From patchwork Mon Jul 16 18:23:38 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10527559 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 98BEE6037E for ; Mon, 16 Jul 2018 18:42:06 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 101CC28DCE for ; Mon, 16 Jul 2018 18:41:54 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 03DA928DDD; Mon, 16 Jul 2018 18:41:54 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI, NO_RDNS_DOTCOM_HELO, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from upbd19pa10.eemsg.mail.mil (upbd19pa10.eemsg.mail.mil [214.24.27.85]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C724828F52 for ; Mon, 16 Jul 2018 18:41:50 +0000 (UTC) Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.3]) by upbd19pa10.eemsg.mail.mil with ESMTP; 16 Jul 2018 18:41:47 +0000 X-IronPort-AV: E=Sophos;i="5.51,362,1526342400"; d="scan'208";a="15798695" IronPort-PHdr: =?us-ascii?q?9a23=3AikSJDR9eU2PNMv9uRHKM819IXTAuvvDOBiVQ1K?= =?us-ascii?q?B62+wQIJqq85mqBkHD//Il1AaPAd2Fraocw8Pt8InYEVQa5piAtH1QOLdtbD?= =?us-ascii?q?Qizfssogo7HcSeAlf6JvO5JwYzHcBFSUM3tyrjaRsdF8nxfUDdrWOv5jAOBB?= =?us-ascii?q?r/KRB1JuPoEYLOksi7ze+/94HSbglSmDaxfa55IQmrownWqsQYm5ZpJLwryh?= =?us-ascii?q?vOrHtIeuBWyn1tKFmOgRvy5dq+8YB6/ShItP0v68BPUaPhf6QlVrNYFygpM3?= =?us-ascii?q?o05MLwqxbOSxaE62YGXWUXlhpIBBXF7A3/U5zsvCb2qvZx1S+HNsDtU7s6RS?= =?us-ascii?q?qt4LtqSB/wiScIKTg58H3MisdtiK5XuQ+tqwBjz4LRZoyaOuB+fqfAdt0EQ2?= =?us-ascii?q?RPUNtaWyhYDo+hc4cDCuwMMuFaoIbnp1sOqhy+CRC1CO7zxDJFh2L60bQm3+?= =?us-ascii?q?g8DArK2BIsE84LvHnSsd77NrodUfqtwafWwzXNb/BY1znz54fHcB8vvOmMUL?= =?us-ascii?q?Btfcff1UYhGB3Kjk6LpIz5PT6YzPgBv3SV4uZ+U++klm4pqxt2ojiq3sohlJ?= =?us-ascii?q?PGhpkLxVHE6C533Zo6Jd2iR05mb96kFIVftzuHPIZxXswtWXpotzg6y7Adop?= =?us-ascii?q?60YCgKx446xx7Rb/yIbZKI7gv/W+mLOzt3mHVleLemihu07EOuyfX8W9Gp3F?= =?us-ascii?q?tFoSdJiNnBum0X2xDN5cWLVOFx8lq51TuO1Q3f8PxILEEwmKbBKpMswqQ8mo?= =?us-ascii?q?QNvUnMGCL9hV/4g7WMdko+/+il8+HnYrL7qZCCL4J0kQT+Mrg2msy4HOQ4Lh?= =?us-ascii?q?ACX2iF9uS4073u5VH5T69Qjv03j6nZq4rWJcUdpq63BA9VyZgs5AqlAze60N?= =?us-ascii?q?UXgXkHLFVfdBKBk4fpIE3BLOr9Dfe+h1SgiDZrx/bYMb39GpjBM3fOnbj7cb?= =?us-ascii?q?t99kJQ0hQ/wN9B655OF70NOPfzVVXwtNzcAB85KQu0w+P/BdVmyIweXWOPAq?= =?us-ascii?q?mEMKLdqFOH/eUvI/SKZIAJpjn9MOMo5+LujHAlmV8derOl3Z0MaH+iBPhmLE?= =?us-ascii?q?KZYWT0jtcbDWgKphY+TPDtiFCaUz5TYHCyULgg5jE7Eo2mC5zORoKqgLyH2S?= =?us-ascii?q?e0BIZWZnxYBVCWCnfkbYKEW+0DaCiKOM9ujiQEVaS9S48mzRyutg36xKB7Ie?= =?us-ascii?q?rX4S0YspTj1Nlr5+DImxEy8SF0DsuG3GGQSWF0gn4ISyUx3KBlrkx30k2D3r?= =?us-ascii?q?Rgg/xECdxT4OtEUwk7NZ7Yyux1FcryVxnPftiXVVmmRc+mDispTtIrxN8OYV?= =?us-ascii?q?hyFMm+jhzZ2CqqGbAVnaSRBJMo6qLcw2TxJ8FlxnfGyakhlUUpQstINW28na?= =?us-ascii?q?N/6gvTB5TTn0WfiamqabwW3DTR+2eb0WqOoEZYXRZtXqrZWHAfYU3Wrcjk6k?= =?us-ascii?q?7ZUb+hF64nMgpAyM6FLKtGcNvpgktaRP37ItTRf3qxm3usBRaP3r6DcZbqdH?= =?us-ascii?q?8H3CjGFEcElAUT8mqcOgglGietuWTeAyJyFVj3eUPj7fF+qG+nTk8z1wyKbF?= =?us-ascii?q?du17my+h4InvGcSOkc3rEDuCc8sTl0G0y9393OAdqauwVhZLlcYc864Fpfz2?= =?us-ascii?q?3WqhZ9Pp2+IKB4nVMRaRh4v0b02xVwEIVAntAgrGk2wwpqNaKYzFRBeiuC3Z?= =?us-ascii?q?/tJ7LaMWby/BWgaqLM3FHRzsqW8L8V6Psks1XjoB2pFk06/nV83dlVyXyc5o?= =?us-ascii?q?7WDAcJSpLxVEE39hZ/p77AZCkx/YXU2mNwMaOsqD/Nx8opBPc5yhanZ9pePr?= =?us-ascii?q?mLFAvuE8IEHciuM/cnm0a3YRIeJ+9S6as0M9mhd/uc166hJPxgky6+jWRb/I?= =?us-ascii?q?B91VqB9yx9Su7M25YK3eqY0xCdWDjillehtdr7mYdeZTEdBmC/0zTrBJZNZq?= =?us-ascii?q?1ueoYGEXmuI8yrydVigJ7tQWRU+0KjB1MB3s+pdgGfb1j83Q1Wz0sXu3unlT?= =?us-ascii?q?G/zzxunDEjtrCf0zDWw+T+aBoHPXZGRG1jjVf3PYi4lssaU1asbwgokhul+E?= =?us-ascii?q?n7yrNApKRnLmnTR0ZIcDTtL214VKu/qKaCadZV6Jw0qSVXTPi8YVeCR77npB?= =?us-ascii?q?sa1yfjEHVExD8ncDGrtI70nwdniG2BN3Z/tn3Zedt/xR3H/tzTWeZR3iYaRC?= =?us-ascii?q?l/kTTXBUazP9+y/diPlJfMrOa+V3mnVpJNbSnn14SAtDG05WdyGx2wg+izms?= =?us-ascii?q?H7EQg9ySL7z8NlVTjMrBnieonkzaK6Mf55cUlyH1L89tF6FZ9kkosrnp0Qwn?= =?us-ascii?q?8ahoiP/XUbj2jzP9Jb2bjxbHUTXzILxcDa4BT90k15Mn2J3575VmmawsZ5ed?= =?us-ascii?q?m6ZH4Z1zkj78BMFaiU7KZInS1rrVqktQjRe+Ryni8Byfsy734Xm/kJtxAwzi?= =?us-ascii?q?WZGb0dAUhYPTDslhiR4dCxtqNXaHyocbiq20p0hcqhA62aogFARHb5fY8vHS?= =?us-ascii?q?Fq4cV5LFLM13jz55rqeNbOcN0TsQeUnA3Yj+hPL5IxlOQFijZ7OW7nun0l0e?= =?us-ascii?q?E7hwR03Z6mpIiHN3lt/KWhDx5dLDL1Y8cT9S/xjaZChMmZxZuiHpN/FTUXR5?= =?us-ascii?q?vnUeinECoMuvj9MQaBDiE8oG+BGbXDBQ+f9Ftmr3XXHpClLXGYOmQWzc54Sx?= =?us-ascii?q?mbOExfhxsUUS4gkZElEwCm3svhcF125joJ/F73tgNMyv50Nxn4SmrfvBmnZS?= =?us-ascii?q?wqR5iZLRpW8gZC6lzUMcOA8O18ATtU/pq7rAyCMmabfRhHDXkVWkyYAFDuJq?= =?us-ascii?q?Kh6sLH/+icB+q+NOfOYa6UpexFSfiH2Yij0pB48DaIN8WPOGRiDvIg10VfXX?= =?us-ascii?q?F5AdnZmy4VRy0ZjS3Nc9WbpBC6+iFtqcC/6vvrUhr15YSTE7tSLclv+xeujK?= =?us-ascii?q?iYNu6QiyF5KTBD25wR23DH07kf00QUiy10cDmtC7sAvzbXTK3Mgq9XEwIbay?= =?us-ascii?q?RrOcRS4KIzxBdNNtDAh9Pyzr53kPg1C1JfWlzgnsGmfssKIm6nOFPAHkaLO6?= =?us-ascii?q?yMJSfXzMHvfaO8VbpQgf1Itx23vDaXCVXjPjOCljb3URCgKvtMjCaFMxxdo4?= =?us-ascii?q?yybhFtCW3/Q938cR27LMV7jTsozr0onnnKL3ITMSBgc0NRqb2d9SFYgvV/Gm?= =?us-ascii?q?xZ6XplKeiEmzqH4OTDL5YWsOdrAj5qmO5A53Q60bRV5jleRPNpgCvSssJuo1?= =?us-ascii?q?a+n+mMyjtnVARBpy1OhIKMs0ViN7vW9oVcWXbE+xIN6HufBw4Mp9R7Ft3lo7?= =?us-ascii?q?pQxcTXlKLvNDdC9MrZ8tUEB8fOMsKHMWEhPAHxGDHOFgsFTCWrNXnbh0NHjP?= =?us-ascii?q?6d6GeZrp8gqpjjgJAOUKNUVEQpFvMGDURoBNoCL4ltUTMgirObj8kI5WGirB?= =?us-ascii?q?bLQsVapZPHVvOIDfXpNjmZkaFOZwEUzrPgMYQTKor71lR4alZkh4TFBVDfXc?= =?us-ascii?q?pRrS1hdQI7u0RN8GJjQW001ULlchmt72ETFPKumB45lBd+a/w39Djw+1c3Ok?= =?us-ascii?q?bKpCwonUYsntXlhzaRfyPvI6e0XIFbEDD7uFYrMpP8WQp1aheynUN8PjfeW7?= =?us-ascii?q?1Rl6dgdXxsiALEpJRAA+BcTaxZbx8L3vyYfe8o0U5bqiSp3k9I+/fKCYZ4lA?= =?us-ascii?q?srbZ6tr2hM2wR9Y94pPabQPrZGzkBMhqKSuS+lzuQxwAgEJ0kT9mOTeSkItV?= =?us-ascii?q?cHNrkgOiqk5Ots6RaNmzFbYmgDS+Iqou529kM6I+mA1Dzv07pCKkC3KuyeIL?= =?us-ascii?q?iUtHTHlc6NXlw/zFgIl1Vf8bhwz8gjb1KeV1ozw7uJCxQJKc3CJBlJb8pT8X?= =?us-ascii?q?jTejqOseXNwJ9uIoq9F+DpQvWVu6oOhEKrAhopFZwW7ssdBpmszF3YLcD/Ib?= =?us-ascii?q?EfzRUt5RjkK0udA/RMeBOLljAHo8elw5JsxoZdJysSAWNkPSW5+7bbvAkqj+?= =?us-ascii?q?SfXN0ueHcVQpMENm4qWM29gyNWpGpPDD+s3+0D1QeC8SHzpj7LDDbmddpiZO?= =?us-ascii?q?2YZRR2CNG54T8/6bS5iUbL8pXCIGH3LdtiusLO6eMeo5aIFfZUQKJgvEjCgI?= =?us-ascii?q?ZYRmalU2jVHd6yPZjwZJEmbcboBXaiTly/lzU1Qt/rPNarL6iHnQHoRYFQsI?= =?us-ascii?q?mAxD4tLNKzGCsCFhl3vOwM+KV8ZQgfbJUheh7oqx4yN6qhLweEyt+uWXqiKS?= =?us-ascii?q?NKT/lDyuW3f6ZXwDA2bu+903QtVY06z/Ot/k4TWp4KihDexfCsZ4laUCjzFX?= =?us-ascii?q?xdexnBpSUjjWhhM/w+wuEhzxPUqVMcKSyEdPR1aGxYuNExHV2TLW9qBWo4Rl?= =?us-ascii?q?+ciIvD7RSv370J/itSgchb3vNfvHj5pJ/fbyqmWLa3ppXNryogcd8mrrV0MY?= =?us-ascii?q?P5OMuGt43RniDeTJnWvQ2ISyC7GOBcmtdMJCJYR+RIlnw+OcAcv4pO91YxXN?= =?us-ascii?q?8kJ7NTEKksuqyqaT18ACEI1y8ZSoWA0CYBguqn2rvalxaQcIg5PxAetpVNnM?= =?us-ascii?q?cdWTZsYiwCvK+jS5nWl2icR2gKJgcT8RpD5AYemY91YO/l/JDITZ9Xxj5Ru/?= =?us-ascii?q?J7TC3LFpxy+Fv6TmGZml/4Sfq7n+yuxwJSw+rm0sMHVx5nFUhd2+FWm1M0KL?= =?us-ascii?q?FwLqkdpZLKviONdUzhpm7tzvWpJEVJw83Oa1L4FJbFtXb7UiAE+30UQpFAxW?= =?us-ascii?q?rCGpsMiAp2drwrpElSL4+7YEr+4SIrx5hxFbmiSc+r30olrWoBRyqyHdpBEf?= =?us-ascii?q?tpsFTLVz1keJCms5DlO41TQmNJ452cpUxZnF9qMy6jxppWM9tN7SIUXDhTvT?= =?us-ascii?q?Wdu8O/SNFe1sBrDp8DONN/tmzhF6NDPZiev2c5uqfzynPD/TAzrku6zi2pG6?= =?us-ascii?q?CkV+JZ43EeGgIxKmSGsUkvE/Ej/XrO8l3WqVB0+PpbBqKTgkpvpjZ9AopOCS?= =?us-ascii?q?xN1Xy/KFRzVnZGuf1AKKvJa8xcX+UyZRi3NhMlG/4pw1CF8ENpkXr3eCF9qg?= =?us-ascii?q?xa+yXBUAYuTikVnq3hmTsApcG7ITUaUY5HbS09byfZLAKWgTpXswhCZEFqQZ?= =?us-ascii?q?8ZHs1I+7Uc3YtK4MXOV1qjKSYYUxN8LA441+RQlVJbukWCZS/dFRaoderIsh?= =?us-ascii?q?BvYceRttCmI+rk8wpcl4PntPw4978ZSH24mA2tRtTeoJHgttGQsUuObqj4Of?= =?us-ascii?q?WmYXDdVDjMkQywhbA8ApnI5SfTKg1bK4J+yXU+f5jsEmvLPQlCJ6IHJkpUSa?= =?us-ascii?q?F6Zs9AouBBfcNkf7wJ+aB1DBKdWhzvAJCvrOVBLlvLRzTRNSOB8uKloYLU8L?= =?us-ascii?q?PSV/PtZtCWyHbBWKJ3OY126T/lFLf2yYVe4Fb52u9x9kNmTljLKyaBrND6Kw?= =?us-ascii?q?MK4smic1HuvpwvHTPYGpd/imHtxl1ad8oKXyKq7IkYyIlH53rqTuJ4yEfzuv?= =?us-ascii?q?VI97Z48Yk3/6xpycCsKKfUKPRVrUhnAhyOCQVx7JktAW9/R2dKYu8KM/rReK?= =?us-ascii?q?sUjM/0p+DwDawX5wWf+/ZFZtvfO0HBhs6/BymARhNemAcOtyUaLhec1v6CgK?= =?us-ascii?q?J0Utqqpenn1UIr/1i+LwQJwKpr5Yia5qqCvPXXYAfJzbgYRqjqQdv+rrA3u0?= =?us-ascii?q?OX5fApj7AOdXJobA2gCugSTNYdxn3nzaAo0y0jD9/DE6jn+P5ZWHIzhijglI?= =?us-ascii?q?xlH1UKBvMUGqKG/YZfnmc9gOHZM8MZc6BclWaVFB6kFLACxWSt6ySJPGlvmg?= =?us-ascii?q?vO3A3oQWOv8F/2qjd1QSrNztj5iEVaSqK6BVxMUCq1J0B3rCmDPA3ytNr4oa?= =?us-ascii?q?419l05MnT4tNKRk2usIKhYH8zkJN2SOyY0plMXjIEpRtO1xIAbHcGwL8sW8H?= =?us-ascii?q?5jcPTR8X6rkzVGo6ddnYXS+MaV+u/YHXO4la2Vt62NxCxEyng/pVw/8sqvNu?= =?us-ascii?q?3S6N2KTfWo0HwRTyRmtwvaQRG1rr3br1YJOU2Ey0rLgJYFPs1F0nk42EDm4/?= =?us-ascii?q?IjQNEp+AVdCInAffUCqi73ODfuxlafed03XDGE0zRLBlL1DUV4GK8k1WL/os?= =?us-ascii?q?3Jk2vQ+1ovRoV3bEzomxh3D4Q+KUIw51ka2S4DHhYXaRGbFr6kH0LlIpUYVU?= =?us-ascii?q?IbcxSIwKC6ersr3U102r6g+O3TYvZgCKcWKvldiQqOnFxaGp0Iq60eXKxzdE?= =?us-ascii?q?Nd9KLNoQjiEYfnVeD8lXUsLf21Xtxa8ccBunsn5Qa/QQag6Zhd4LsAjZCId7?= =?us-ascii?q?RLYZ7Ss8Bg4UZn4iQPdi9WgBRliRO2T/wcrvj54tfHqJqo9vquVKE1SuUY6x?= =?us-ascii?q?c0HH9+g4Ltjl4sp9/X1uFcSpDaiInk/wBNJmSFuIDE3BVmLuoOMY2rdq5693?= =?us-ascii?q?obPygeO24OPd2OZvk+5C9tMDPT60ZeDcMMYdMYIdfCmAFVik3vQ7FT9cvbF0?= =?us-ascii?q?SGC4dyacAn9W73xy008ZcmVObv9iO2L4jF715RJ/NDkDlslNXaqegU3/rdEi?= =?us-ascii?q?4X7GKdaxho3yyCyp6NC+3q8eWL0tHUWEsMHjQqXIdFODqC5QunS/K3lJr3XA?= =?us-ascii?q?OU5MvzjYkwdU2KQHy+grgFvrxKEeFeliXxxiJeGZzth/KJr9qs73NatlJDEI?= =?us-ascii?q?Z04xzKBqFfPpFgNBTjkcmrQEl8CTfldMHSaBUupPKcxv0Q7OVmK0v+eYgbLw?= =?us-ascii?q?oBy7L76npVTQxuRaX0vlmDXuIRY91mR+3CrnxP74JvNbMPNkCHpJP2tjdItE?= =?us-ascii?q?w2AAgxZbArsDNacFXOkRZOW6bwv74AlhccUcBntkBRA26wP3g+5zXfX6RPkK?= =?us-ascii?q?aREOAV8imUTqEWS0VoNSd+TAmv2JRgfLupmf5Hv3hDniN6p/gqyCJpSwemuS?= =?us-ascii?q?3rvKINwjMg+Le3tDkbvnxFVOqemT/SCVpf1PQKkbscC3H65FyyfnYDaIry4K?= =?us-ascii?q?F5Ksn79Igh4nE/YRA9cC0cWeSvFTv8j6SSAoyAqNhcngKCuN3Sbb+vKigfLr?= =?us-ascii?q?o8yQr5R3h8zgfRgg1l8G4KQjW89t8rOp+xOcE/xiqnAWLbbkoD4rtVsMvtsl?= =?us-ascii?q?4GVOw2aVd/z2h4ysiHQjcCRNfTG2Y0kgckdX9Ef4xd5hMAEaknnCqItLFc/g?= =?us-ascii?q?4IeDfUDpil+o7IkMfM2Hk9S8pqx23Pqq2Bh5Mqy2Flm8hv4y6PonsScevYX9?= =?us-ascii?q?VrAnjp2YdV0fb+aOm1suAbVItmz6ysUPoYPca/+Wu22ZNqWki+y7QAHlq5Nv?= =?us-ascii?q?EMxrPaUyejVG2ZVv6Hc2+WnzY2KkTy/wWnLkUraMdWqE8wKunCiYRflw3mSr?= =?us-ascii?q?x5XTiQpVnHzGwjNuMaag02uIe7ewAQSu4eefScL/A0wPIiEFsMc2PJHSxuBu?= =?us-ascii?q?+tv16tmZR0NnRj7Ejhf+Ti7BrmMNqTGxkDF47WtJhx9uKmRjHJBXg16CZXdB?= =?us-ascii?q?1w9uHCBxEqu+RBaZeNjJ3VgNhm1eMtafhgK2s+t8QVl4Yl7pObhoPCVTL169?= =?us-ascii?q?6mIdDTv+jdAPDFyUkuUn9VX6BfYg7v4Yg+eNkjVOuXVYNQoBBUIK89WpFpY3?= =?us-ascii?q?/46aVcNApudkvUY7Ouj4/hoefdItNvu3LO7l82ZBzZshkHx+38GRd3dLi2ln?= =?us-ascii?q?7yJ9Y2XTsHoNpzXF8uJ6YHP8IGshrvV4WZnKC9ls+Z51Jxu+hMt7H5TP/Nyo?= =?us-ascii?q?L9l89KerFxxgmHPS3aGbJwqkBklfipxK+ZlJ7rBomqLeghfcNYB2LEcbTbBZ?= =?us-ascii?q?6XLjOVJtm6IxcA9KSThvYxcBKRYmjbWKqPsjapMr0w40I7zMp6e+rayicg6Z?= =?us-ascii?q?nQ0d31YWBQryPlpnmMYt8Xz1HHHqT1WBVXAa6G/Wt+FqoQbqP/9P0JNN0/xZ?= =?us-ascii?q?6b+QYlqHx+3deePq/pjkbK1kszIYrWKkT02iB8WoQQJhm7GUpphWjHpzLGCH?= =?us-ascii?q?dBNMHiL8Qrgs7DSlTP7kx8gikIYXRbG3GgEdWUPnIB2tmWYgSP+QMNCMwMyb?= =?us-ascii?q?2ZY0k944a7UuR5cq5Omey3urEKi549ICjUSdlyJCrQJaJ4OjdLS+7G4lMvZ0?= =?us-ascii?q?hX4PAORo4paM3Wcws8O0CaxHa3nFOYix/9asCs2aCVIS0f7nRAyfff3CNRox?= =?us-ascii?q?Wi46rC0PDbfJuCR6nfBKKUPScgTT7cQD0zFQCs+FP33phMp+KWdEEYpF1ceS?= =?us-ascii?q?eOEEgLvKk6ptHLA377guZjdYAEgP2AHiv5DiZ/kflXZG5QrU7ZZf0FGEHNam?= =?us-ascii?q?P5xm9VuQisPPhJqHnsdLCJ7rFeW+ULDI9BaLiSSp3TfvUNQlVgjS0XbcC7ed?= =?us-ascii?q?CUtLMlyhTIQG8eRrHP70GbRVWKT+a03DXtXI5O59Jx4Hpu8dXWhSptVaHBPr?= =?us-ascii?q?LZqCf3tJ+xjCGf/+bZUzpIAQQ5g+MHVXGI2wIIaHoFBNccpFz3T+aealxN2n?= =?us-ascii?q?MkhaMm2xIFdAlpFHw7+mxfnPG6XMZeTFM=3D?= X-IPAS-Result: =?us-ascii?q?A2C9BwBw5kxb/wHyM5BcGwEBAgMBAQoBAYNHgQlKEiiMX?= =?us-ascii?q?409gSGBX5J5gVsuFIUEgkA4FAECAQEBAQEBAgFsHAyCNSSCXgMDAQIkEwYBA?= =?us-ascii?q?QwgCwECAwkBAUAICAMBLRQBEQYBBwUGAgEBARgEgn+BaAMVA54/ihuBaTOCc?= =?us-ascii?q?QEBBYECAQFfgjUDgycIF4dUgy2BESeCNYIJgnQBEgGFdYdfCIRyPS5Ai1oJh?= =?us-ascii?q?ViJSWqHVYUsjD+HLSFhcU0jFTuCaYIlF4NFihwBVU98imCCOQEB?= Received: from tarius.tycho.ncsc.mil (HELO tarius.infosec.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 16 Jul 2018 18:41:46 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus.infosec.tycho.ncsc.mil [192.168.25.40]) by tarius.infosec.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w6GIfjdB023709; Mon, 16 Jul 2018 14:41:45 -0400 Received: from tarius.infosec.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id w6GINdgS024374 for ; Mon, 16 Jul 2018 14:23:39 -0400 Received: from goalie.tycho.ncsc.mil (goalie.infosec.tycho.ncsc.mil [144.51.242.250]) by tarius.infosec.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w6GINjhQ020802 for ; Mon, 16 Jul 2018 14:23:48 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A1CpBgCx4Uxbly0bGNZcHAEBAQQBAQoBA?= =?us-ascii?q?YNGgWUog3yIY4tdgWCBIYFflF+EdwJCgh8hOBQBAgEBAQEBAQIUAQEBAQEGGAZ?= =?us-ascii?q?MhUMDAyMEGQEBNwEPJQImAgJFEgYBDAYCAQGDHIFoAxUDnj2KG257M4JxAQEFg?= =?us-ascii?q?QIBAV+CNAODJwgXdIZggReCFoERJ4I1ggmGKIJVh18IhHI9LkCLWgmFWIlJaod?= =?us-ascii?q?VhSyMP4ctgXNNIxU7gmmCGQwOCRGDNIocAVVPjhUBAQ?= X-IPAS-Result: =?us-ascii?q?A1CpBgCx4Uxbly0bGNZcHAEBAQQBAQoBAYNGgWUog3yIY4t?= =?us-ascii?q?dgWCBIYFflF+EdwJCgh8hOBQBAgEBAQEBAQIUAQEBAQEGGAZMhUMDAyMEGQEBN?= =?us-ascii?q?wEPJQImAgJFEgYBDAYCAQGDHIFoAxUDnj2KG257M4JxAQEFgQIBAV+CNAODJwg?= =?us-ascii?q?XdIZggReCFoERJ4I1ggmGKIJVh18IhHI9LkCLWgmFWIlJaodVhSyMP4ctgXNNI?= =?us-ascii?q?xU7gmmCGQwOCRGDNIocAVVPjhUBAQ?= X-IronPort-AV: E=Sophos;i="5.51,362,1526356800"; d="scan'208";a="324720" Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.35]) by goalie.tycho.ncsc.mil with ESMTP; 16 Jul 2018 14:23:48 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3Au2COjhb6AQ3mi9JrBWcU2az/LSx+4OfEezUN45?= =?us-ascii?q?9isYplN5qZps67YB7h7PlgxGXEQZ/co6odzbaO7ea4ASQp2tWoiDg6aptCVh?= =?us-ascii?q?sI2409vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6nK94iQPFR?= =?us-ascii?q?rhKAF7Ovr6GpLIj8Swyuu+54Dfbx9HiTahYL5+Ngm6oRnMvcQKnIVuLbo8xA?= =?us-ascii?q?HUqXVSYeRWwm1oJVOXnxni48q74YBu/SdNtf8/7sBMSar1cbg2QrxeFzQmLn?= =?us-ascii?q?s65Nb3uhnZTAuA/WUTX2MLmRdVGQfF7RX6XpDssivms+d2xSeXMdHqQb0yRD?= =?us-ascii?q?+v9LlgRgP2hygbNj456GDXhdJ2jKJHuxKquhhzz5fJbI2JKPZye6XQctQYSm?= =?us-ascii?q?VbXsZRUCtBDpqlY4YTAecMPPtUo5Dhq1cTsBCyARegCP/qxjJOm3T437A10/?= =?us-ascii?q?45HA/bwgIgEdIAvnfaotr7O6gdU/y6wqbTwDXfbf5bwyvx5JTGfx0jp/yHQL?= =?us-ascii?q?J+cdDWyUkqDw7IkE+fqZf7MDKVy+8DrnSU7+p6WuKyhW4nrx9+oiKyzcorlo?= =?us-ascii?q?bGnJkVxU7E9Chi24Y6Od24R1RmYd6qFJtfqTuaO5JqTcw4WW1npCE6yrgftJ?= =?us-ascii?q?O9YSMEy4wnygbBZ/CafIWE+AzvWemLLTtmhn9pYr2yihaq/UWhyODwTNS43V?= =?us-ascii?q?dOoyZfk9TBtmoB2wLN5sWITPZ2412v1iyV1w/J7+FJOUA0mrTfK54m2rM/mI?= =?us-ascii?q?Adv0rdEyL4hkj4lrObelkl9+Sy9evofLDmpoSTN4NujwHxKKUumsilDeQ9Mw?= =?us-ascii?q?gOW3CX+eW61LL94U30WKtGguA5n6XDrpzXKt4XqrC7DgNP3Ysu6w6zDzK839?= =?us-ascii?q?QZmXkHIkhFeBWCj4XxJ17BOuv4Aum/glm3izdk2/DGMaf8ApXDKnjMjq3hca?= =?us-ascii?q?9h5EFG0gY80ddf55dMBrEbPP3zQlPxtMDfDhIhKAy73eLnCNR71oMDVmOCGb?= =?us-ascii?q?OZMaPOvl+I4eIjOe+MZJQPtzrnJPgl4ODu3jcFngo5RozhiZ8Wbm2oW+9rKF?= =?us-ascii?q?iDYGb9x9IGHXoOsyIgQ+Hwzl6PSzheYzC1Ra1qonkfK6aDRdPHR4awkPmC0T?= =?us-ascii?q?29E5l+eG9LEBaPHG3ueoHCXO0DPmbaGsZ8lnQhUr+7Rsd1zRizsCfiwqdja+?= =?us-ascii?q?/T/TcV85nk0Y4xr9bPmAky+Do8NMGU12WAXikghW8TbyMn16B450pmwxGM1r?= =?us-ascii?q?Yux7RjOJR35vVUQk9uLpPYzupnG/juSwnBeZGPU1/gTdK4V3V5BOkU6vQtJk?= =?us-ascii?q?p8AN6/lQvr2yuxH6RTz+XNA4Y7uOqI5F3YDOU4x3fd37Q6lHEiQ9BTLiv+3+?= =?us-ascii?q?h47QeFQ8brlEWf34Stda0axyPLvDOBymqI+kNfUAd2SqjDdXsWYEzQrN/w4g?= =?us-ascii?q?XJSLr4TfwEPwZageWFLagCPt7kgE5NQ/DgEN/eeWW0mnq1QxGSyeXIJLbnZ3?= =?us-ascii?q?4A2239AU4ImkhH5XuAOhU/AGKirnjYAThGFBfrZF3ht/J3q26hRwkywkeIdx?= =?us-ascii?q?sln5i8/xMOzdmbUekSxfpQuiImsS91B3671tfbCpyHvQU3L4tGZtZoy15c2H?= =?us-ascii?q?ORjAd9N4GuK614zgoVeh96rmv13BV+F4tEnNJvp3psxw13f/HLmGhdfi+ViM?= =?us-ascii?q?ijcobcLXP/qVX/M/SMiFjDzNab/LsO4/0kqlLl+RukDVcm7249iIQH7kOwzc?= =?us-ascii?q?7hNCNKDdT8X0Ms+F5/rrDeJCw849CczmViZI+ztDKKwNc1HK090B/1dN5EPb?= =?us-ascii?q?KsDwTyGtAUA8W0becj3VOua0FMJ/hcoYgzOc7ubP6awOiuNedkkiihiDFM6Z?= =?us-ascii?q?tww2qX/Cp1V+DM0oxAyPje1QyCBH/nlFn0lMfxlMhfYC0KWGqyzS+xHIlKeq?= =?us-ascii?q?h7ZpoGE0+1JMu2zY4m3du3CzhT81i4AklA3caofVyddgW7zARQ0kNRqnuiym?= =?us-ascii?q?O0zD1xxikgtbHXnDfPzOLraAcdNyZVSXNjg1bhLcn8j90TUEWyKQl8vAqs5U?= =?us-ascii?q?H9gaNcoak=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AqBgD44Uxbly0bGNZcHAEBAQQBAQo?= =?us-ascii?q?BAYNGgWUog3yIY4tdgWCBIYFflF+EdwJCgh8hOBQBAgEBAQEBAQIBEwEBAQE?= =?us-ascii?q?BBhgGTAyCNSSCXgMDIwQZAQE3AQ8lAiYCAkUSBgEMBgIBAYMcgWgDFQOePYo?= =?us-ascii?q?bbnszgnEBAQWBAgEBX4I0A4MnCBd0hmCBF4IWgREngjWCCYYoglWHXwiEcj0?= =?us-ascii?q?uQItaCYVYiUlqh1WFLIw/hy2Bc00jFTuCaYIZDA4JEYM0ihwBVU+OFQEB?= X-IPAS-Result: =?us-ascii?q?A0AqBgD44Uxbly0bGNZcHAEBAQQBAQoBAYNGgWUog3yIY?= =?us-ascii?q?4tdgWCBIYFflF+EdwJCgh8hOBQBAgEBAQEBAQIBEwEBAQEBBhgGTAyCNSSCX?= =?us-ascii?q?gMDIwQZAQE3AQ8lAiYCAkUSBgEMBgIBAYMcgWgDFQOePYobbnszgnEBAQWBA?= =?us-ascii?q?gEBX4I0A4MnCBd0hmCBF4IWgREngjWCCYYoglWHXwiEcj0uQItaCYVYiUlqh?= =?us-ascii?q?1WFLIw/hy2Bc00jFTuCaYIZDA4JEYM0ihwBVU+OFQEB?= X-IronPort-AV: E=Sophos;i="5.51,362,1526342400"; d="scan'208";a="15797531" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from updc3cpa06.eemsg.mail.mil ([214.24.27.45]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 16 Jul 2018 18:23:47 +0000 X-EEMSG-check-005: 0 X-EEMSG-check-006: 000-001;3c46cbcc-3576-4dbc-8a6c-3f2c29b68c1c Received: from localhost.localdomain (localhost [127.0.0.1]) by UPDCF3IC06.oob.disa.mil (Postfix) with SMTP id 41TsHQ75LQz19Yth for ; Mon, 16 Jul 2018 18:23:46 +0000 (UTC) Received: from UPDC3CPA04.eemsg.mil (unknown [192.168.18.11]) by UPDCF3IC06.oob.disa.mil (Postfix) with ESMTP id 41TsHQ0Ynrz19Ytd for ; Mon, 16 Jul 2018 18:23:46 +0000 (UTC) Authentication-Results: UPDC3CPA04.eemsg.mail.mil; spf=None smtp.pra=casey@schaufler-ca.com; spf=None smtp.mailfrom=casey@schaufler-ca.com; spf=None smtp.helo=postmaster@sonic302-28.consmr.mail.gq1.yahoo.com; dkim=pass (signature verified) header.i=@yahoo.com X-EEMSG-check-008: 254759389|UPDC3CPA04_EEMSG_MP20.csd.disa.mil X-EEMSG-SBRS: 3.5 X-EEMSG-ORIG-IP: 98.137.68.154 X-EEMSG-check-002: true IronPort-PHdr: =?us-ascii?q?9a23=3A7jjU6x+5QbIafv9uRHKM819IXTAuvvDOBiVQ1KB+?= =?us-ascii?q?0e4UIJqq85mqBkHD//Il1AaPAd2Fraocw8Pt8InYEVQa5piAtH1QOLdtbDQizf?= =?us-ascii?q?ssogo7HcSeAlf6JvO5JwYzHcBFSUM3tyrjaRsdF8nxfUDdrWOv5jAOBBr/KRB1?= =?us-ascii?q?JuPoEYLOksi7ze+/94HSbglSmDaxfa55IQmrownWqsQYm5ZpJLwryhvOrHtIeu?= =?us-ascii?q?BWyn1tKFmOgRvy5dq+8YB6/ShItP0v68BPUaPhf6QlVrNYFygpM3o05MLwqxbO?= =?us-ascii?q?SxaE62YGXWUXlhpIBBXF7A3/U5zsvCb2qvZx1S+HNsDtU7s6RSqt4LtqSB/wiS?= =?us-ascii?q?cIKTg58H3MisdtiK5XuQ+tqwBjz4LRZoyaM/hxcbndfdMdQmpNR99dWjBPD469?= =?us-ascii?q?cocDFvYNMftFpIX5uVcCsR6yCA+xD+3t1zBInGf707Ak3eQvEQ/I3wIuENwBv3?= =?us-ascii?q?vWsNr7O7wfUfy3waTS0TnPc/1b1DX75YPVch4hu/aMXbdofMfP00YvDB3Kj1WN?= =?us-ascii?q?ooL4IzyV1v4Cs3WV7+pkS+2vkXMspgZtrTe13ccjlInIi5kOyl/Y9SV22ps1Jd?= =?us-ascii?q?O8SEFle96oCYdfuDuAO4RqRcMiRnhltSAnwbMFoZ62ZCwHxZc9yxLCZfGKcZKE?= =?us-ascii?q?7xPgWeqLPDt1hH1odKq+ihuw60Ss1+zxW82u3FtLridJiMfAum4C2hHV98OJUO?= =?us-ascii?q?Fy/l271jaKzw3T6v9LIUQzlafDMJ4hxbgwlpsPvknNAiP6hlz6gLGVe0k+5ueo?= =?us-ascii?q?7OLnYq7jpp+GLYN0jxvxMqUqmsClDuQ4KxUCU3Kb+Oum1L3j+kr5TK9Wgf0xl6?= =?us-ascii?q?nVqJHaJcIFqa6lGwJY1oUu5wyiAzqo0tkUh3gKIVFfdB6aj4XkNEnCIPXiAve+?= =?us-ascii?q?h1Ssni1rx/fDPrD5HprCNGPDn6nhfLtm8E5T1AozwspC55JaDrEOPujzVlbtu9?= =?us-ascii?q?PCFBM2Lwu0w+P/BNVnyoweQX6PArOeMK7Kql+H+OYvI+iKZI8ItzfwMOQl5v7y?= =?us-ascii?q?gn85nl8RZ6+p3YANZ3yiEfRmJFuZMjLQhYIlKkJC6g4/SvH6zUaPWiNJZmqjGq?= =?us-ascii?q?c76iw/Baq4AorZAIOgmrqM2GG8BJIAIihiKXSpWSPsdoOZS7IPZTiUL8tJjDMJ?= =?us-ascii?q?T/6iRpUn2BXosxX1nf4vFuPJ/mU9spX52ZAh/+TOkTkq/CFwSsGa1HuACWpzmz?= =?us-ascii?q?VMDwQq0bh/rEo18VKK1ax1krQMDtBIz+9YWQc9c5jHxqp1DM6kHkr6U5+tSVC7?= =?us-ascii?q?Up3yGjw1T9Qs0/cSck19HJOklRmF0C20Vftd3YeuLbcXt67dxHPsPN1Vz3fdyL?= =?us-ascii?q?Jn1wBgRdFAfyXyvYtW3CuWC4/SmFiCjI6udL8Ax2iVrSGE12XY+Al6Vw52GYfC?= =?us-ascii?q?XXkZfUbQ5YD74UPECb2pCb0hKQZH4cWLLKxMa9bgiRNNQ/K1fJz9bm+q00y3Ah?= =?us-ascii?q?XAkrCBYZHhfGIe9C7dEk8Bkh0Wu3GcOl56Thusv3nDC3ROHFTjagu46eR4p266?= =?us-ascii?q?SAo3whuMYklJ1v+x/QAYw+eVSO4J1/QCtWEjs2MwVHS02t/NQ/+HvRBgZ+0IY9?= =?us-ascii?q?Y6+k1GzkrfvglwP9qnNa801XAEdAEilEr12gQ/MY5AmNUkqH4whF55ILmVwXta?= =?us-ascii?q?fDORwJ70N6eSIWC09xeqPf2FkmrC2cqbr/9coM8zrE/u6UT5ThNzoUUi6MFc1j?= =?us-ascii?q?6n3ruPCQMTVZzrVUNup0phrLHTfyc56pmR3nQqOq6x4Gebh4AZQdA9wxPlRO9x?= =?us-ascii?q?dbueHVaiQdYRB8GzJugngR2iZ1QPO+UArPdpbfPjTOOP3euQBMglnD+iij8Wsp?= =?us-ascii?q?t61EOHrHImD7SYmZ0CxeqdxE2CXjb4yli464bmkIBDYncZGW/tkSU=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0C/BABK4Uxbh5pEiWJcHAEBAQQBAQoBA?= =?us-ascii?q?YUrKIN8iGONPYEhgV+UX4R3AkKCHxkGBjQUAQIBAQEBAQEBAQETAQEBCA0JCCk?= =?us-ascii?q?jDII1JIJeAwMjBBkBATcBDyUCJgICRRIGAQwGAgEBgxyBaAMVnkCKG257M4JxA?= =?us-ascii?q?QEFgQIBAV+CNAODJwgXdIZggy2BESeCNYIJhiiCVYdfCIRyPS5Ai1oJjyFqh1W?= =?us-ascii?q?FLIw/hy2Bc00jFTuCaYIZDA4Jg0WKHAFVHzCOFQEB?= X-IPAS-Result: =?us-ascii?q?A0C/BABK4Uxbh5pEiWJcHAEBAQQBAQoBAYUrKIN8iGONPYE?= =?us-ascii?q?hgV+UX4R3AkKCHxkGBjQUAQIBAQEBAQEBAQETAQEBCA0JCCkjDII1JIJeAwMjB?= =?us-ascii?q?BkBATcBDyUCJgICRRIGAQwGAgEBgxyBaAMVnkCKG257M4JxAQEFgQIBAV+CNAO?= =?us-ascii?q?DJwgXdIZggy2BESeCNYIJhiiCVYdfCIRyPS5Ai1oJjyFqh1WFLIw/hy2Bc00jF?= =?us-ascii?q?TuCaYIZDA4Jg0WKHAFVHzCOFQEB?= Received: from sonic302-28.consmr.mail.gq1.yahoo.com ([98.137.68.154]) by UPDC3CPA04.eemsg.mail.mil with ESMTP; 16 Jul 2018 18:23:43 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1531765422; bh=dTjdMQ4U/LvBXCv7B1mKLgwJZxWqhdn9rXUeZKqj6qA=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From:Subject; b=IzcUiaSmFJVTRu7jTTCys/sO7g0qEgLoFJMQGie5Zj+lOQw6VL0rxqJpp+9bc6dmp+h+RMBHk4hPwv8TPXixQYcFruOSXdNFEITHL06inWMZLXqV3dubs1T14gsKgATvyzTp6Ciyj1ckXiaQpqp7uzHgLrbVprM51OItAs9RLM9cOk8nfVF4uvZUHWJz54+Nh+A0i/RK6slKU4fwym+H+j+cYyCgFdqoEuhZ+RYaws4S+B/JDuIWSs2Z9QS6hVxwzpUjNbE/8qpQD5JOU2X82BvWdPhLZi7d5vYTyliLVow73EXxqkqOF16n16t1iTZhlmC2B/QmX6DP2YXurLY7Cw== X-YMail-OSG: Lgp46EkVM1lIgbEBX0Yz2y3ASgdw5wkMWLBEb_5hJHg0DTGOC5KQxjZT7N2z6pS X_iqVQoa3B3il2rhiNGMCsP0OjfiXiCqRHeV563WSfoA52jogm8Pa52nGKJRw3trhtlbsitOid.Z 48dBpLOa5f_fr4MCzxCVCY2jFrXcNjX10Ns0orHS9IrXmhtLDOEdWo7n7fiYOubYrN.r0Y.aOqML 52K.W_yECpLVdtFTucSWQpc.c_bK5vqY3xKI_K_QXulTsSVCUM7JnGMyxR58JfAv2fuDtWD8kp3F cIxA_aIDmqpyD8WqW47mr_Iy9BAVXv8gzVy2Qu6kh7Fwn.hQ_qimCLY0sTO9WOmkoQuCaA2JeChZ uNcZoCxYR9_cIS9sF.g_J_Sxz4EQ4wRaQ0dRjYWnCfjOqUsJ737wd7SIo_c4vOJPbA7bDTf7vaqx DWv8qZ.eyj1wmX3Qp5zOqNopOU1E8MkKDdRhiwyN8EB_44IxsqUWEaiV4XRrOwrotHB6d0PtXc3L TV7rywRJlF9W6eH3ZK706EQQ.ogOtTouV8RDnwUM3as7nTK1VBgZCPwiXlUplAh61UBPkNskD_r6 A4dEr4ggr7ItL2rSXGFIwOK7VRHBCFND2zCQrg0cTVbKjq7u2sQKwap3hnCiPj0fG5gW4v4p9rvp Ig_biwyDMk6MpDC2YKOhy8qiFHjldIruOCP4t4wGYOZnSkL7WQGd.U.cA.P41xTzRXNm_upVuJ5J ud3EqUWJYB271dOElNbLp8wS75boUbO1g_aSJUId0V2KIu9EfRl.3oKbB_IoVTQmgQCbtFh3cqIb Bxy0G5lOSbRhWQ3WzmvgDeMI6uu3yd_b2yQB_JxKMfaZ61LTD83T0G474oM3JSoIP3diNJxZHs.K alIG9GV.Yo3CST0GpLwO05YknbbWEEaTF04sSY4Vc4tu.Wyf1So_wMIbaF4wjVqqlcjxNPKq4ODa vIorRrwiuz09hsiwlBhzSCt4hI23bhlJU2nnwvYM.c1FpnAPDHhHf1egp1iDUCibQ8pATp0H2hPQ jbAz0KtFMPXm9Zf.CjYaea230pASynWk- Received: from sonic.gate.mail.ne1.yahoo.com by sonic302.consmr.mail.gq1.yahoo.com with HTTP; Mon, 16 Jul 2018 18:23:42 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO [192.168.0.100]) ([67.169.65.224]) by smtp424.mail.gq1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID d6fd2d3adff339a22520d890755549b3; Mon, 16 Jul 2018 18:23:41 +0000 (UTC) To: LSM , LKLM , Paul Moore , Stephen Smalley , SE Linux , "SMACK-discuss@lists.01.org" , John Johansen , Kees Cook , Tetsuo Handa , James Morris References: <8a325db8-e7eb-9581-2b77-fc987a165df7@schaufler-ca.com> X-EEMSG-check-009: 444-444 From: Casey Schaufler Message-ID: <3caf0ced-9f3c-a295-2cb8-0f3817416346@schaufler-ca.com> Date: Mon, 16 Jul 2018 11:23:38 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <8a325db8-e7eb-9581-2b77-fc987a165df7@schaufler-ca.com> Content-Language: en-US X-Mailman-Approved-At: Mon, 16 Jul 2018 14:38:37 -0400 Subject: [PATCH v1 11/22] LSM: Infrastructure management of the superblock security blob X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: "Schaufler, Casey" Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP LSM: Infrastructure management of the superblock security blob Move management of the superblock->sb_security blob out of the individual security modules and into the security infrastructure. Instead of allocating the blobs from within the modules the modules tell the infrastructure how much space is required, and the space is allocated there. Signed-off-by: Casey Schaufler --- include/linux/lsm_hooks.h | 1 + security/security.c | 34 ++++++++++++++++++- security/selinux/hooks.c | 56 ++++++++++++------------------- security/selinux/include/objsec.h | 6 ++++ security/selinux/ss/services.c | 3 +- security/smack/smack.h | 6 ++++ security/smack/smack_lsm.c | 35 +++++-------------- 7 files changed, 78 insertions(+), 63 deletions(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 12360f0ec8f7..789a7ef15736 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -2025,6 +2025,7 @@ struct lsm_blob_sizes { int lbs_cred; int lbs_file; int lbs_inode; + int lbs_superblock; int lbs_task; }; diff --git a/security/security.c b/security/security.c index 610cd57d11da..f1f10be13ef2 100644 --- a/security/security.c +++ b/security/security.c @@ -114,6 +114,7 @@ int __init security_init(void) pr_info("LSM: cred blob size = %d\n", blob_sizes.lbs_cred); pr_info("LSM: file blob size = %d\n", blob_sizes.lbs_file); pr_info("LSM: inode blob size = %d\n", blob_sizes.lbs_inode); + pr_info("LSM: superblock blob size = %d\n", blob_sizes.lbs_superblock); pr_info("LSM: task blob size = %d\n", blob_sizes.lbs_task); #endif /* CONFIG_SECURITY_LSM_DEBUG */ @@ -290,6 +291,7 @@ void __init security_add_blobs(struct lsm_blob_sizes *needed) { lsm_set_size(&needed->lbs_cred, &blob_sizes.lbs_cred); lsm_set_size(&needed->lbs_file, &blob_sizes.lbs_file); + lsm_set_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock); lsm_set_size(&needed->lbs_task, &blob_sizes.lbs_task); /* * The inode blob gets an rcu_head in addition to @@ -401,6 +403,27 @@ void lsm_early_inode(struct inode *inode) panic("%s: Early inode alloc failed.\n", __func__); } +/** + * lsm_superblock_alloc - allocate a composite superblock blob + * @sb: the superblock that needs a blob + * + * Allocate the superblock blob for all the modules + * + * Returns 0, or -ENOMEM if memory can't be allocated. + */ +int lsm_superblock_alloc(struct super_block *sb) +{ + if (blob_sizes.lbs_superblock == 0) { + sb->s_security = NULL; + return 0; + } + + sb->s_security = kzalloc(blob_sizes.lbs_superblock, GFP_KERNEL); + if (sb->s_security == NULL) + return -ENOMEM; + return 0; +} + /* * Hook list operation macros. * @@ -568,12 +591,21 @@ void security_bprm_committed_creds(struct linux_binprm *bprm) int security_sb_alloc(struct super_block *sb) { - return call_int_hook(sb_alloc_security, 0, sb); + int rc = lsm_superblock_alloc(sb); + + if (unlikely(rc)) + return rc; + rc = call_int_hook(sb_alloc_security, 0, sb); + if (unlikely(rc)) + security_sb_free(sb); + return rc; } void security_sb_free(struct super_block *sb) { call_void_hook(sb_free_security, sb); + kfree(sb->s_security); + sb->s_security = NULL; } int security_sb_copy_data(char *orig, char *copy) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 0f5066c94270..fdafe4184b42 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -333,7 +333,8 @@ static struct inode_security_struct *backing_inode_security(struct dentry *dentr static void inode_free_security(struct inode *inode) { struct inode_security_struct *isec = selinux_inode(inode); - struct superblock_security_struct *sbsec = inode->i_sb->s_security; + struct superblock_security_struct *sbsec = + selinux_superblock(inode->i_sb); /* * As not all inode security structures are in a list, we check for @@ -365,11 +366,7 @@ static int file_alloc_security(struct file *file) static int superblock_alloc_security(struct super_block *sb) { - struct superblock_security_struct *sbsec; - - sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL); - if (!sbsec) - return -ENOMEM; + struct superblock_security_struct *sbsec = selinux_superblock(sb); mutex_init(&sbsec->lock); INIT_LIST_HEAD(&sbsec->isec_head); @@ -378,18 +375,10 @@ static int superblock_alloc_security(struct super_block *sb) sbsec->sid = SECINITSID_UNLABELED; sbsec->def_sid = SECINITSID_FILE; sbsec->mntpoint_sid = SECINITSID_UNLABELED; - sb->s_security = sbsec; return 0; } -static void superblock_free_security(struct super_block *sb) -{ - struct superblock_security_struct *sbsec = sb->s_security; - sb->s_security = NULL; - kfree(sbsec); -} - static inline int inode_doinit(struct inode *inode) { return inode_doinit_with_dentry(inode, NULL); @@ -457,7 +446,7 @@ static int may_context_mount_inode_relabel(u32 sid, static int selinux_is_sblabel_mnt(struct super_block *sb) { - struct superblock_security_struct *sbsec = sb->s_security; + struct superblock_security_struct *sbsec = selinux_superblock(sb); return sbsec->behavior == SECURITY_FS_USE_XATTR || sbsec->behavior == SECURITY_FS_USE_TRANS || @@ -476,7 +465,7 @@ static int selinux_is_sblabel_mnt(struct super_block *sb) static int sb_finish_set_opts(struct super_block *sb) { - struct superblock_security_struct *sbsec = sb->s_security; + struct superblock_security_struct *sbsec = selinux_superblock(sb); struct dentry *root = sb->s_root; struct inode *root_inode = d_backing_inode(root); int rc = 0; @@ -559,7 +548,7 @@ static int selinux_get_mnt_opts(const struct super_block *sb, struct security_mnt_opts *opts) { int rc = 0, i; - struct superblock_security_struct *sbsec = sb->s_security; + struct superblock_security_struct *sbsec = selinux_superblock(sb); char *context = NULL; u32 len; char tmp; @@ -680,7 +669,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, { const struct cred *cred = current_cred(); int rc = 0, i; - struct superblock_security_struct *sbsec = sb->s_security; + struct superblock_security_struct *sbsec = selinux_superblock(sb); const char *name = sb->s_type->name; struct dentry *root = sbsec->sb->s_root; struct inode_security_struct *root_isec; @@ -935,8 +924,8 @@ static int selinux_set_mnt_opts(struct super_block *sb, static int selinux_cmp_sb_context(const struct super_block *oldsb, const struct super_block *newsb) { - struct superblock_security_struct *old = oldsb->s_security; - struct superblock_security_struct *new = newsb->s_security; + struct superblock_security_struct *old = selinux_superblock(oldsb); + struct superblock_security_struct *new = selinux_superblock(newsb); char oldflags = old->flags & SE_MNTMASK; char newflags = new->flags & SE_MNTMASK; @@ -968,8 +957,9 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb, unsigned long *set_kern_flags) { int rc = 0; - const struct superblock_security_struct *oldsbsec = oldsb->s_security; - struct superblock_security_struct *newsbsec = newsb->s_security; + const struct superblock_security_struct *oldsbsec = + selinux_superblock(oldsb); + struct superblock_security_struct *newsbsec = selinux_superblock(newsb); int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT); int set_context = (oldsbsec->flags & CONTEXT_MNT); @@ -1495,7 +1485,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent if (isec->sclass == SECCLASS_FILE) isec->sclass = inode_mode_to_security_class(inode->i_mode); - sbsec = inode->i_sb->s_security; + sbsec = selinux_superblock(inode->i_sb); if (!(sbsec->flags & SE_SBINITIALIZED)) { /* Defer initialization until selinux_complete_init, after the initial policy is loaded and the security @@ -1886,7 +1876,8 @@ selinux_determine_inode_label(const struct task_security_struct *tsec, const struct qstr *name, u16 tclass, u32 *_new_isid) { - const struct superblock_security_struct *sbsec = dir->i_sb->s_security; + const struct superblock_security_struct *sbsec = + selinux_superblock(dir->i_sb); if ((sbsec->flags & SE_SBINITIALIZED) && (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) { @@ -1917,7 +1908,7 @@ static int may_create(struct inode *dir, int rc; dsec = inode_security(dir); - sbsec = dir->i_sb->s_security; + sbsec = selinux_superblock(dir->i_sb); sid = tsec->sid; @@ -2066,7 +2057,7 @@ static int superblock_has_perm(const struct cred *cred, struct superblock_security_struct *sbsec; u32 sid = cred_sid(cred); - sbsec = sb->s_security; + sbsec = selinux_superblock(sb); return avc_has_perm(&selinux_state, sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad); } @@ -2697,11 +2688,6 @@ static int selinux_sb_alloc_security(struct super_block *sb) return superblock_alloc_security(sb); } -static void selinux_sb_free_security(struct super_block *sb) -{ - superblock_free_security(sb); -} - static inline int match_prefix(char *prefix, int plen, char *option, int olen) { if (plen > olen) @@ -2798,7 +2784,7 @@ static int selinux_sb_remount(struct super_block *sb, void *data) int rc, i, *flags; struct security_mnt_opts opts; char *secdata, **mount_options; - struct superblock_security_struct *sbsec = sb->s_security; + struct superblock_security_struct *sbsec = selinux_superblock(sb); if (!(sbsec->flags & SE_SBINITIALIZED)) return 0; @@ -2992,7 +2978,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, int rc; char *context; - sbsec = dir->i_sb->s_security; + sbsec = selinux_superblock(dir->i_sb); newsid = tsec->create_sid; @@ -3229,7 +3215,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name, return dentry_has_perm(current_cred(), dentry, FILE__SETATTR); } - sbsec = inode->i_sb->s_security; + sbsec = selinux_superblock(inode->i_sb); if (!(sbsec->flags & SBLABEL_MNT)) return -EOPNOTSUPP; @@ -6803,6 +6789,7 @@ struct lsm_blob_sizes selinux_blob_sizes = { .lbs_cred = sizeof(struct task_security_struct), .lbs_file = sizeof(struct file_security_struct), .lbs_inode = sizeof(struct inode_security_struct), + .lbs_superblock = sizeof(struct superblock_security_struct), }; static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { @@ -6828,7 +6815,6 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds), LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security), - LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security), LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data), LSM_HOOK_INIT(sb_remount, selinux_sb_remount), LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount), diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h index 7a3d18fa9b13..d64c4f6adb35 100644 --- a/security/selinux/include/objsec.h +++ b/security/selinux/include/objsec.h @@ -175,4 +175,10 @@ static inline struct inode_security_struct *selinux_inode( return inode->i_security; } +static inline struct superblock_security_struct *selinux_superblock( + const struct super_block *superblock) +{ + return superblock->s_security; +} + #endif /* _SELINUX_OBJSEC_H_ */ diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index dd2ceec06fef..7f9c87b077f3 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -52,6 +52,7 @@ #include #include #include +#include #include #include "flask.h" @@ -2766,7 +2767,7 @@ int security_fs_use(struct selinux_state *state, struct super_block *sb) struct sidtab *sidtab; int rc = 0; struct ocontext *c; - struct superblock_security_struct *sbsec = sb->s_security; + struct superblock_security_struct *sbsec = selinux_superblock(sb); const char *fstype = sb->s_type->name; read_lock(&state->ss->policy_rwlock); diff --git a/security/smack/smack.h b/security/smack/smack.h index 5da5bd1b9b47..d73e9def586c 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -372,6 +372,12 @@ static inline struct inode_smack *smack_inode(const struct inode *inode) return inode->i_security; } +static inline struct superblock_smack *smack_superblock( + const struct super_block *superblock) +{ + return superblock->s_security; +} + /* * Is the directory transmuting? */ diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index cdcbf205a52d..4f25fba4f4d3 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -519,12 +519,7 @@ static int smack_syslog(int typefrom_file) */ static int smack_sb_alloc_security(struct super_block *sb) { - struct superblock_smack *sbsp; - - sbsp = kzalloc(sizeof(struct superblock_smack), GFP_KERNEL); - - if (sbsp == NULL) - return -ENOMEM; + struct superblock_smack *sbsp = smack_superblock(sb); sbsp->smk_root = &smack_known_floor; sbsp->smk_default = &smack_known_floor; @@ -533,22 +528,10 @@ static int smack_sb_alloc_security(struct super_block *sb) /* * SMK_SB_INITIALIZED will be zero from kzalloc. */ - sb->s_security = sbsp; return 0; } -/** - * smack_sb_free_security - free a superblock blob - * @sb: the superblock getting the blob - * - */ -static void smack_sb_free_security(struct super_block *sb) -{ - kfree(sb->s_security); - sb->s_security = NULL; -} - /** * smack_sb_copy_data - copy mount options data for processing * @orig: where to start @@ -739,7 +722,7 @@ static int smack_set_mnt_opts(struct super_block *sb, { struct dentry *root = sb->s_root; struct inode *inode = d_backing_inode(root); - struct superblock_smack *sp = sb->s_security; + struct superblock_smack *sp = smack_superblock(sb); struct inode_smack *isp; struct smack_known *skp; int i; @@ -868,7 +851,7 @@ static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data) */ static int smack_sb_statfs(struct dentry *dentry) { - struct superblock_smack *sbp = dentry->d_sb->s_security; + struct superblock_smack *sbp = smack_superblock(dentry->d_sb); int rc; struct smk_audit_info ad; @@ -905,7 +888,7 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task) return 0; - sbsp = inode->i_sb->s_security; + sbsp = smack_superblock(inode->i_sb); if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) && isp->smk_task != sbsp->smk_root) return 0; @@ -1156,7 +1139,7 @@ static int smack_inode_rename(struct inode *old_inode, */ static int smack_inode_permission(struct inode *inode, int mask) { - struct superblock_smack *sbsp = inode->i_sb->s_security; + struct superblock_smack *sbsp = smack_superblock(inode->i_sb); struct smk_audit_info ad; int no_block = mask & MAY_NOT_BLOCK; int rc; @@ -1398,7 +1381,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name) */ if (strcmp(name, XATTR_NAME_SMACK) == 0) { struct super_block *sbp = dentry->d_sb; - struct superblock_smack *sbsp = sbp->s_security; + struct superblock_smack *sbsp = smack_superblock(sbp); isp->smk_inode = sbsp->smk_default; } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) @@ -1668,7 +1651,7 @@ static int smack_mmap_file(struct file *file, isp = smack_inode(file_inode(file)); if (isp->smk_mmap == NULL) return 0; - sbsp = file_inode(file)->i_sb->s_security; + sbsp = smack_superblock(file_inode(file)->i_sb); if (sbsp->smk_flags & SMK_SB_UNTRUSTED && isp->smk_mmap != sbsp->smk_root) return -EACCES; @@ -3288,7 +3271,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) goto unlockandout; sbp = inode->i_sb; - sbsp = sbp->s_security; + sbsp = smack_superblock(sbp); /* * We're going to use the superblock default label * if there's no label on the file. @@ -4561,6 +4544,7 @@ struct lsm_blob_sizes smack_blob_sizes = { .lbs_cred = sizeof(struct task_smack), .lbs_file = sizeof(struct smack_known *), .lbs_inode = sizeof(struct inode_smack), + .lbs_superblock = sizeof(struct superblock_smack), }; static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { @@ -4569,7 +4553,6 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(syslog, smack_syslog), LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security), - LSM_HOOK_INIT(sb_free_security, smack_sb_free_security), LSM_HOOK_INIT(sb_copy_data, smack_sb_copy_data), LSM_HOOK_INIT(sb_kern_mount, smack_sb_kern_mount), LSM_HOOK_INIT(sb_statfs, smack_sb_statfs),