From patchwork Thu Sep 20 00:20:45 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10607583 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BD8126CB for ; Thu, 20 Sep 2018 12:34:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AA98E2C9E2 for ; Thu, 20 Sep 2018 12:34:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9E1812C9EB; Thu, 20 Sep 2018 12:34:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI,NO_RDNS_DOTCOM_HELO,RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from upbd19pa10.eemsg.mail.mil (upbd19pa10.eemsg.mail.mil [214.24.27.85]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA256 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id A64A62C808 for ; Thu, 20 Sep 2018 12:34:27 +0000 (UTC) X-EEMSG-check-008: 169706735|UPBD19PA10_EEMSG_MP10.csd.disa.mil Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.3]) by upbd19pa10.eemsg.mail.mil with ESMTP; 20 Sep 2018 12:34:23 +0000 X-IronPort-AV: E=Sophos;i="5.53,398,1531785600"; d="scan'208";a="18464579" IronPort-PHdr: 9a23:5duivRR2PHwVR43VQGfps1ePVtpsv+yvbD5Q0YIujvd0So/mwa6/YxeFt8tkgFKBZ4jH8fUM07OQ7/i/HzRYqb+681k6OKRWUBEEjchE1ycBO+WiTXPBEfjxciYhF95DXlI2t1uyMExSBdqsLwaK+i764jEdAAjwOhRoLerpBIHSk9631+ev8JHPfglEnjWwba9wIRmssQndqtQdjJd/JKo21hbHuGZDdf5MxWNvK1KTnhL86dm18ZV+7SleuO8v+tBZX6nicKs2UbJXDDI9M2Ao/8LrrgXMTRGO5nQHTGoblAdDDhXf4xH7WpfxtTb6tvZ41SKHM8D6Uaw4VDK/5KpwVhTmlDkIOCI48GHPi8x/kqRboA66pxdix4LYeZyZOOZicq/Ye94VS3BBXsJMXCJfBI2yYZYEA+4YMepFs4Xxol0Dohy8Cga2BOPvzThIimbv0aAm3eksEBzK0BU8E94TrX/YqMv5OLsXXe2z0aLGzyjMb+lO1Dnj5ojGchMvr/+CUr1/c8Xf1FEvGgHYglietYPrMC2a1v8WvmiH7edtT/6jh3Ippg1vpDWk28ciipPOhoIQ0l3J6z92wJ0rKty4VUV1fMKrEJtKuCGHOYt2Rt0tQ3t1sys91rIJo4W7czYKyZk83B7Qd/yHfJKV4hLtUOaePy14iGt5d72lnRq97U+gyujlW8SyzV1ErTJFn8HRun0C2BHf8MiKRuZn8ku/1juDyRrf5vxcLU01l6fXMYMtz780m5YJsEnOHjX6lFvogKKZcEgv5/Km5P79Yrr8o5+RL4p0igbjPaswgsG/GuE4MhQWX2ic5OS8yKXv/U3nT7VOif07irXZv4rAJcQau665GBVZ0poj6hmjDzem184UnX8bI1JeZB2LlY3pO1DKIPzgDPe/hUqjkCtzyvzbMbDsDY/BI3jenLv7Y7pw5FBQxBAuwdxH4pJbELABIPb9Wk/rs9zYCwc0MxeqzObjCdV90J4eWG2WDqCCN6PSrFmI6f4xLOmXf4IVpDb8JOQl5/7pl3M5n0QdcrOz0ZsYb3C4AOxqI1+Fbnr0ntcBDWAKsxI8TOztjl2NSyJTZ3aoUKI6/Tw7CoWmDYHGRo+3m7yBwDm0HodNZmxcDVCMC3jofZ2eW/gQcCKSPtNhkjscWLijSY8uzw2htAzhy7pgKOrU+zMYuInt1Nhx+u3Smgo99SFyD8SBzmGBVWZ0nnkHRzUuxqBwvVR9ykuf0ah/m/FYDcJc6OhXXQc8NJ7c0+t6BsvzWg3fYNiGVkyqQtK8ATE+Vtgx2cMBY15hG9W+iRDOxzelA7gTl7yNGZM77Kbc33nqKsln1XnGzq4hg0MhQstVOm2snrR/+BTLB47Vj0WZkL6ndKod3C7J8WeM03COsVpWUAFuTKrFWmofaVHOrdTj4UPCTaGhBqg7Mgdbzs6CMKRKYMXzjVpaXPfjJMjeY2Wplme+HxaH3LWMY5bre2UGxyjdDVAEkwEK8XadOwk+HT2to2XEDDxhDVjveV/j8fFiqHOnSU851wKKYFdi17qy5x4Ynv+cROkQ3rIDpSctsTJ0HEyy39jOEdqPuxJhfLlAYdM6+FpIz3/WtxZ8PpO+NaBvnUQRfBhyv0/00BV3EIpAm9AwrHw21ApyNb6Y0FRZejyEx5/wPqPYKnLu/BGvbK7bwUre38qX+qgR7vQ4t1TjsxuzGkok7Xpnz8Ff02GA6ZXSEAoSTZXxX14t9xdnur7XeSY954bb1HF2N6m7rCPC0cozBOQ50hagY8tfMKScGQ/pHc0aHc+uKPc2m1WydRIEOudS9aAxP8y8cfuKwqirM/h8nDi+l2RI/Jh90l6Q9yp7UuPJ0YwKw/WE3gSZTTf8l0ysst7ploBefj4SA2+/xTLjBI5Laa14ZZwLBnu2I82r2tV+gIbgW3hZ9F6nA1MJxtSpdAGIYFPjxw1Q0l4boXu9mSu31zZ0iS0mrrKD3CzSxOTvbAcIOnJRS2l4llrjPY+0j9UGU0eydAgpiAGp5UDkyKhHvK5/NXXcQV9UfyjqKGFvSrWwtruebM5T75Moqz9bX/i8YVCdTL79rAAX0yfiH2tY3j87bTaqto/+nxxgh2KXNGxzo2bBecFs2Rff48TRRfpQ3jodWCl0kCLXCUa4P9mo+9WUipjCv/ulV2K5V51Tdyjrwp+btCeh421lHwG/leipmtL7CQg6zTP7195yWCXSqxb8Zo3r2LqgMe17eUlpCkTx69FnGo5iiYs8npYQ2WIVhp+N53oIjX/zMclH2aL5dHcNRiAEw9jO4AX+201sMHSJx5n/VnqD3sttfd66YnkZ2igl9cBFFL+U7KBYnStyule4tRjeYeV5njgD0fsh8ngag/0Xtwo31SidH6sSEldCPSz3jRiI9Ne+rLhNZGmzb7ew2k1+ncquDL6cuA1cXmj2eos6Fy9q8sp/KE7M0GH06oz8ZtnQa88cuwaKkxfGkudVKIg9lvwUiip7IWj9p2Eqy/YnjRxy2pG3pJCHJH9w/KK9GRNXKjz1Z98T+z30g6ZRhMCW05qoHpV7FTUBRIHoQu6wEDIOqfTnMB6DED48q3efB7XSBgqf6EBor3LBDZ+rK22XJHkezdVnWhaRPkpfjx4IXD8ihJ42ChiqxND9cEd+/j0R6ET3qh1QyuJvMhnySWnfqxm1ZTczUpiQNgJW7htF50fXL8OR8v5zEztf/p27owyHMnabaBhQDWEVRkyEAEjuPre05dbe7ueYHfCxL/3SYbWJsuxTTO2Hyo6q0od8+DaMLMqPNGF4D/InwkpDQWx5G8PBljoUUCMbkCbNb8+ApBeg4S17tNu//+r3Vw71/ouAFb9SMdRp+xCrjqaOLPKfhSZjKTZFzZMA33HJx6ID3F4JjCFucSOhEbMatS7CVKjQgLNYDwYHayNvM8tF97kz3ghCOc7cjNP4zaN3geAuBFdET1PhnNulZcsQI2GyLFnHHlqENKyaJT3XxMH6eaG8Sb1QjeVMsB2wvTebE1P9MTmYkjnpVgyvMftSgy2BOxxeoo69eA53CWf/VNLmdgG7MNhvgDIo2b07nGnKNW8HMTVna0NCtKeQ7SJDgvVnH2xO9GZqIveelyae9enYJY4cseF3DSRsi+Ja/HM6xqNT7C5aXvN1nDDfrt1po1G9jumA0DxnUAFNqjZKno6Lu1ttObnB/JlaRXnE5A4N7XmXCxkSvdtqFMbvtL5KxdjViK3zKCxP/MnV/csGGsfUL8yHMGI7MRX3GD/YFg0FQiC3NWvHnUxSjOmS9mGJrpg9spXjhYABSqFaVFMoDfMXEV5qHMYYIJdwUDIkiqCUg9IV5XqkrRnRWMVbsorBVv2MHfXlMCyZgqVcZxsU3bP4KpweNon820x4dFZ6moXLG03LUNBCpC1hcxU4oEJX8HhxVmczwV7qahux4H8PEv65hgU2hRV6YeQs8jfs/lg2K0HWqys3lUk+hc/qgSuNcDLrKqe/Q51WATLut0ctKpP7Xxp1bQqqkEN5KDjEQrVRj718dWx2kwLcp4VAGeRdTaxFZx8Qw+ubZ/M23lRAsi+n31NI5fPZCZt+kwsnaYKsr3NF2wJkcN41JazRKbFUwVhRhqOBpDSn2vo3wAAAO0YH6HmSdzIQuEwUKrkmIDKl8fZo6QyDhzRMZnADV/8qo/Js8UM9Pf6Pwjn73L5CME+xMfWTL62Eu2Tak86HXE8w3FsSl0ZZ5bh2zdsjc02MWk800rSREQ8EOtDfJgFLccVS7mPTcjyUseTN2551OJ+9Fu/wR++UqKkUml6kHBouH4kU9MQBGJis313YLcfgKL4F0g0j6h32KlufEPlHfwmGnysAo8G60JB4x5JdJi0HDWV7Lyq3+q7dphU2j/qbQNc2fnAaU5MYOXI0QsK1hzVUsGhHDDmz1uIZyRaN7yXgpivOEDb8b8BvZPCOZRNjENu24ykw87CqiV7L9ZXTP3v6Os54ut/I8uwXvIqHC+lOQrljrUjcn4hYR3qlU27LEN61KJjwa5UibdPuEHa6V0azizQrQMftJNytNLSHgRn0RYZIt4mWxD4iOdWhGTEeGhdwouAD67h/ZQAYYpo0fwDnuBokO6y4OgeY3c2kQ3yxJjtOU/lf0eK6aqRSzyU2dO+6y2UvTo07z+mx/k4AX58LgQvYxfm/Y4leVjXzFWFGewnVoyo2iXRhPP4owugj2BPIrUUcMzeTeexxb2xEu8szBUmcIHVxDmo4SUSRjY/E4g6rxLAd4TdSn8xT0e1eq3j+v5nfYD22VKyss5XVvDIqbcI6rK1pLYzjPsyGuYvEkTzFUZnQtBeJUC2hGvpbm9hQIT5YT+JSlWEjJ8MGpZJL6VAtWccmO7xPFK4sq6i2aTpjCC4f1jMZW5+F3DMZmOu83aXVlguIepQ4LBMEqIlCgscaUyNuYCMeo7GsWp7LmGCaUWgEPh0T7RhS6w0djINweP7q4JbQRp9W1zFWu+50UjfMFpRw61v0V3yZgVniR/WliOGmwQVSzPfw3dYBQx5/FVJRx+BImUs0MLt3MbUfvpbWsj+UckP3pHrtyPC6JFZL1MLUa0b1DJHCtWrhSC0T5WMbRYlTyHHFD5sSlxB1aKExpFVDOIqmYFrx5yQ4x4R1GLm1Tdukx1g5onoaRSqmDtRMBvp6v1LQXT1qf4qkqI75O5lIRG9f5oGdoU9DkEpxKy651YZcK8ZV7z4WQjdAvDWds8GuSMBY3c92CIEMLclht3jhH6NLJYaer2cwurPx1n/T4yo8v0uixDWvB6+4SPpU/3EEGgo3OWuRt1IiD/Yo8mfO6FDCqE50/+ZcBriLk0pxvCxxHpdUBjZGzXqlNUh8TGFas+VGL6TYa8lcTOM2ZR+rJRM+CeIm0FaT8kxvm3f2fTBythBG9C/HRwk7SzMZgrHzlj0CssunIyMVS4pUbTU9aCfIMwCbljpNvBZYcEFqX4oWAshe9rEewItU+tbCSUewJiEERhNiMBk43eBYlU5Zv0WSYTrdAhawdfbTrh13et+crMyzI/T/8gdHkITnv/0m+KgYW32pgwutQcvZr4PmsN2FqFeOfr/iM+KgeX/BUCTMjReoiLcrEpnK/izTMA5FJJl/0ncrfIbuBnXKPRtcIaIXPU1bVbp1ad9euOBVe9dkeLoV+a9qHh+HRBLvGIm0oflDMFnSRSrRLz+A8uy5roLf97rdRvb8ZsaU3XbIX7p3Potm6Tn8A7rq14te91H32vdr80N2U1nGMyaPrNT7PAwL/9WidlH/vpI1ATPWHY1wn2T3ykFHbcoXTDWg8I4Ex5NB9HbwVeV431D2sO1V8blk9YY37K5yxMexJKfdM/JavlF7AhmaAQVq7JYtAHNlS2BXfOARNO/bfb4FgsD2t+D3C6sX5QWR++xCbNvKJ1rMmsehBT6BThxEhh0OqSYALgub1f6KhbN7Sdq/qej+wEIt7EC0LgQaw7B1+YeE5q2IqffWbxrQ17cLQLTlS9jorrsyp0Od++ErmKQJemxvbA2tCPIdWdIFxmf80aAqyjohHNjCH7L79v9MTXA5njP8m5BlBVoWB/cUEKGX8oRZg2g3hfbWNsAMcqBFgGaADwSoErgYyX6k8yGXOnVqggnS0xHsRmO+9Ef2ojVkQSTQz9finE1VVqO0BUtLRCqmJ0t4sDKJPAr1u9v6orw141sqMmP4tNKMmmyhOKlUH8HlJ9yTPzM0pFQJg501XNCv3pobGdWlKtcL7H5+dufe63+skyJZrKdImYze4t2S+vXQGnWglLOVq7GMxDBe13g5skoy6tS+OfHU59yFWe6k12APQCdjowHBRQK6qqTHr1AIPkyGyEHLmI0WMdFe2Xk3zFrm6PIiQNI08wVeDZ3AaugHpT38Nzr421GfY8g4ViOGyTtYAkr1EUVkGKg7wG/ws97GlWzL+1ExW4d+eErphR1xD4UlJkMg81cXwi8ZHggLdx+XFraoBV7qLYEcT0gMdQyH3KSmeqcwxUBzwLSv5O/VbeBmG6UNNvJdjhOTk1laG5IWt7YeQLF9e1JG6q7XpxbiBJLjX/f7lHo8L/u1Td5G8coBrXst/h6/Rwa86ZdE97sbiY6IebRCYZXXuMB88lpo5T8IdixWmhR/iAm5Ue8EruD5/tfbqIao6vqpVKs1ReUY6RY0B2p6j5brjlEsu9fX2PlASoHPj4Tw7hxNKWaQuInGyxl8NfYOK4WzcbZv83UHICYfKGwKPdqScPQ8+ChtMDPS51NeGM8MY80XPNbVkwBOlkLpQK1T9tbcGlKADodzdsMo72nwyD0u85szSOXg6DiwJZ/B6VFBJfVDgztwlNjavuga3eLSCDQL4XmecxV62T2Ny5+RC/vr5uWMzNbUV08aHi4oTYhSOSCO+Qu9Ruq6jJ/pSB+b6tfvgJIic0KdXnKxk7oBsqZNCe5PlD723zlfFoDwgvKarcCs6G9JuVFdF4Zz9xLFEr1FPppnIRT4itWrRk9kCyrxYMHUbBsut/aIyeoX5uV+Nlf+ZZUFLR4ezLL683VVRBN0SLHqplaZQf4RZNx+RfPDqnBa95ltK7cLPFeHv5zqsjZIp0wqAA8zdrA/sCZWdk/Qkw1JQ6z0oqIPihMAUd5lvk9BAWawOGM45zraWqVZla2RCP0O8jWPVawDSERoPTl4QxOywplufKGpnf9fuGNcgix9uOQq0yBhRBakvC3jvb4C2TIh+LG+szUMomJFTuSYkyjWDVVDzfIKjboTCnr47ly8enYDZpPo4LZ7PcTg6ZUh43MnbBUhZSIGXuOgBDrrgqOVBIyPrNJchBmQuMXBbb+zMTIeNrIjxhL/X3J9yBTRnA508GsXRTWt9MQkJIu4Ock5xyelGnPWdEgS7aNTscvwtFkLTO0sZVNn3mpjzpvPeipYYPfqUzIxjw45eSBffZle8x4GBuwthTqVuqRu4A4ZenHXH56j942Wmt3Hjz11b95vy3meg6qfnJIxmClnntRu9C+VkHIbcuHZFch2DS63nrxygcj/Yei9+rQcRY9nzqmxeOMTOcmkv22t0dNlXVHzgvw6PH6ceLsHx7HGQ2KmRHeeVOCjbWeBhXA6P1T06B3uKUc4PoMCjUg9NKPggZ5VkRbsV/sgRCKQoxnZy2wqN/gXcSo9sYGgfQ0BRepXbO+Zc6xm4/AzExMnaHjKVX91BuKtulmqn6BwO29n5ETnZKLq6A+wdJOuFwUfDImSjpd39fXyEnqMP3B9zRs3P0Ru8erbP1V0suhCftCKlNvNnd091+NDde87dWUFs8MX0qdk7pOZmJOSeAzV5o77ONWQp/+fGfCZxEMvLCUSaaYUeQP44c0BO9c9X7DCVe9CsQ80GbkxQJtnMXz4sq5zMlU3OkTVZbKpkozkve6GeJZQj2HZ40h2LyrGvRAHjPuuQkYzO5SrgWjiZZ4rSj9fotlFFBRrBs1MFtkGog7hBISbzuXzotu8605r88MNu7DxG/nMnICw04J7RZlL7EqjMzPYBa0tiUNg2KD6p/bL0ZByDfTZcNcNwO4zFmvEYZfKH4q+KTWCfMTxZxgCu4WV1KxwThKLaWjcUrGBriSvPb0w+gM+x5d/ZuPYxWVzx77e0dr2IWpco3Hwg2SOMc505UfHFKTlVBJdVPSB/XwtSaYedobl3PwFMdU/ztyR+Ux45XJJ187TcPvplVPFxk8uLcGTF0DuwStsHNhSek7tOFYwgWLftnXWCGhdKc7hM8R2ndKJFUaxvBtMoU0GPUV5MzK0A9qcPHMUnce3ZQnM8QNPXLNh1/Wvdxsesau/AfJtJo0Dgf+j4b4Oitt4AzrERMFHMSXdNvp9N3xaCeCcwTpgeQYK5p4yXIp9fp2SOAUCOUaExzn1yF7J2Fb5ZvS336aAPSgS/28CxLuD2j9J9Gzb8e2BjJjFV7bUJIrzQOaUMCchUWSCQi8uFE+y5Vq+k+EDuvuTej9D5wlEJCmVDhUWvOZqpNnUSGXdw6tydZ0Ng7aRXCWjLU8wmKkzA3NTvFuXC7oYFAbQZmP8mmcUpgG4J/FN8H6kJ72Vz6ZYQaoXV6Nde/2eRJ3TfvVT X-IPAS-Result: A2DAAABUk6Nb/wHyM5BbHQEBBQELAYFQggUDgQhcKIwIX4tRgWiBHYFhk3UUgVsuEwGFBIJ+ITQYAQMBAQEBAQECAWwcDII1JIJgAwMBAiQTBgEBDCAMAgMJAQFACAgDAS0UAREGAQcFBgIBAQEYBIMAgWoDFQOYU4ocgWozgnUBAQWBBAEBdYJEA4JRCBeKWBeCAIESJwyCKoIJgncBEgGFd4g+CoVwMUaNQQmCDI4SHViIOYYRjmyHSzhkcU0jFTuCbIIZDBeDRoocAVVPewEBijqCPQEB Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 20 Sep 2018 12:34:22 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus.infosec.tycho.ncsc.mil [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w8KCYLuc025538; Thu, 20 Sep 2018 08:34:21 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id w8K0KwDE024231 for ; Wed, 19 Sep 2018 20:20:58 -0400 Received: from goalie.tycho.ncsc.mil (goalie.infosec.tycho.ncsc.mil [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w8K0Krht020773 for ; Wed, 19 Sep 2018 20:20:58 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1AVAAB15qJblywbGNZcHgEGDIFQggWBZyiDc4h0i1KBYAiBHYFhk3SBeoR3AkKCeSE0GAEDAQEBAQEBAhQBAQEBAQYYBkyFRQMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVA5lxihxvezOCdQEBBYEEAQF1gksDglEIF3SJYheCAIESJwyCKoIJhiuCV4g5CoVuMUaNNgmCDI4RHViINoYMjmqHSYINTSMVO4JsghkMDgkRgzSKHAFVT41sAQE X-IPAS-Result: A1AVAAB15qJblywbGNZcHgEGDIFQggWBZyiDc4h0i1KBYAiBHYFhk3SBeoR3AkKCeSE0GAEDAQEBAQEBAhQBAQEBAQYYBkyFRQMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVA5lxihxvezOCdQEBBYEEAQF1gksDglEIF3SJYheCAIESJwyCKoIJhiuCV4g5CoVuMUaNNgmCDI4RHViINoYMjmqHSYINTSMVO4JsghkMDgkRgzSKHAFVT41sAQE X-IronPort-AV: E=Sophos;i="5.53,396,1531800000"; d="scan'208";a="373932" Received: from emsm-gh1-uea10.ncsc.mil ([214.29.60.34]) by goalie.tycho.ncsc.mil with ESMTP; 19 Sep 2018 20:20:58 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0AUAAAv56JblywbGNZcHgEGDIFQggWBZyiDc4h0i1KBYAiBHYFhk3SBeoR3AkKCeSE0GAEDAQEBAQEBAgETAQEBAQEGGAZMDII1JIJgAwMjBBkBATgPJQImAgJFEgYBDAYCAQGDHYFqAxUDmXOKHG97M4J1AQEFgQQBAXWCSwOCUQgXdIliF4IAgRInDIIqggmGK4JXiDkKhW4xRo02CYIMjhEdWIg2hgyOaodJgg1NIxU7gmyCGQwOCRGDNIocAVVPjWwBAQ X-IPAS-Result: A0AUAAAv56JblywbGNZcHgEGDIFQggWBZyiDc4h0i1KBYAiBHYFhk3SBeoR3AkKCeSE0GAEDAQEBAQEBAgETAQEBAQEGGAZMDII1JIJgAwMjBBkBATgPJQImAgJFEgYBDAYCAQGDHYFqAxUDmXOKHG97M4J1AQEFgQQBAXWCSwOCUQgXdIliF4IAgRInDIIqggmGK4JXiDkKhW4xRo02CYIMjhEdWIg2hgyOaodJgg1NIxU7gmyCGQwOCRGDNIocAVVPjWwBAQ X-IronPort-AV: E=Sophos;i="5.53,396,1531785600"; d="scan'208";a="16038255" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from updc3cpa05.eemsg.mail.mil ([214.24.27.44]) by EMSM-GH1-UEA10.NCSC.MIL with ESMTP; 20 Sep 2018 00:20:57 +0000 X-EEMSG-check-005: 0 X-EEMSG-check-006: 000-001;5126de18-7462-4562-8640-18dd91e37621 Authentication-Results: UPDC3CPA04.eemsg.mail.mil; spf=None smtp.pra=casey@schaufler-ca.com; spf=None smtp.mailfrom=casey@schaufler-ca.com; spf=None smtp.helo=postmaster@sonic304-18.consmr.mail.bf2.yahoo.com; dkim=pass (signature verified) header.i=@yahoo.com X-EEMSG-check-008: 270651791|UPDC3CPA04_EEMSG_MP20.csd.disa.mil X-EEMSG-SBRS: 3.4 X-EEMSG-ORIG-IP: 74.6.128.41 X-EEMSG-check-002: true X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0BbAADy5qJbhimABkpcHgEGDIFQg2wog3OIdI0yCIEdgWGTdIF6hHcCQoJ5GQYGMBgBAwEBAQEBAQEBARMBAQEICwsIGw4jDII1JIJgAwMjBBkBATgPJQImAgJFEgYBDAYCAQGDHYFqAxWZdoocb3szgnUBAQWBBAEBdYJLA4JRCBd0iXmCAIESJwyCKgeCAoYrgleIOQqFbjFGjTYJggyOER1YiDaGDI5qh0mCDU0jFTuCbIIZDA4Jg0WKHAFVHzCNbAEB X-IPAS-Result: A0BbAADy5qJbhimABkpcHgEGDIFQg2wog3OIdI0yCIEdgWGTdIF6hHcCQoJ5GQYGMBgBAwEBAQEBAQEBARMBAQEICwsIGw4jDII1JIJgAwMjBBkBATgPJQImAgJFEgYBDAYCAQGDHYFqAxWZdoocb3szgnUBAQWBBAEBdYJLA4JRCBd0iXmCAIESJwyCKgeCAoYrgleIOQqFbjFGjTYJggyOER1YiDaGDI5qh0mCDU0jFTuCbIIZDA4Jg0WKHAFVHzCNbAEB Received: from sonic304-18.consmr.mail.bf2.yahoo.com ([74.6.128.41]) by UPDC3CPA04.eemsg.mail.mil with ESMTP; 20 Sep 2018 00:20:54 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1537402853; bh=63zMDkCGiN/Cue+xLhmzc4sjwheDuCpACLUPTkKzgr0=; h=Subject:To:References:From:Date:In-Reply-To:From:Subject; b=YjKjLkFTZv0ymwCLxVERz7nxvklonICl0hqT2WZ3vIRhqBoc5ltsWHMU0bnYhmgD2yhj6hkbyFal7UvRPCYi6hYCj4X4W7J2PPXaU1dJ33lWOTRxTrUoYeMG4aF3sfufRPd2QaEjW6z9CcnMcbK7wRZCFykkbTf41vHnXYccdJe5zJ3cE+S50CF9B8hI786jRyyO+dfQfbqF9kck7tsyo+BKTpQwAqB8Ob++6/gjvJ5auMhVyY5ddb1XZb7EpLAjLAgikXdJ0meu/E5tsIodNg7MnyCDdZ27FudmyLDNXFJfKriC25BnYwwSvoAhsUoWT/zs0994Gn0e+KPBtpzEYw== X-YMail-OSG: EEsGYqsVM1mkJ9toeXG0pgKi2AM_upvWEo6XC.E7ru831jyoKgKcqsXDhFv4d8C j.3Qk1GfPqaPZjKZqXS2kcnvnLkWEJ14Hkl03YQ5TTPV7Na9fx8lWSJtjAMWi3mm2OVLLA3VY5Nw uV8MA_V4o6GFCioHUVodlePceIzXjeCLYNz6Fl7NLAOxN.shA5dIZe08Lho.rZdshPUaS4hHEh3T bjMuxXcPaoSxeIAhMPSST9GLvNvQxGyo1RX.P8W.hhbmvnGzPX72kXri7roJ7Gf7tcf5r4JyVGsk MSrz1TLoA5UOSM1DOoG9OCGBEdMiiXxtFzoTzODMCDmgVp..F0dP2C0oRpc4KUgmTtjMFjucJV7Q 9f3Yj.xb9LzwKtF1aw.ak1BrlhtIj81HNzhZVpZP506vX070DoPua.thRmJXT_X2nLEp8mArVub. EzBgn6HBfwORN7Oe_ik9rfrFjXLwV9m_f_9_ZmtPcWkYQ64WrqDhVFGhAG3JAW.vsGW7WJOCg6q. HM.ZbPL3SQokyldNtwFkvoxJzDOgbX1hVBH.EchE8p9AEZnHBOZ8qjPdtPBX0Sx2Jz5_nViL06vb kyJ7AST17Xjo4.eDGwU6rKnV44tycbAqIIYcl.tIBLBFskdUtNXTBMnbh4_e3xipZHt3VXE0r0Ej 6n70MUpKSBsIaLLEpLUj8L6ul5jBxqPJEYk5OxyRw3VVtmBMsQRTWVdUFTY6vGINb.X8j7Hj.sEc LaCojh4Kooet0IBXqfaVff1TAI1OCsvKgXmPNJ.KeC1rfraKw8XfZwWzhaweXqyXAl5CsUS3miPg 4ViByucbV9Z.oD_XrFD5YzNujGV_y8tIowl2xMqS1.FinI0BdK_C957.K9M0bKOF52ee3JLU.aNZ KqbvuIaLAkNhObP6PfcvAPlEIUuM2oubFd2gIqy2l4OwtOrwS5.Hgsl7N283USNeB3GJtGc1PLuy tGJS9NknpK.ZlBO9MA4Oj._ZJuQQXUnLTnG3wVLWJhHOtxPRRw3En6wu9pYUeyWVQoVutS7DaicG eiI4S3hylu5Z.8XW71gOeeRs5LPJKJw3BK7_LfSxV1A-- Received: from sonic.gate.mail.ne1.yahoo.com by sonic304.consmr.mail.bf2.yahoo.com with HTTP; Thu, 20 Sep 2018 00:20:53 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO [192.168.0.102]) ([67.169.65.224]) by smtp417.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 7ce36f9ba6dc94867b03d0bc567514d6; Thu, 20 Sep 2018 00:20:48 +0000 (UTC) To: LSM , James Morris , SE Linux , LKLM , John Johansen , Kees Cook , Tetsuo Handa , Paul Moore , Stephen Smalley , "linux-fsdevel@vger.kernel.org" , Alexey Dobriyan , =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= , Salvatore Mesoraca References: <748c61cb-b6fa-c36d-a7b3-2315ff6292af@schaufler-ca.com> X-EEMSG-check-009: 444-444 From: Casey Schaufler Message-ID: <8a71b231-4284-f6d3-e3f2-7420cb96e6e2@schaufler-ca.com> Date: Wed, 19 Sep 2018 17:20:45 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <748c61cb-b6fa-c36d-a7b3-2315ff6292af@schaufler-ca.com> Content-Language: en-US X-Mailman-Approved-At: Thu, 20 Sep 2018 08:30:05 -0400 Subject: [PATCH v3 08/16] LSM: Infrastructure management of the cred security blob X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP LSM: Infrastructure management of the cred security blob Move management of the cred security blob out of the security modules and into the security infrastructre. Instead of allocating and freeing space the security modules tell the infrastructure how much space they require. Signed-off-by: Casey Schaufler --- include/linux/lsm_hooks.h | 14 ++++ security/Kconfig | 11 ++++ security/apparmor/lsm.c | 18 +++++ security/security.c | 106 +++++++++++++++++++++++++++++- security/selinux/hooks.c | 58 +++++----------- security/selinux/include/objsec.h | 2 + security/smack/smack_lsm.c | 85 +++++++++--------------- security/tomoyo/common.h | 2 +- security/tomoyo/tomoyo.c | 17 ++++- 9 files changed, 213 insertions(+), 100 deletions(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 97a020c616ad..0bef312efd45 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -2024,6 +2024,13 @@ struct security_hook_list { char *lsm; } __randomize_layout; +/* + * Security blob size or offset data. + */ +struct lsm_blob_sizes { + int lbs_cred; +}; + /* * Initializing a security_hook_list structure takes * up a lot of space in a source file. This macro takes @@ -2036,6 +2043,7 @@ struct security_hook_list { extern struct security_hook_heads security_hook_heads; extern char *lsm_names; +extern void security_add_blobs(struct lsm_blob_sizes *needed); extern void security_add_hooks(struct security_hook_list *hooks, int count, char *lsm); @@ -2082,4 +2090,10 @@ void __init loadpin_add_hooks(void); static inline void loadpin_add_hooks(void) { }; #endif +extern int lsm_cred_alloc(struct cred *cred, gfp_t gfp); + +#ifdef CONFIG_SECURITY +void lsm_early_cred(struct cred *cred); +#endif + #endif /* ! __LINUX_LSM_HOOKS_H */ diff --git a/security/Kconfig b/security/Kconfig index 27d8b2688f75..22f7664c4977 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -36,6 +36,17 @@ config SECURITY_WRITABLE_HOOKS bool default n +config SECURITY_LSM_DEBUG + bool "Enable debugging of the LSM infrastructure" + depends on SECURITY + help + This allows you to choose debug messages related to + security modules configured into your kernel. These + messages may be helpful in determining how a security + module is using security blobs. + + If you are unsure how to answer this question, answer N. + config SECURITYFS bool "Enable the securityfs filesystem" help diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 4f51705c3c71..c2566aaa138e 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1126,6 +1126,13 @@ static void apparmor_sock_graft(struct sock *sk, struct socket *parent) ctx->label = aa_get_current_label(); } +/* + * The cred blob is a pointer to, not an instance of, an aa_task_ctx. + */ +struct lsm_blob_sizes apparmor_blob_sizes = { + .lbs_cred = sizeof(struct aa_task_ctx *), +}; + static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check), LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme), @@ -1455,6 +1462,7 @@ static int __init set_init_ctx(void) if (!ctx) return -ENOMEM; + lsm_early_cred(cred); set_cred_label(cred, aa_get_label(ns_unconfined(root_ns))); task_ctx(current) = ctx; @@ -1540,8 +1548,18 @@ static inline int apparmor_init_sysctl(void) static int __init apparmor_init(void) { + static int finish; int error; + if (!finish) { + if (apparmor_enabled && security_module_enable("apparmor")) + security_add_blobs(&apparmor_blob_sizes); + else + apparmor_enabled = false; + finish = 1; + return 0; + } + if (!apparmor_enabled || !security_module_enable("apparmor")) { aa_info_message("AppArmor disabled by boot time parameter"); apparmor_enabled = false; diff --git a/security/security.c b/security/security.c index 3dfe75d0d373..ff7df14f6db1 100644 --- a/security/security.c +++ b/security/security.c @@ -41,6 +41,8 @@ struct security_hook_heads security_hook_heads __lsm_ro_after_init; static ATOMIC_NOTIFIER_HEAD(lsm_notifier_chain); char *lsm_names; +static struct lsm_blob_sizes blob_sizes; + /* Boot-time LSM user choice */ static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] = CONFIG_DEFAULT_SECURITY; @@ -85,10 +87,22 @@ int __init security_init(void) loadpin_add_hooks(); /* - * Load all the remaining security modules. + * The first call to a module specific init function + * updates the blob size requirements. + */ + do_security_initcalls(); + + /* + * The second call to a module specific init function + * adds hooks to the hook lists and does any other early + * initializations required. */ do_security_initcalls(); +#ifdef CONFIG_SECURITY_LSM_DEBUG + pr_info("LSM: cred blob size = %d\n", blob_sizes.lbs_cred); +#endif + return 0; } @@ -198,6 +212,73 @@ int unregister_lsm_notifier(struct notifier_block *nb) } EXPORT_SYMBOL(unregister_lsm_notifier); +/** + * lsm_cred_alloc - allocate a composite cred blob + * @cred: the cred that needs a blob + * @gfp: allocation type + * + * Allocate the cred blob for all the modules + * + * Returns 0, or -ENOMEM if memory can't be allocated. + */ +int lsm_cred_alloc(struct cred *cred, gfp_t gfp) +{ + if (blob_sizes.lbs_cred == 0) { + cred->security = NULL; + return 0; + } + + cred->security = kzalloc(blob_sizes.lbs_cred, gfp); + if (cred->security == NULL) + return -ENOMEM; + return 0; +} + +/** + * lsm_early_cred - during initialization allocate a composite cred blob + * @cred: the cred that needs a blob + * + * Allocate the cred blob for all the modules if it's not already there + */ +void lsm_early_cred(struct cred *cred) +{ + int rc; + + if (cred == NULL) + panic("%s: NULL cred.\n", __func__); + if (cred->security != NULL) + return; + rc = lsm_cred_alloc(cred, GFP_KERNEL); + if (rc) + panic("%s: Early cred alloc failed.\n", __func__); +} + +static void __init lsm_set_size(int *need, int *lbs) +{ + int offset; + + if (*need > 0) { + offset = *lbs; + *lbs += *need; + *need = offset; + } +} + +/** + * security_add_blobs - Report blob sizes + * @needed: the size of blobs needed by the module + * + * Each LSM has to register its blobs with the infrastructure. + * The "needed" data tells the infrastructure how much memory + * the module requires for each of its blobs. On return the + * structure is filled with the offset that module should use + * from the blob pointer. + */ +void __init security_add_blobs(struct lsm_blob_sizes *needed) +{ + lsm_set_size(&needed->lbs_cred, &blob_sizes.lbs_cred); +} + /* * Hook list operation macros. * @@ -998,17 +1079,36 @@ void security_task_free(struct task_struct *task) int security_cred_alloc_blank(struct cred *cred, gfp_t gfp) { - return call_int_hook(cred_alloc_blank, 0, cred, gfp); + int rc = lsm_cred_alloc(cred, gfp); + + if (rc) + return rc; + + rc = call_int_hook(cred_alloc_blank, 0, cred, gfp); + if (rc) + security_cred_free(cred); + return rc; } void security_cred_free(struct cred *cred) { call_void_hook(cred_free, cred); + + kfree(cred->security); + cred->security = NULL; } int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp) { - return call_int_hook(cred_prepare, 0, new, old, gfp); + int rc = lsm_cred_alloc(new, gfp); + + if (rc) + return rc; + + rc = call_int_hook(cred_prepare, 0, new, old, gfp); + if (rc) + security_cred_free(new); + return rc; } void security_transfer_creds(struct cred *new, const struct cred *old) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 82b28ee878c4..b629cc302088 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -212,12 +212,9 @@ static void cred_init_security(void) struct cred *cred = (struct cred *) current->real_cred; struct task_security_struct *tsec; - tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL); - if (!tsec) - panic("SELinux: Failed to initialize initial task.\n"); - + lsm_early_cred(cred); + tsec = selinux_cred(cred); tsec->osid = tsec->sid = SECINITSID_KERNEL; - cred->security = tsec; } /* @@ -3897,47 +3894,16 @@ static int selinux_task_alloc(struct task_struct *task, sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL); } -/* - * allocate the SELinux part of blank credentials - */ -static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp) -{ - struct task_security_struct *tsec; - - tsec = kzalloc(sizeof(struct task_security_struct), gfp); - if (!tsec) - return -ENOMEM; - - cred->security = tsec; - return 0; -} - -/* - * detach and free the LSM part of a set of credentials - */ -static void selinux_cred_free(struct cred *cred) -{ - struct task_security_struct *tsec = selinux_cred(cred); - - kfree(tsec); -} - /* * prepare a new set of credentials for modification */ static int selinux_cred_prepare(struct cred *new, const struct cred *old, gfp_t gfp) { - const struct task_security_struct *old_tsec; - struct task_security_struct *tsec; - - old_tsec = selinux_cred(old); - - tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp); - if (!tsec) - return -ENOMEM; + const struct task_security_struct *old_tsec = selinux_cred(old); + struct task_security_struct *tsec = selinux_cred(new); - new->security = tsec; + *tsec = *old_tsec; return 0; } @@ -6887,6 +6853,10 @@ static void selinux_bpf_prog_free(struct bpf_prog_aux *aux) } #endif +struct lsm_blob_sizes selinux_blob_sizes = { + .lbs_cred = sizeof(struct task_security_struct), +}; + static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr), LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction), @@ -6969,8 +6939,6 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(file_open, selinux_file_open), LSM_HOOK_INIT(task_alloc, selinux_task_alloc), - LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank), - LSM_HOOK_INIT(cred_free, selinux_cred_free), LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare), LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer), LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid), @@ -7126,11 +7094,19 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { static __init int selinux_init(void) { + static int finish; + if (!security_module_enable("selinux")) { selinux_enabled = 0; return 0; } + if (!finish) { + security_add_blobs(&selinux_blob_sizes); + finish = 1; + return 0; + } + if (!selinux_enabled) { pr_info("SELinux: Disabled at boot.\n"); return 0; diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h index 734b6833bdff..ad511c3d2eb7 100644 --- a/security/selinux/include/objsec.h +++ b/security/selinux/include/objsec.h @@ -25,6 +25,7 @@ #include #include #include +#include #include #include "flask.h" #include "avc.h" @@ -158,6 +159,7 @@ struct bpf_security_struct { u32 sid; /*SID of bpf obj creater*/ }; +extern struct lsm_blob_sizes selinux_blob_sizes; static inline struct task_security_struct *selinux_cred(const struct cred *cred) { return cred->security; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 68ee3ae8f25c..a06ea8aa89c4 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -309,29 +309,20 @@ static struct inode_smack *new_inode_smack(struct smack_known *skp) } /** - * new_task_smack - allocate a task security blob + * init_task_smack - initialize a task security blob + * @tsp: blob to initialize * @task: a pointer to the Smack label for the running task * @forked: a pointer to the Smack label for the forked task - * @gfp: type of the memory for the allocation * - * Returns the new blob or NULL if there's no memory available */ -static struct task_smack *new_task_smack(struct smack_known *task, - struct smack_known *forked, gfp_t gfp) +static void init_task_smack(struct task_smack *tsp, struct smack_known *task, + struct smack_known *forked) { - struct task_smack *tsp; - - tsp = kzalloc(sizeof(struct task_smack), gfp); - if (tsp == NULL) - return NULL; - tsp->smk_task = task; tsp->smk_forked = forked; INIT_LIST_HEAD(&tsp->smk_rules); INIT_LIST_HEAD(&tsp->smk_relabel); mutex_init(&tsp->smk_rules_lock); - - return tsp; } /** @@ -1958,14 +1949,7 @@ static int smack_file_open(struct file *file) */ static int smack_cred_alloc_blank(struct cred *cred, gfp_t gfp) { - struct task_smack *tsp; - - tsp = new_task_smack(NULL, NULL, gfp); - if (tsp == NULL) - return -ENOMEM; - - cred->security = tsp; - + init_task_smack(smack_cred(cred), NULL, NULL); return 0; } @@ -1982,10 +1966,6 @@ static void smack_cred_free(struct cred *cred) struct list_head *l; struct list_head *n; - if (tsp == NULL) - return; - cred->security = NULL; - smk_destroy_label_list(&tsp->smk_relabel); list_for_each_safe(l, n, &tsp->smk_rules) { @@ -1993,7 +1973,6 @@ static void smack_cred_free(struct cred *cred) list_del(&rp->list); kfree(rp); } - kfree(tsp); } /** @@ -2008,14 +1987,10 @@ static int smack_cred_prepare(struct cred *new, const struct cred *old, gfp_t gfp) { struct task_smack *old_tsp = smack_cred(old); - struct task_smack *new_tsp; + struct task_smack *new_tsp = smack_cred(new); int rc; - new_tsp = new_task_smack(old_tsp->smk_task, old_tsp->smk_task, gfp); - if (new_tsp == NULL) - return -ENOMEM; - - new->security = new_tsp; + init_task_smack(new_tsp, old_tsp->smk_task, old_tsp->smk_task); rc = smk_copy_rules(&new_tsp->smk_rules, &old_tsp->smk_rules, gfp); if (rc != 0) @@ -2023,10 +1998,7 @@ static int smack_cred_prepare(struct cred *new, const struct cred *old, rc = smk_copy_relabel(&new_tsp->smk_relabel, &old_tsp->smk_relabel, gfp); - if (rc != 0) - return rc; - - return 0; + return rc; } /** @@ -4652,6 +4624,10 @@ static int smack_dentry_create_files_as(struct dentry *dentry, int mode, return 0; } +struct lsm_blob_sizes smack_blob_sizes = { + .lbs_cred = sizeof(struct task_smack), +}; + static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(ptrace_access_check, smack_ptrace_access_check), LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme), @@ -4830,23 +4806,35 @@ static __init void init_smack_known_list(void) */ static __init int smack_init(void) { - struct cred *cred; + static int finish; + struct cred *cred = (struct cred *) current->cred; struct task_smack *tsp; if (!security_module_enable("smack")) return 0; + if (!finish) { + security_add_blobs(&smack_blob_sizes); + finish = 1; + return 0; + } + smack_inode_cache = KMEM_CACHE(inode_smack, 0); if (!smack_inode_cache) return -ENOMEM; - tsp = new_task_smack(&smack_known_floor, &smack_known_floor, - GFP_KERNEL); - if (tsp == NULL) { - kmem_cache_destroy(smack_inode_cache); - return -ENOMEM; - } + lsm_early_cred(cred); + /* + * Set the security state for the initial task. + */ + tsp = smack_cred(cred); + init_task_smack(tsp, &smack_known_floor, &smack_known_floor); + + /* + * Register with LSM + */ + security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), "smack"); smack_enabled = 1; pr_info("Smack: Initializing.\n"); @@ -4860,20 +4848,9 @@ static __init int smack_init(void) pr_info("Smack: IPv6 Netfilter enabled.\n"); #endif - /* - * Set the security state for the initial task. - */ - cred = (struct cred *) current->cred; - cred->security = tsp; - /* initialize the smack_known_list */ init_smack_known_list(); - /* - * Register with LSM - */ - security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), "smack"); - return 0; } diff --git a/security/tomoyo/common.h b/security/tomoyo/common.h index c9d8c49e3210..0110bebe86e2 100644 --- a/security/tomoyo/common.h +++ b/security/tomoyo/common.h @@ -1206,7 +1206,7 @@ static inline void tomoyo_put_group(struct tomoyo_group *group) */ static inline struct tomoyo_domain_info **tomoyo_cred(const struct cred *cred) { - return (struct tomoyo_domain_info **)&cred->security; + return cred->security; } /** diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c index 622ffa74a124..bb84e6ec3886 100644 --- a/security/tomoyo/tomoyo.c +++ b/security/tomoyo/tomoyo.c @@ -509,6 +509,10 @@ static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg, return tomoyo_socket_sendmsg_permission(sock, msg, size); } +struct lsm_blob_sizes tomoyo_blob_sizes = { + .lbs_cred = sizeof(struct tomoyo_domain_info *), +}; + /* * tomoyo_security_ops is a "struct security_operations" which is used for * registering TOMOYO. @@ -556,15 +560,26 @@ bool tomoyo_enabled; */ static int __init tomoyo_init(void) { + static int finish; struct cred *cred = (struct cred *) current_cred(); struct tomoyo_domain_info **blob; - if (!security_module_enable("tomoyo")) + if (!security_module_enable("tomoyo")) { + tomoyo_enabled = false; + return 0; + } + tomoyo_enabled = true; + + if (!finish) { + security_add_blobs(&tomoyo_blob_sizes); + finish = 1; return 0; + } /* register ourselves with the security framework */ security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo"); printk(KERN_INFO "TOMOYO Linux initialized\n"); + lsm_early_cred(cred); blob = tomoyo_cred(cred); *blob = &tomoyo_kernel_domain; tomoyo_mm_init();