBMgEBkS2OOzI?= =?us-ascii?q?IAQGFcIoGhGwNhXCNKY0GiFo4gRUfgQeBDDQhJV6BEYFTgk0PHIIHVgGISyyCF?= =?us-ascii?q?gEBAQ?= X-IPAS-Result: =?us-ascii?q?A0D6AADEMOlZfygaGNZcHAEBBAEBCgEBFwEBBAEBCgEBgzG?= =?us-ascii?q?BVSeDeoofdI8MAQEBBoIqh06FMIg6gTUDeYp0GAEBAQEBAQEBAQEBEgEBCxZdg?= =?us-ascii?q?jgkAYJBBiMEGQEBNwEPJQImAgIhEwEFARwZiggDCA0Dni1AiyFrgW06gwgBAQW?= =?us-ascii?q?ELQ2BH4I6AQseCBJ9giCDEIIygnmDE4U7gmGBMgEBkS2OOzIIAQGFcIoGhGwNh?= =?us-ascii?q?XCNKY0GiFo4gRUfgQeBDDQhJV6BEYFTgk0PHIIHVgGISyyCFgEBAQ?= X-IronPort-AV: E=Sophos;i="5.43,404,1503360000"; d="scan'208";a="4940227" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from uphb3cpa01.eemsg.mail.mil (HELO USFB19PA01.eemsg.mail.mil) ([214.24.26.40]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 19 Oct 2017 23:14:45 +0000 X-EEMSG-check-005: 0 X-EEMSG-check-006: 000-001;aea9533d-b89d-4bc9-ada8-059e481ae10b X-EEMSG-check-008: 4754425|USFB19PA09_EEMSG_MP5.csd.disa.mil X-EEMSG-SBRS: 3.4 X-EEMSG-ORIG-IP: 209.85.220.202 X-EEMSG-check-002: true X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0CZAQDEMOlZhsrcVdFcHAEBBAEBCgEBhTEng3qZXUMBAQaCKodOhTCIOoE1A3mFJAKFD0AXAQIBAQEBAQEBEwEBAQoJCwgoL4UeBiMEGQEBNwEPJQImAgIhEwEFARwZiggDCA2eMECLIWuBbTqDCAEBBYQtDYEfgjoqCBJ9giCCB4EJgjKCeYMThTuCYYEyAQGRLY47MggBAYVwigaEbA2FcI0pjQaIWjiBFSEBgQSBDDQhJV6BEYFTgk0PHIIHIDYBiEssghYBAQE X-IPAS-Result: A0CZAQDEMOlZhsrcVdFcHAEBBAEBCgEBhTEng3qZXUMBAQaCKodOhTCIOoE1A3mFJAKFD0AXAQIBAQEBAQEBEwEBAQoJCwgoL4UeBiMEGQEBNwEPJQImAgIhEwEFARwZiggDCA2eMECLIWuBbTqDCAEBBYQtDYEfgjoqCBJ9giCCB4EJgjKCeYMThTuCYYEyAQGRLY47MggBAYVwigaEbA2FcI0pjQaIWjiBFSEBgQSBDDQhJV6BEYFTgk0PHIIHIDYBiEssghYBAQE Received: from mail-qk0-f202.google.com ([209.85.220.202]) by USFB19PA09.eemsg.mail.mil with ESMTP; 19 Oct 2017 23:14:40 +0000 Received: by mail-qk0-f202.google.com with SMTP id t5so9719008qkc.14 for ; Thu, 19 Oct 2017 16:14:40 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:in-reply-to:message-id :references:subject:from:to:cc; bh=7kGRlnmPXj5wXXCQuH2P+VW4/lS2y20VmkAxDn+KRfA=; b=m8BKxTJIAsnbeajeLAnMz8MfG27RHpwQ1gIb0N/QcNaiDUad6N/jostEBzhcb+2CIF TFB3SjMhQFChdv4OWM+tFTdCcwN6Uux27yiVKpMiPECLWdM4f7vaITbErnTOh3ZP4CCQ D/3iOqEG2EpiUzYzMX5m1zABv+bugpEO8kx9eAUCGJU27iz6kmc33LCs0DOOGd/nspSH O6rq2uEdlN91DdW1wMJQqJiY9Cl77NNyF+D0G7jwfW4uYjgc34PAQEyEBJFuEVp1M9Ie 7/Hr7qHDgFZlGtpK3qQxiLYn0pPfiSEWJnikgz5azvCqV97vXWTTFN328e3bV+vN9dYa /8xA== X-Gm-Message-State: AMCzsaXUWEmQoUxG0hA++xrC4AEQqCygSZ7rGWIHuOOD5CD2uGBp4GlM JOlwEimGl2Aowxj/dgzFcnlXWQoKCFvf7TkGark10A== X-Google-Smtp-Source: ABhQp+TTTlITIxTTG08I8/WGcsLipCMZgqy1Qx+87lkNsQN9V0bQ+75mhcN4NYZIZFp6PG022pIjXZJsKleyNVCK4XroDQ== MIME-Version: 1.0 X-Received: by 10.55.101.149 with SMTP id z143mr2320217qkb.38.1508454879940; Thu, 19 Oct 2017 16:14:39 -0700 (PDT) Date: Thu, 19 Oct 2017 16:14:33 -0700 In-Reply-To: <20171019231433.11723-1-mjg59@google.com> Message-Id: <20171019231433.11723-2-mjg59@google.com> References: <20171019231433.11723-1-mjg59@google.com> X-Mailer: git-send-email 2.15.0.rc0.271.g36b669edcc-goog To: linux-integrity@vger.kernel.org X-Mailman-Approved-At: Fri, 20 Oct 2017 08:29:07 -0400 Subject: [PATCH 2/2] IMA: Support using new creds in appraisal policy X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: From: Matthew Garrett via Selinux Reply-To: Matthew Garrett Cc: Matthew Garrett , linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, Dmitry Kasatkin , Stephen Smalley Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP The existing BPRM_CHECK functionality in IMA validates against the credentials of the existing process, not any new credentials that the child process may transition to. Add an additional CREDS_CHECK target and refactor IMA to pass the appropriate creds structure. In ima_bprm_check(), check with both the existing process credentials and the credentials that will be committed when the new process is started. Signed-off-by: Matthew Garrett Cc: Paul Moore Cc: Stephen Smalley Cc: Eric Paris Cc: selinux@tycho.nsa.gov Cc: Casey Schaufler Cc: linux-security-module@vger.kernel.org Cc: Mimi Zohar Cc: Dmitry Kasatkin Cc: linux-integrity@vger.kernel.org --- V2: Fix the IMA_CRED_CHECK defines Documentation/ABI/testing/ima_policy | 2 +- security/integrity/iint.c | 1 + security/integrity/ima/ima.h | 7 ++++--- security/integrity/ima/ima_api.c | 8 +++++--- security/integrity/ima/ima_appraise.c | 10 +++++++++- security/integrity/ima/ima_main.c | 26 +++++++++++++++++--------- security/integrity/ima/ima_policy.c | 19 ++++++++++++------- security/integrity/integrity.h | 9 +++++++-- 8 files changed, 56 insertions(+), 26 deletions(-) diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy index e76432b9954d..5dc9eed035fb 100644 --- a/Documentation/ABI/testing/ima_policy +++ b/Documentation/ABI/testing/ima_policy @@ -25,7 +25,7 @@ Description: [obj_user=] [obj_role=] [obj_type=]] option: [[appraise_type=]] [permit_directio] - base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK] + base: func:= [BPRM_CHECK][MMAP_CHECK][CREDS_CHECK][FILE_CHECK][MODULE_CHECK] [FIRMWARE_CHECK] [KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK] mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND] diff --git a/security/integrity/iint.c b/security/integrity/iint.c index 6fc888ca468e..ad30094a58b4 100644 --- a/security/integrity/iint.c +++ b/security/integrity/iint.c @@ -78,6 +78,7 @@ static void iint_free(struct integrity_iint_cache *iint) iint->ima_mmap_status = INTEGRITY_UNKNOWN; iint->ima_bprm_status = INTEGRITY_UNKNOWN; iint->ima_read_status = INTEGRITY_UNKNOWN; + iint->ima_creds_status = INTEGRITY_UNKNOWN; iint->evm_status = INTEGRITY_UNKNOWN; iint->measured_pcrs = 0; kmem_cache_free(iint_cache, iint); diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index d52b487ad259..0703a96072b5 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -177,6 +177,7 @@ static inline unsigned long ima_hash_key(u8 *digest) hook(FILE_CHECK) \ hook(MMAP_CHECK) \ hook(BPRM_CHECK) \ + hook(CREDS_CHECK) \ hook(POST_SETATTR) \ hook(MODULE_CHECK) \ hook(FIRMWARE_CHECK) \ @@ -191,7 +192,7 @@ enum ima_hooks { }; /* LIM API function definitions */ -int ima_get_action(struct inode *inode, int mask, +int ima_get_action(struct inode *inode, const struct cred *cred, int mask, enum ima_hooks func, int *pcr); int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func); int ima_collect_measurement(struct integrity_iint_cache *iint, @@ -212,8 +213,8 @@ void ima_free_template_entry(struct ima_template_entry *entry); const char *ima_d_path(const struct path *path, char **pathbuf, char *filename); /* IMA policy related functions */ -int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, - int flags, int *pcr); +int ima_match_policy(struct inode *inode, const struct cred *cred, + enum ima_hooks func, int mask, int flags, int *pcr); void ima_init_policy(void); void ima_update_policy(void); void ima_update_policy_flag(void); diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index c2edba8de35e..ff33b7e65a07 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -157,6 +157,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, /** * ima_get_action - appraise & measure decision based on policy. * @inode: pointer to inode to measure + * @cred: pointer to credentials structure to validate * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC, * MAY_APPEND) * @func: caller identifier @@ -165,20 +166,21 @@ void ima_add_violation(struct file *file, const unsigned char *filename, * The policy is defined in terms of keypairs: * subj=, obj=, type=, func=, mask=, fsmagic= * subj,obj, and type: are LSM specific. - * func: FILE_CHECK | BPRM_CHECK | MMAP_CHECK | MODULE_CHECK + * func: FILE_CHECK | BPRM_CHECK | CREDS_CHECK | MMAP_CHECK | MODULE_CHECK * mask: contains the permission mask * fsmagic: hex value * * Returns IMA_MEASURE, IMA_APPRAISE mask. * */ -int ima_get_action(struct inode *inode, int mask, enum ima_hooks func, int *pcr) +int ima_get_action(struct inode *inode, const struct cred *cred, int mask, + enum ima_hooks func, int *pcr) { int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE; flags &= ima_policy_flag; - return ima_match_policy(inode, func, mask, flags, pcr); + return ima_match_policy(inode, cred, func, mask, flags, pcr); } /* diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 809ba70fbbbf..137b8d1708c6 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -53,7 +53,8 @@ int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func) if (!ima_appraise) return 0; - return ima_match_policy(inode, func, mask, IMA_APPRAISE, NULL); + return ima_match_policy(inode, current_cred(), func, mask, + IMA_APPRAISE, NULL); } static int ima_fix_xattr(struct dentry *dentry, @@ -86,6 +87,8 @@ enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint, return iint->ima_mmap_status; case BPRM_CHECK: return iint->ima_bprm_status; + case CREDS_CHECK: + return iint->ima_creds_status; case FILE_CHECK: case POST_SETATTR: return iint->ima_file_status; @@ -106,6 +109,8 @@ static void ima_set_cache_status(struct integrity_iint_cache *iint, case BPRM_CHECK: iint->ima_bprm_status = status; break; + case CREDS_CHECK: + iint->ima_creds_status = status; case FILE_CHECK: case POST_SETATTR: iint->ima_file_status = status; @@ -127,6 +132,9 @@ static void ima_cache_flags(struct integrity_iint_cache *iint, case BPRM_CHECK: iint->flags |= (IMA_BPRM_APPRAISED | IMA_APPRAISED); break; + case CREDS_CHECK: + iint->flags |= (IMA_CREDS_APPRAISED | IMA_APPRAISED); + break; case FILE_CHECK: case POST_SETATTR: iint->flags |= (IMA_FILE_APPRAISED | IMA_APPRAISED); diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 2aebb7984437..f41aa427792b 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -155,8 +155,9 @@ void ima_file_free(struct file *file) ima_check_last_writer(iint, inode, file); } -static int process_measurement(struct file *file, char *buf, loff_t size, - int mask, enum ima_hooks func, int opened) +static int process_measurement(struct file *file, const struct cred *cred, + char *buf, loff_t size, int mask, + enum ima_hooks func, int opened) { struct inode *inode = file_inode(file); struct integrity_iint_cache *iint = NULL; @@ -178,7 +179,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size, * bitmask based on the appraise/audit/measurement policy. * Included is the appraise submask. */ - action = ima_get_action(inode, mask, func, &pcr); + action = ima_get_action(inode, cred, mask, func, &pcr); violation_check = ((func == FILE_CHECK || func == MMAP_CHECK) && (ima_policy_flag & IMA_MEASURE)); if (!action && !violation_check) @@ -282,8 +283,8 @@ static int process_measurement(struct file *file, char *buf, loff_t size, int ima_file_mmap(struct file *file, unsigned long prot) { if (file && (prot & PROT_EXEC)) - return process_measurement(file, NULL, 0, MAY_EXEC, - MMAP_CHECK, 0); + return process_measurement(file, current_cred(), NULL, 0, + MAY_EXEC, MMAP_CHECK, 0); return 0; } @@ -302,8 +303,14 @@ int ima_file_mmap(struct file *file, unsigned long prot) */ int ima_bprm_check(struct linux_binprm *bprm) { - return process_measurement(bprm->file, NULL, 0, MAY_EXEC, - BPRM_CHECK, 0); + int ret; + + ret = process_measurement(bprm->file, current_cred(), NULL, 0, + MAY_EXEC, BPRM_CHECK, 0); + if (ret) + return ret; + return process_measurement(bprm->file, bprm->cred, NULL, 0, + MAY_EXEC, CREDS_CHECK, 0); } /** @@ -318,7 +325,7 @@ int ima_bprm_check(struct linux_binprm *bprm) */ int ima_file_check(struct file *file, int mask, int opened) { - return process_measurement(file, NULL, 0, + return process_measurement(file, current_cred(), NULL, 0, mask & (MAY_READ | MAY_WRITE | MAY_EXEC | MAY_APPEND), FILE_CHECK, opened); } @@ -413,7 +420,8 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size, } func = read_idmap[read_id] ?: FILE_CHECK; - return process_measurement(file, buf, size, MAY_READ, func, 0); + return process_measurement(file, current_cred(), buf, size, MAY_READ, + func, 0); } static int __init init_ima(void) diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index 95209a5f8595..c9d5735711eb 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -247,10 +247,9 @@ static void ima_lsm_update_rules(void) * Returns true on rule match, false on failure. */ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, - enum ima_hooks func, int mask) + const struct cred *cred, enum ima_hooks func, + int mask) { - struct task_struct *tsk = current; - const struct cred *cred = current_cred(); int i; if ((rule->flags & IMA_FUNC) && @@ -305,7 +304,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, case LSM_SUBJ_USER: case LSM_SUBJ_ROLE: case LSM_SUBJ_TYPE: - security_task_getsecid(tsk, &sid); + security_cred_getsecid(cred, &sid); rc = security_filter_rule_match(sid, rule->lsm[i].type, Audit_equal, @@ -339,6 +338,8 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func) return IMA_MMAP_APPRAISE; case BPRM_CHECK: return IMA_BPRM_APPRAISE; + case CREDS_CHECK: + return IMA_CREDS_APPRAISE; case FILE_CHECK: case POST_SETATTR: return IMA_FILE_APPRAISE; @@ -351,6 +352,8 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func) /** * ima_match_policy - decision based on LSM and other conditions * @inode: pointer to an inode for which the policy decision is being made + * @cred: pointer to a credentials structure for which the policy decision is + * being made * @func: IMA hook identifier * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) * @pcr: set the pcr to extend @@ -362,8 +365,8 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func) * list when walking it. Reads are many orders of magnitude more numerous * than writes so ima_match_policy() is classical RCU candidate. */ -int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, - int flags, int *pcr) +int ima_match_policy(struct inode *inode, const struct cred *cred, + enum ima_hooks func, int mask, int flags, int *pcr) { struct ima_rule_entry *entry; int action = 0, actmask = flags | (flags << 1); @@ -374,7 +377,7 @@ int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, if (!(entry->action & actmask)) continue; - if (!ima_match_rules(entry, inode, func, mask)) + if (!ima_match_rules(entry, inode, cred, func, mask)) continue; action |= entry->flags & IMA_ACTION_FLAGS; @@ -691,6 +694,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) entry->func = MMAP_CHECK; else if (strcmp(args[0].from, "BPRM_CHECK") == 0) entry->func = BPRM_CHECK; + else if (strcmp(args[0].from, "CREDS_CHECK") == 0) + entry->func = CREDS_CHECK; else if (strcmp(args[0].from, "KEXEC_KERNEL_CHECK") == 0) entry->func = KEXEC_KERNEL_CHECK; diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index a53e7e4ab06c..45ba0e4501d6 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -48,10 +48,14 @@ #define IMA_BPRM_APPRAISED 0x00002000 #define IMA_READ_APPRAISE 0x00004000 #define IMA_READ_APPRAISED 0x00008000 +#define IMA_CREDS_APPRAISE 0x00010000 +#define IMA_CREDS_APPRAISED 0x00020000 #define IMA_APPRAISE_SUBMASK (IMA_FILE_APPRAISE | IMA_MMAP_APPRAISE | \ - IMA_BPRM_APPRAISE | IMA_READ_APPRAISE) + IMA_BPRM_APPRAISE | IMA_READ_APPRAISE | \ + IMA_CREDS_APPRAISE) #define IMA_APPRAISED_SUBMASK (IMA_FILE_APPRAISED | IMA_MMAP_APPRAISED | \ - IMA_BPRM_APPRAISED | IMA_READ_APPRAISED) + IMA_BPRM_APPRAISED | IMA_READ_APPRAISED | \ + IMA_CREDS_APPRAISED) enum evm_ima_xattr_type { IMA_XATTR_DIGEST = 0x01, @@ -108,6 +112,7 @@ struct integrity_iint_cache { enum integrity_status ima_mmap_status:4; enum integrity_status ima_bprm_status:4; enum integrity_status ima_read_status:4; + enum integrity_status ima_creds_status:4; enum integrity_status evm_status:4; struct ima_digest_data *ima_hash; };